Data Processing Agreement
Last updated: 23 October 2026
Part of the Terms of Service. Between the restaurant using AVA (the Controller) and SIA "AVA Systems", reg. no. 40003309926, VAT no. LV40003309926, Stopiņu iela 22, Rīga, LV-1035, Latvia (the Processor). This agreement meets Article 28 of the GDPR.
1. Subject and duration
The Processor processes personal data on the Controller's behalf only to provide AVA, as described in the Terms of Service, for as long as the Controller uses AVA and until the data is deleted or returned (§10).
2. What is processed
- Whose data: the Controller's guests (people who book, join a waitlist, buy gift cards or receive campaign emails) and the Controller's staff.
- What data: names, phone numbers and email addresses; booking and waitlist details; visit and no-show history and staff notes; payment state and the terms the guest agreed to (never card numbers); gift-card codes, balances and company invoice details; marketing consent.
- No special categories intended. If the Controller writes such data into notes (for example an allergy), the Controller is responsible for having a lawful basis to do so.
- Purpose: managing reservations, tables, payments, gift cards and guest communication for the Controller.
3. Instructions
The Processor acts only on the Controller's documented instructions: the Terms of Service and the Controller's settings and actions in AVA. It tells the Controller if it believes an instruction breaks data-protection law.
4. Confidentiality
Everyone at the Processor with access to the data is bound to confidentiality.
5. Security (Article 32)
Encryption in transit (HTTPS); one-way hashing of passwords; encryption of stored payment keys; role-based access; an activity log of changes; separation of each Controller's data from every other's; backups through the database provider.
6. Sub-processors
The Controller agrees that the Processor may use the providers below. Stripe processes payments in the Controller's own Stripe account under the Controller's own agreement with Stripe. The Processor gives 30 days' notice by email before adding or replacing a sub-processor; the Controller may object and, if no solution is found, end the service without penalty and without the notice period. The Processor imposes the same data-protection duties on its sub-processors and remains responsible for them.
| Provider | What it does for AVA | Where |
|---|---|---|
| Render | Hosts the AVA server. | region being confirmed |
| Neon | The database. | region being confirmed |
| Resend | Sends the emails (confirmations, reminders, gift cards, campaigns). | United States (Standard Contractual Clauses) |
| Stripe | AVA's own subscription billing, and the payments taken in each restaurant's own Stripe account. | EU / United States (Standard Contractual Clauses) |
| Cloudflare | The network in front of the site, for speed and protection against attacks; on the sign-up page, a check that stops bots (Turnstile), when switched on. | Global network (Standard Contractual Clauses) |
| OpenStreetMap (Nominatim) | Looks up a restaurant's street address when staff search for it in Settings. Only the typed address is sent. | United Kingdom (adequacy decision) |
7. Transfers outside the EEA
Only where covered by an adequacy decision or the European Commission's Standard Contractual Clauses.
8. Helping the Controller
As far as it reasonably can, the Processor helps the Controller answer data-subject requests (mostly through tools in AVA itself: editing, deleting and exporting) and with security, breach notification, impact assessments and consultations with the supervisory authority.
9. Breaches
The Processor notifies the Controller without undue delay, and where possible within 48 hours, after becoming aware of a personal-data breach affecting the Controller's data, with what is known: its nature, the data and people affected, likely consequences and the measures taken.
10. End of processing
When the Controller closes its account down, the Processor permanently deletes the Controller's data, unless the law requires keeping it (such as invoices). The Controller can export its data first. Backups expire on the database provider's normal cycle, at most 30 days.
11. Audits
The Processor makes available the information needed to show compliance and allows reasonable audits with at least 30 days' notice, at the Controller's cost, at most once a year unless a breach has occurred.
12. Law
Governed by Latvian law, like the Terms of Service.