GDPR Art. 28 · between the customer as controller and POSolid as processor
Version 2026-08-27 · This agreement is published in English and Polish. The German version is a translation provided for convenience; the other site languages show the English text.
This Data Processing Agreement forms part of the Terms and Conditions and applies whenever POSolid processes personal data on behalf of a customer. Accepting the Terms when you create an organization accepts this agreement. Where it conflicts with the Terms on a question of data protection, this agreement prevails.
The customer — the organization holding the POSolid account — is the controller of the personal data it and its staff enter into the service. POSolid is the processor of that data. For our own account, billing and support records we are the controller, and our Privacy Policy governs that processing.
We process the customer's personal data solely to operate the POSolid platform — taking and storing orders, printing receipts, running the kitchen display, reservations, inventory, staff scheduling, payroll calculation, reporting and the related support — for as long as the customer's subscription is in force, and for the further period stated in clause 10.
Data subjects: the customer's staff, the customer's guests where the customer records them, and the customer's own business contacts. Personal data: names and contact details, login credentials and PINs, roles and permissions, working time, absence and pay-rate data, reservation and order details, and technical data such as device and session identifiers. No payment card numbers are processed by POSolid; card data is handled by the payment provider. No special-category data is required by the service.
We process personal data only on the customer's documented instructions, including as to transfers, unless required otherwise by EU or member-state law — in which case we inform the customer before processing, unless that law prohibits it. The customer's configuration and use of the service constitutes such an instruction. If we consider an instruction to infringe data protection law, we will say so.
Everyone we authorise to process the customer's personal data is bound by an obligation of confidentiality that survives the end of their engagement, and is granted access only to what their work requires.
We implement appropriate technical and organisational measures under Art. 32 GDPR: encryption of traffic in transit, role- and permission-based access control, separation of each organization's data with an optional dedicated database, restricted internal access on a need-to-know basis, regular backups, and logging of administrative actions. We keep these measures under review as the service changes.
The customer gives general authorisation for us to engage sub-processors. They are a hosting provider, an email delivery provider, a payment provider and, for the optional AI menu tools, a translation provider and an image-recognition provider; the current list, naming each sub-processor and its role, is available on request at contact@posolid.com. We will give at least 30 days' notice by email before adding or replacing a sub-processor, and the customer may object on reasonable data-protection grounds; if the objection cannot be resolved, the customer may terminate the subscription and receive a pro-rata refund of the unused period. Each sub-processor is bound by obligations equivalent to those in this agreement, and we remain liable for their performance.
Application data is stored on servers in the European Union. Where a sub-processor processes personal data outside the European Economic Area, the transfer is made under the European Commission's Standard Contractual Clauses or an adequacy decision, together with any supplementary measures required.
The service gives the customer the tools to access, correct, export and delete personal data directly. Beyond that, we assist the customer with data-subject requests, with data protection impact assessments and prior consultation, and with the security and breach obligations of Art. 32 to 36 GDPR, taking into account the nature of the processing and the information available to us.
We notify the customer without undue delay after becoming aware of a personal data breach affecting personal data we process for them, with the information then available and further detail as it emerges, and we take reasonable steps to contain and remedy the breach.
The customer can export its business data from the settings panel at any time while the account is open. When the subscription ends, or a free trial lapses without payment, we retain the data for 30 days so an export can still be requested, and delete it afterwards; the customer may ask for earlier deletion. Deleting an organization removes its data from every service of the platform. Backups are purged as they are overwritten in rotation. We may keep data where EU or member-state law requires it, and only for as long as that law requires.
On request we make available the information needed to demonstrate compliance with Art. 28 GDPR. The customer may audit us, or mandate an independent auditor bound by confidentiality, once in any twelve-month period on 30 days' written notice, during business hours, without disrupting the service and at the customer's cost — and additionally after a personal data breach affecting their data.
This agreement runs for as long as we process personal data for the customer. It is published in English and Polish; if the two versions differ, the Polish version governs for customers contracting under Polish law and the English version governs for all others. Questions and requests under this agreement: contact@posolid.com.