Data processing agreement (DPA)

For processing guest data on behalf of the venues, TischNow enters into a data processing agreement pursuant to Art. 28 GDPR. It is available in the dashboard as a self-service download and for digital signature.

Subject matter

Processing of personal guest data (name, contact, reservation history) to provide the reservation services.

Roles

The venue is the controller, Pixel & Process UG (haftungsbeschränkt) is the processor.

Subprocessors

All subprocessors are located in the EU (Hetzner, Stripe, EU mail provider, OpenAI EU/Mistral). Changes are notified in advance.

TOMs

Technical and organisational measures: encryption at rest and at field level, access concept, 2FA for the dashboard, PIN device mode, append-only audit log.

Deletion

Automatic deletion concepts: call audio after 30 days, guest profiles after configurable inactivity, audit logs after 12 months.