Data Processing Agreement (DPA)

This agreement governs how we process the personal data of your venue’s customers and staff when you use Gnam. It is the agreement required by Art. 28 of EU Regulation 2016/679 (GDPR).

This is a translation. If it differs from the Italian version, the Italian version prevails.

The parties are:

• the restaurateur who uses Gnam for their business: the controller (“you”);
• CodeLab srls, Corso Giuseppe Garibaldi 22, 00034 Colleferro (RM), Italy, VAT number 17925991006, email info@codelab.email: the processor (“we”).

This agreement is part of the terms of service and is accepted together with them. If the terms and this agreement conflict on data protection, this agreement prevails.

1. Subject matter and duration

We process the personal data described in Annex 1 only to provide Gnam to you: back office, floor, kitchen, bookings, events, orders, bills, staff and the integrations you turn on.

This agreement lasts as long as the service contract. Obligations that by their nature continue afterwards (for example confidentiality and deletion of data) remain in force after the end.

2. Your instructions

We process the data only on your documented instructions. The instructions are:

• the terms of service and this agreement;
• the settings and actions you and your staff take in the back office (for example turning on an integration, enrolling a device, cancelling a booking);
• other written instructions you send us and we accept.

If the law requires us to process the data differently, we tell you beforehand, unless that law forbids it. If we think one of your instructions infringes the GDPR or other data protection rules, we tell you immediately.

3. Confidentiality

The people who may access the data on our behalf are authorised in writing, trained and bound by confidentiality. They access the data only when needed to provide the service, for the support you ask for or to fix a technical problem.

4. Security

We adopt the technical and organisational measures appropriate to the risk (Art. 32 GDPR) described in Annex 2. We may update them over time without lowering the level of protection.

5. Sub-processors

You give us a general authorisation to use other processors (sub-processors). The current ones are listed in Annex 3.

• Before adding or replacing a sub-processor, we notify you by email or in the back office at least 30 days in advance.
• You may object on reasonable data protection grounds within that period. If we find no solution, you may withdraw from the contract without penalty before the change applies.
• Each sub-processor is contractually bound by data protection obligations no less strict than these. We are liable to you for their performance.

The services you choose to connect (for example TheFork, Deliverect, your own Stripe account or your electronic cash register) are not our sub-processors: you turn them on, under your own contract, and we transmit data to them on your instruction.

6. Transfers outside the European Union

We transfer data outside the European Economic Area only with the safeguards of Chapter V GDPR: an adequacy decision (including the EU-U.S. Data Privacy Framework for certified providers) or the European Commission’s Standard Contractual Clauses. Annex 3 states the safeguard for each sub-processor.

7. Data subjects’ rights

The back office lets you view and correct your customers’ and staff’s data and delete what you no longer need. For what you cannot do yourself (for example a full copy of a data subject’s data), we help you on request.

If a data subject writes to us with a request concerning your venue’s data, we forward it to you within 5 working days and do not answer on the merits without your instruction. We help you, as far as reasonable, to answer within the legal deadlines.

8. Other assistance

We give you the information we hold that you need for:

• the security of processing (Art. 32);
• notifying and communicating breaches (Arts. 33 and 34);
• data protection impact assessments and prior consultation of the supervisory authority (Arts. 35 and 36), where needed.

9. Personal data breaches

If we discover a breach affecting your venue’s data, we notify you without undue delay and in any case within 48 hours of becoming aware of it. As soon as available, we give you:

• what happened, and which categories and approximate numbers of data subjects and records are involved;
• the likely consequences;
• the measures taken or proposed to remedy it and limit the harm;
• a contact for further information.

You decide whether to notify the supervisory authority and the data subjects; we help you.

10. End of processing

When the contract ends:

• if you ask us in writing before the end, we return the data to you in a commonly used format;
• within 90 days of the end we delete the personal data processed on your behalf (after returning it, if you asked);
• we keep only the data the law requires us to keep, for the required period;
• on request, we confirm the deletion in writing.

11. Records and audits

We keep the record of processing activities carried out on behalf of controllers (Art. 30(2) GDPR).

On your request we give you the information needed to show that we comply with this agreement. If that is not enough, you may carry out an audit, also through an independent auditor bound by confidentiality:

• with at least 30 days’ written notice;
• no more than once a year, except after a data breach or at the request of an authority;
• during working hours, without compromising the security and confidentiality of other customers’ data;
• at your expense.

12. Your commitments

As controller you undertake to:

• have a valid legal basis for the data you process with Gnam and inform your customers and staff;
• for special category data (for example allergies, or dietary needs related to health or religion written in a booking’s requests or add-ons), collect it only when needed and on the correct legal basis;
• decide how long to keep the data and delete from the back office what you no longer need;
• comply with employment law for your staff’s data, including, where needed, the rules of Art. 4 of the Italian Workers’ Statute (Law 300/1970);
• give us instructions that comply with the law.

13. Liability

Each party is liable under Art. 82 GDPR. Otherwise, the liability rules of the terms of service apply, within the limits allowed by law.

14. Governing law and court

This agreement is governed by Italian law. For the competent court, the terms of service apply.

Annex 1 — Description of the processing

Data subjects

• The venue’s customers: anyone who books, orders, pays or attends an event, including through connected services (for example TheFork or Deliverect), and the people named in the booking.
• The venue’s staff: the people the restaurateur authorises to use Gnam.

Data

The venue’s customers

• name, phone, email;
• date, time, party size, table, booking status, source (for example app, phone, TheFork);
• special requests and chosen add-ons (for example high chair, dietary needs), which may contain special category data about health or religious beliefs;
• orders, dishes, courses, bill, table sessions;
• payment data: amount, method, status, Stripe identifiers, receipt references. Never full card data;
• delivery orders received from connected services, with the data those services transmit;
• if the customer has a Gnam account, the link to their profile.

The venue’s staff

• name, email or username, phone (optional), password and PIN (only as hashes);
• role, permissions, shift status, assigned rooms;
• enrolled devices and sign-in sessions;
• activity log (audit);
• voice commands: audio (sent for transcription and not stored by us), transcript, outcome;
• operations carried out on the floor and in the kitchen (for example tables opened, courses delivered, timings).

Nature and purpose

Collection, recording, organisation, storage, consultation, alteration, transmission to the integrations you turn on, erasure. The only purpose is to provide the features of the service you use.

Duration

For the term of the contract, then as set out in Art. 10.

Annex 2 — Security measures

• EU infrastructure: Hetzner Online GmbH servers in the European Union. Database, cache and file storage run on servers we manage ourselves, not on third-party services.
• Network: a firewall that accepts from outside only web traffic (HTTPS) and administrative access from authorised addresses; internal services are not exposed to the internet.
• Encryption in transit: all public connections use HTTPS.
• Credentials: passwords, PINs, device secrets and refresh tokens are stored only as hashes. Session cookies are httpOnly and secure.
• Sessions: short-lived access tokens with rotating refresh; immediate revocation per device or per person; lockouts after too many wrong PIN attempts.
• Data separation: each venue sees only its own data; every request is filtered by venue.
• Permissions: configurable roles and permissions; nobody can assign a role equal to or higher than their own.
• Traceability: log of important operations (audit).
• Integrations: incoming notifications from Stripe, TheFork and Deliverect are verified with a cryptographic signature before being processed.
• Anti-abuse limits on public requests and on the assistant.
• Access by our personnel: only authorised people, with personal keys, bound by confidentiality and only when needed.
• Minimisation: we do not store the audio of voice commands, only the transcript and the outcome.

Annex 3 — Authorised sub-processors

Version 2026-09-24 · Last updated: 24 September 2026