What is a data processing agreement?

A data processing agreement is a document describing how a supplier handles personal data on behalf of a business. It is a legal requirement under the GDPR (the EU General Data Protection Regulation) when a business hands over the processing of customer or employee data to an external supplier – for example a digital POS or booking system.

Among other things, the agreement sets out which types of data are processed, how they are stored, who has access to them, and how the supplier ensures the data is not misused or leaked. It helps document that personal data is processed responsibly and in line with applicable data protection rules.

A practical example:

Imagine you run a café and use a POS system that stores information about your customers – for example name, phone number and any allergies in connection with table reservations. This information is stored by the system's supplier in the cloud. In that case you need a data processing agreement with the supplier describing how they protect and handle your customers' data.

Why is it important for you as a restaurateur?

When you collect and store personal data – e.g. from customers who book a table online or receive newsletters – you are responsible for that data being processed lawfully. But if you use an IT solution that handles data on your behalf, the technical supplier becomes a data processor. It is therefore your responsibility to make sure you have a correct, up-to-date data processing agreement in place.

Without this agreement you risk breaching the GDPR, which can lead to fines or lost customer trust. It is therefore a cornerstone of digital compliance and data protection.

How are data processing agreements used in Flexybox?

At Flexybox we take data protection seriously. When we supply our POS or booking system to restaurants, cafés and similar businesses, we always enter into a data processing agreement with our customers. This ensures that all customer data is processed in accordance with the GDPR and that the restaurateur meets their legal obligations as data controller. It is an important part of our work to ensure safe, professional operations for you and your guests.

Frequently asked questions

Yes, if the supplier processes personal data on behalf of your business – e.g. customer data or employee information – a data processing agreement is required by law.

As the owner of a restaurant or café, you are the data controller, because you determine the purpose and means of processing personal data. A data processor is a third party that processes data on your behalf.

Your IT supplier (e.g. of your POS system) should offer a data processing agreement as part of the contract. It is your responsibility to make sure it meets the requirements of the GDPR.

Not having a data processing agreement can mean you are not complying with the GDPR, which can lead to legal consequences and fines.