Data Processing Agreement (DPA)
This agreement forms part of the Terms of use for venues. It governs how we process the personal data of guests and staff on behalf of the venue, in line with the BiH Law on Personal Data Protection and the EU General Data Protection Regulation (GDPR).
Effective from 01.11.2026
Translation. The Bosnian version is legally binding. Show the Bosnian version
1. Roles
The venue is the controller of the personal data of its guests and staff processed in ServedSoul. SoulGrid Solutions, Sarajevo is the processor and processes that data only on behalf of and on the documented instructions of the venue.
The venue’s instructions are these terms, the settings the venue chooses in ServedSoul, and written requests to info@soulgridsolutions.com.
2. Subject, duration and purpose
The subject is the provision of ServedSoul (ordering, staff work, payments, statistics, stock, shifts, help with payroll). Processing lasts as long as the contract of use and for 30 days after it ends (data export).
3. Types of data and data subjects
| Data subjects | Data |
|---|---|
| Guests | orders and items, table, time, notes, the result of the GPS check when sending the order, bill and payment method; for registered guests name and e-mail; allergen and diabetes data only with the guest’s explicit consent for that venue |
| Staff | name, e-mail, role, PIN (hash only), shifts and work records, performance (prepared and served items), payroll data entered by the venue |
| Owner and managers | name, e-mail, phone, sign-ins, activity log |
Health data (allergens, diabetes) is a special category of data. It is sent to the venue only with the guest’s explicit, separate and revocable consent, and is visible only to that venue’s staff alongside the order.
4. Processor obligations
- we process data only on the venue’s instructions unless the law requires otherwise (we inform the venue where permitted);
- everyone with access to data on our behalf is bound by confidentiality;
- we apply appropriate technical and organisational measures (section 5);
- we help the venue respond to data subject requests (access, rectification, erasure, portability, objection);
- we notify the venue of a personal data breach without undue delay, at the latest within 48 hours of becoming aware of it, with the information needed to report it to the authority;
- on request we give the venue the information needed to demonstrate compliance.
5. Security measures
- encrypted connection (HTTPS) for all traffic;
- passwords and PINs stored only as one-way hashes; two-step sign-in secrets encrypted; recovery codes stored only as hashes;
- mandatory two-step sign-in for owners, managers and the platform administrator;
- strict separation of data per venue at application level;
- role-based access rights and hierarchical approval for sensitive actions (voids, discounts, stock corrections, payroll);
- a log of actions affecting money, stock, prices, payroll or access;
- administrator access only through remote support, with valid access from the venue, with notification to the owner and a full record;
- regular backups and automatic deletion of data that is not kept (live events after 48 hours, guest sessions after 12 hours).
6. Sub-processors
To provide the service we use a web hosting provider (Verpex) and an e-mail delivery provider. The venue agrees to their engagement.
We send an up-to-date list of sub-processors with their processing locations on request to info@soulgridsolutions.com. We inform the venue of any new sub-processor at least 30 days in advance; the venue may raise a justified objection.
If data is transferred outside BiH and the EU/EEA, we do so only with appropriate safeguards (e.g. standard contractual clauses).
7. Remote support
The platform administrator accesses the venue’s data only through remote support, in the mode the venue has chosen, and only as far as needed to solve the problem. Every access and every change is recorded and visible to the owner.
8. End of processing
After the contract ends the venue can download an export of its data for 30 days. We then delete the data permanently unless the law requires it to be kept. Copies disappear when backups rotate out.
9. Other provisions
The liability, governing law and jurisdiction provisions of the Terms of use for venues apply to this agreement. The Bosnian version is binding.