Data Processing Agreement (Art. 28 GDPR)

Last updated: 29 October 2026 · Part of the Terms of Use

between the business using Menü Uyum (the "Controller") and Menümde ([Şahıs işletmesi / Ltd. Şti.]), Istanbul, Türkiye (the "Processor"). The agreement applies as soon as the Controller switches on table ordering, pickup or in-app waiter calls, and ends with the service contract.

1. Subject matter, nature and purpose

The Processor runs a digital menu with ordering and waiter calls for the Controller. It processes guest data only to pass orders and calls to the Controller's staff, show their status, and delete them when the retention periods end.

2. Types of data and data subjects

Data subjects: the Controller's guests; the Controller's staff who use the staff screen.
Data: dishes ordered, quantities, prices, an optional note to the kitchen (which may contain health information such as allergies), table or pickup number, times and status, a random device code, and the IP address briefly, to prevent abuse. Also an optional first name or nickname the guest chooses to enter (so staff can keep separate bills at the table). No phone numbers or payment data are collected. If a guest or staff member allows notifications: the push address and keys created by the browser.

3. Instructions

The Processor processes the data only on documented instructions from the Controller; the account settings and this agreement are such instructions. If it considers an instruction unlawful, it informs the Controller without delay. Where the law requires processing, it informs the Controller beforehand unless the law prohibits this.

4. Confidentiality

Persons with access to the data are bound to confidentiality. Only those who need access to run the service receive it.

5. Technical and organisational measures (Art. 32 GDPR)

Encrypted transfer (HTTPS); passwords stored only as a one-way hash; two-factor secrets encrypted (AES-256-GCM).
Two-factor authentication required for administration; lockout after repeated failed logins; request limits per IP address.
Separation of customers: each business sees only its own data; the staff screen requires a login or a secret key.
Content Security Policy, protection against cross-site request forgery, secure cookie settings.
Logging of security-relevant events (about 24 months); daily backups, the last 30 kept.
Automatic deletion: waiter calls after 30 days, orders after 90 days, table sessions 7 days after the last activity, guests' push addresses after 12 hours. Notifications are end-to-end encrypted (RFC 8291) and delivered through each browser's push service.

The Processor may develop these measures further as long as the level of protection does not decrease.

6. Sub-processors

The Controller authorises the following sub-processors:

[Hosting firması, ülke]: hosting and backups.

Guest data is not sent to DeepL or any other third party (only menu texts are translated). The Processor gives at least 30 days' written notice of new or replaced sub-processors; the Controller may object on reasonable data protection grounds and, in that case, terminate the agreement. The Processor imposes the same obligations on its sub-processors.

7. Transfers to third countries

Where the Processor or its servers are located outside the EU/EEA, transfers are based on the EU Standard Contractual Clauses (Implementing Decision (EU) 2021/914, Module 2: controller to processor), which the parties conclude in addition. In case of conflict, the Standard Contractual Clauses prevail.

8. Assistance

The Processor assists the Controller with data subject requests (Art. 15–22 GDPR), data protection impact assessments and breach notifications. If a guest contacts the Processor directly, it forwards the request to the Controller.

9. Personal data breaches

The Processor notifies the Controller of a breach without undue delay, where possible within 48 hours of becoming aware of it, with the information listed in Art. 33(3) GDPR as far as available.

10. Deletion and return

After the agreement ends, the Processor deletes guest data no later than at the end of the periods above; copies in backups are deleted as the backups rotate. Before the end, the Controller can view order data in the account; return in another format is available on request.

11. Evidence and audits

The Processor makes available the information needed to demonstrate compliance and allows audits by the Controller or an appointed auditor, with reasonable notice, during business hours and without disrupting operations.

12. Final provisions

In data protection matters this agreement prevails over the Terms of Use. Liability is governed by Art. 82 GDPR.

Contact: iletisim@menumde.com · Privacy Policy · Legal notice