Parties and formation
Controller: the customer, i.e. the venue operator that has entered into an agreement to use Rezervos.
Processor: Vít Kilián, Company ID (IČO) 21125511, registered office at Na Vršku 230/14, 321 00 Plzeň – Litice, Czech Republic, registered in the Czech Trade Licensing Register maintained by the Plzeň City Hall.
This Agreement is concluded when the Controller accepts the Terms of Service on account creation, of which it forms an integral part. A signed counterpart is issued on request to gdpr@kilivi-dev.cz.
1. Subject matter, nature, purpose and duration
The Processor processes personal data solely to provide the Service: managing reservations and capacity, sending confirmations and reminders by email and SMS, operating the venue website, and displaying statistics to the Controller.
The nature of processing comprises collection, storage, access, modification, erasure and disclosure to the sub-processors listed in Article 7.
Processing lasts for the duration of the Controller's subscription and ends as set out in Article 13.
2. Categories of data subjects and personal data
Data subjects: guests and clients of the Controller who make a reservation, and persons to whom the Controller grants system access.
Categories of data: identification and contact details (name, email, phone), reservation data (date, time, party size, service, assigned staff), the content of the free-text reservation note, communication history and technical operational data.
A detailed list is set out in Annex A.
3. Controller instructions and responsibility
The Processor processes personal data only on documented instructions from the Controller, including as regards transfers to a third country, unless required to do so by Union or Member State law; in that case the Processor informs the Controller of that legal requirement beforehand, unless the law prohibits it.
Use of the Service in accordance with its documentation, and the settings made by the Controller in the administration interface, constitute such instructions.
The Controller is responsible for the lawfulness of data collection, for informing data subjects under Arts. 13 and 14 GDPR, and for the legal basis of processing.
The Processor immediately informs the Controller if, in its opinion, an instruction infringes the GDPR or other data protection provisions.
4. Special categories of personal data
The Service is not intended for processing special category data under Art. 9 GDPR.
Where the Controller enables a free-text note for guests, health data (such as an allergy) may be entered into it. The Controller undertakes to display an appropriate notice on that field, or to obtain the data subject's explicit consent under Art. 9(2)(a) GDPR.
The Processor merely stores such data as part of the reservation content and subjects it to no further analysis.
5. Processor obligations
The Processor undertakes to:
• process data only on the Controller's instructions (Art. 28(3)(a)),
• ensure that persons authorised to process the data are bound by confidentiality (point b),
• implement the measures required by Art. 32 GDPR (point c) as set out in Annex B,
• respect the conditions for engaging another processor set out in Article 7 (point d),
• assist the Controller by appropriate measures in responding to data subject rights requests (point e),
• assist the Controller in ensuring compliance with Arts. 32 to 36 GDPR (point f),
• delete or return the data after the end of processing as set out in Article 13 (point g),
• make available all information necessary to demonstrate compliance and allow for audits under Article 11 (point h).
6. Confidentiality
The Processor ensures that every person involved in processing is bound by confidentiality, contractually or by a statutory obligation. That obligation survives the end of their engagement with the Processor.
7. Sub-processors
The Controller grants the Processor general authorisation to engage sub-processors. As at the effective date these are:
• Stripe Payments Europe, Ltd. / Stripe, Inc. — payment gateway, invoicing (Ireland / USA, standard contractual clauses)
• SmsManager.cz (Quanda International s.r.o.) — sending SMS reminders (Czech Republic)
• Railway Corp. — application and database hosting (EU (eu-west region) / USA, standard contractual clauses)
• Google Ireland Ltd. (reCAPTCHA) — bot protection for forms (Ireland / USA, standard contractual clauses)
• Cloudinary Ltd. — image storage and delivery (EU / USA, standard contractual clauses)
• Functional Software, Inc. (Sentry) — application error monitoring (USA, standard contractual clauses)
The Processor imposes on each sub-processor the same data protection obligations as set out here and remains fully liable to the Controller for their performance.
The Processor notifies the Controller by email at least 30 days before any intended change of sub-processors. Within that period the Controller may object in writing on serious data protection grounds. Failing agreement, the Controller may terminate the subscription without penalty as of the effective date of the change.
8. Security of processing (Art. 32 GDPR)
The Processor has implemented and maintains the technical and organisational measures described in Annex B, and reviews and adapts them to current risks and the state of the art.
9. Personal data breach
On becoming aware of a personal data breach, the Processor notifies the Controller without undue delay and no later than 72 hours.
The notification describes the nature of the breach, the categories and approximate number of data subjects and records concerned, the likely consequences, and the measures taken or proposed.
Notification to the supervisory authority and to data subjects is made by the Controller; the Processor provides the necessary cooperation.
10. Assistance to the Controller
The Processor provides tools in the Service administration through which requests for access, rectification, erasure and portability can be handled.
Where a request cannot be handled with those tools, the Processor provides assistance within 10 business days of the Controller's request.
The Processor also assists with data protection impact assessments and prior consultation with the supervisory authority (Arts. 35 and 36 GDPR).
11. Audit and inspection
On request the Processor makes available the information necessary to demonstrate compliance with Art. 28 GDPR, normally in the form of current documentation of its security measures.
The Controller may conduct an audit, including an inspection, once per 12 months and additionally at any time following a personal data breach. Audits are announced at least 14 days in advance, take place during business hours, and are conducted so as not to disrupt the Service or expose other customers' data.
Audits are performed by the Controller or an auditor it appoints who is bound by confidentiality. Audit costs are borne by the Controller unless the audit reveals a material breach by the Processor.
12. Transfers outside the EU/EEA
Transfers to a third country occur only to the sub-processors listed in Article 7 and are safeguarded by the European Commission's standard contractual clauses under Art. 46(2)(c) GDPR, supplemented by a transfer impact assessment and any supplementary measures.
13. Deletion and return of data
After the Service ends the Processor makes a machine-readable data export available to the Controller for 30 days.
After that period the Processor deletes or anonymises all personal data, including in backups within their normal rotation cycle and no later than 90 days. This does not apply where Union or Member State law requires storage; in that case the Processor only continues to store the data.
The Processor confirms deletion in writing on request.
14. Liability and duration
This Agreement is effective for the duration of the subscription and, as regards confidentiality and deletion obligations, thereafter.
Liability is governed by Art. 82 GDPR. The limitation of liability in the Terms of Service does not apply to obligations under this Agreement to the extent such limitation would conflict with mandatory law.
This Agreement is governed by Czech law.
Annex A — Detailed scope of processing
Data subjects: guests and clients of the Controller; employees and contractors of the Controller with system access.
Categories of data: name; email; phone number; reservation date and time; party size; selected service or table; assigned staff; free-text reservation note; communication language; history of notifications sent; IP address and access time for user accounts.
Purpose: operation of the reservation system and related communication with data subjects on behalf of the Controller.
Duration: for the term of the Controller's subscription plus 30 days; backups no longer than 90 days.
Annex B — Technical and organisational measures
• Encryption in transit using TLS 1.2 or higher; encryption of data at rest.
• Role-based access control, least-privilege principle, multi-factor authentication for administrator accounts.
• Logical isolation of each customer's data in the multi-tenant environment.
• Audit logs of access and changes, retained for 90 days.
• Regular database backups with restore verification; backups stored encrypted.
• Availability and error monitoring, and vulnerability monitoring of dependencies.
• Documented security incident procedure including notification to the Controller within 72 hours.
• Contractual confidentiality obligations for everyone with access to data.
• Periodic review and update of the measures in place.