Data processing agreement

1. Parties and roles

This agreement covers the personal data that Finnzon (business ID 2849466-3, Espoo) (“Tastiana”) processes on behalf of a restaurant using the Tastiana Guide service (the “Customer”). The Customer is the controller and Tastiana the processor under Article 28 of the EU General Data Protection Regulation (GDPR).

This agreement forms part of the terms of service and takes effect when the Customer starts using the service. For the Customer’s own user accounts, billing and contact requests, Tastiana is an independent controller, as described in the privacy notice.

2. Subject matter, nature and purpose

Tastiana provides a restaurant guide that the Customer embeds on its own website. Personal data is processed only to show the guide to guests, answer their questions, produce aggregate usage statistics and limit abuse.

The data is not used for marketing, advertising, profiling or training AI models. Bookings are made in the Customer’s own booking service, and Tastiana does not collect the details of the person booking.

3. Data subjects and personal data

The data subjects are visitors to the Customer’s website who open the guide. The data processed is:

• technical data needed to deliver the service, such as the IP address and browser details
• a random session identifier created in the browser, which disappears when the tab is closed
• questions guests type into the guide and the answers generated for them
• guide usage events, such as opening the menu or tapping the booking button.

Special categories of personal data are not requested, although a guest may mention, for example, a food allergy in a question. The guide never judges allergy safety and always tells guests to check with the staff.

4. Retention

• Questions and answers are processed only while the answer is produced. Tastiana does not store them in its database or logs.
• To limit abuse, the IP address and session identifier are stored only as a keyed hash, deleted within one day after the limit window ends.
• To recognise frequently asked topics, the session identifier’s hash and the question’s general topic (for example gluten-free) are stored, never the question text. This is kept for the duration of the agreement.
• Usage statistics are stored as daily counts that cannot identify an individual guest.

OpenAI may keep data sent through its API for up to 30 days for abuse monitoring and does not use it to train its models.

5. Tastiana’s obligations

Tastiana processes personal data only on the Customer’s documented instructions, which are these terms and the settings the Customer makes in the service. Tastiana informs the Customer if it considers an instruction to infringe data protection law.

Tastiana ensures that the people processing personal data are bound by confidentiality. Tastiana assists the Customer with reasonable measures in responding to data subject requests and in meeting its obligations under GDPR Articles 32–36, such as impact assessments.

6. Security

Tastiana protects personal data with appropriate technical and organisational measures. The database is located in the EU, data is encrypted in transit and at rest, and each restaurant’s data is separated from the others at the database level. Administrators use two-factor authentication and the least privileges needed. The measures are described on the security page.

7. Subprocessors

The Customer gives general prior authorisation for the subprocessors listed on the subprocessors page. Tastiana binds its subprocessors to equivalent data protection obligations and remains responsible for them.

Tastiana notifies the Customer by email at least 30 days before adding or replacing a subprocessor. If the Customer objects on reasonable grounds and the matter cannot be resolved, the Customer may terminate the agreement before the change takes effect.

8. Transfers outside the EU and EEA

Some subprocessors are US companies. Data is transferred outside the EU and EEA only on the basis of the EU–US Data Privacy Framework or the standard contractual clauses adopted by the European Commission.

9. Personal data breaches

Tastiana notifies the Customer of a personal data breach without undue delay and no later than 48 hours after becoming aware of it. The notice includes the information listed in GDPR Article 33(3) as far as it is available, and Tastiana supplements it as details emerge.

10. End of the agreement

When the service ends, Tastiana deletes the personal data it processed on the Customer’s behalf within 90 days, unless the law requires it to be kept. Data in backups is deleted as the backups expire in their normal cycle. Before the end, the Customer can request a copy of its usage statistics.

11. Audits

On request, Tastiana provides the Customer with the information needed to demonstrate compliance with this agreement. The Customer may, at its own cost, have an audit carried out at most once a year with at least 30 days’ notice, unless a breach or a supervisory authority requires otherwise. The auditor must be bound by confidentiality.

12. Liability and governing law

The parties’ liability is governed by the terms of service unless mandatory law provides otherwise. This agreement is governed by the laws of Finland.

Data protection contact: privacy@tastiana.com.