Data processing agreement

1. Parties and subject

• Controller: the customer under the business terms, i.e. an entrepreneur who created a business in Managero.
• Processor: Martin Nemeškal, company ID (IČO) 17944953, with registered office at Míru 482, 790 70 Javorník, Czech Republic, registered in the Trade Register kept by the Municipal Office of Jeseník. Data protection contact: email podpora@managero.app, phone +420 727 960 413, postal address Míru 482, 790 70 Javorník, Czech Republic.
• Subject: processing of personal data that the controller or its users put into the Managero service or that is created in it for the business, to the extent necessary to provide the service under the business terms.

2. Duration

Processing lasts for the term of the service contract and until the data is returned or erased under section 13.

3. Nature and purpose

The processor stores data, displays it to authorised users, transfers it between devices, backs it up, evaluates it according to the business's settings (for example hour totals, points, stamps) and delivers notifications and emails on behalf of the business. The sole purpose is providing the Managero service to the controller: rota and attendance, team communication, tasks, stock and closings, payroll data, rewards and reviews, loyalty programme, guest bookings and orders, and news for guests.

4. Categories of data subjects

• employees, temporary workers and other collaborators of the business and its management;
• guests and customers of the business (loyalty members, people with bookings or orders, news subscribers);
• contact persons of suppliers and business partners;
• other people appearing in content added by users (for example in a photo or message).

5. Categories of personal data

Staff and management:

• identification and contact data: name, email, phone, avatar, job title, role and permissions; password and tablet PIN hashes;
• shifts, availability, time-off and shift-swap requests;
• attendance: clock-in, clock-out and break times and where they were recorded (phone, tablet, manually). If the business enables clock-in only at the venue, the result of the check and the distance from the venue in metres are stored with a phone clock-in; phone coordinates are not stored;
• payroll data: hourly rate, hours worked, bonuses and wage adjustments, payouts and closed pay periods;
• shift reviews, points, rewards and redemptions, penalties and warnings (text, a photo attached by management if any, points, reduction of a discretionary bonus and the employee's response), tasks, till closings including differences;
• communication content: chat messages including photos, voice messages and videos, reactions, ideas and votes, polls, announcements and guide read receipts;
• technical data: device tokens for notifications and the business change log (who changed important settings and when).

Guests: name, email, phone and date of birth (optional), loyalty card code, points, stamps, credit, visits, vouchers and coupons, ratings, bookings, table orders (items, table, note; with a location check only the distance from the venue), POS receipts linked to the card, consent to news (time and channel), groups and the business's notes about the guest, and data the business imports from an earlier loyalty system.

Suppliers: name, email and phone of the contact person and order content.

The service is not intended for special categories of data (Article 9 GDPR). If the controller nevertheless enters them (for example a health reason for absence in a note), it is responsible for the legal basis. The processor performs no biometric processing or face recognition.

6. Controller's instructions

• The processor processes data only on documented instructions from the controller, including with regard to transfers to third countries. Instructions are the business terms, this agreement and the settings and actions the controller and its users make in the app. Further instructions are given by email.
• The processor informs the controller without undue delay if it considers an instruction to infringe the GDPR or other data protection law.
• The processor may process data otherwise only where required by EU or Member State law, informing the controller beforehand unless that law prohibits it.

7. Controller's obligations

The controller is responsible for the lawfulness of processing: the legal basis, informing data subjects (the Information for staff template helps), guests' consent to news, a data protection impact assessment where needed (for example for location checks at clock-in), and the settings it chooses in the app.

8. Confidentiality

The processor keeps the data and the measures protecting it confidential. Anyone the processor involves in handling the data is bound by confidentiality by contract or by law. Confidentiality survives the end of the contract.

9. Security (Article 32 GDPR)

The processor has adopted these technical and organisational measures:

• encrypted transfer (HTTPS/TLS with enforced HSTS) between devices and the service and between the service and its providers; the database and file storage are also encrypted at rest at the providers;
• passwords and PINs only as one-way hashes (bcrypt), never readable; rate-limited sign-in; sign-in in a secure (httpOnly) cookie with limited validity; changing the password signs out other devices;
• separation of businesses: every query is limited to the business the user is a member of; access within a business is governed by roles and permissions (for example only management sees hourly rates, not even the owner sees private messages);
• files (photos, receipts, attachments) in non-public storage, served only to signed-in authorised users; without sign-in only images the business itself publishes on its guest page are shown (logo, venue photos, public events, banners);
• a business change log and a separate log of platform administration actions;
• backups: point-in-time recovery of the database at the database provider and a daily business backup for the controller via a signed link valid 7 days that works only after an authorised person signs in;
• minimisation: location is not stored, only the distance and the result of the check; old data is deleted according to section 13;
• only the processor has access to production systems; accounts at infrastructure providers are protected by strong passwords and two-factor authentication;
• secure development: automated tests and checks before deployment, security headers (Content Security Policy), dependency updates;
• an incident response procedure (section 12).

10. Subprocessors

• The controller gives the processor general authorisation to engage other processors (subprocessors). The current list with purpose, location and safeguards is on the Subprocessors page and forms an annex to this agreement.
• The processor announces an intended addition or replacement of a subprocessor by email to the business owner and on the list page at least 30 days in advance. The controller may raise a reasoned objection within 30 days of the notice. If we cannot resolve it, the controller may terminate without penalty as of the day before the subprocessor is engaged and we refund the unused part of the subscription pro rata.
• A shorter period may be used only in urgent cases (security, sudden termination by a subprocessor); the change is then announced without undue delay.
• The processor imposes the same data protection obligations on subprocessors by contract and remains liable to the controller for their performance.

11. Transfers outside the EU

Where data is stored: European Union (Neon database in AWS eu-central-1, Frankfurt). Some subprocessors are established in the USA. Data is transferred to them only on the basis of the Commission adequacy decision (EU–US Data Privacy Framework, Implementing Decision (EU) 2023/1795) for certified recipients, or of standard contractual clauses under Implementing Decision (EU) 2021/914 included in their data processing agreements. The safeguard for each is stated in the list of subprocessors.

12. Data subject rights, assistance and breaches

• The processor helps the controller respond to data subject requests. The app provides tools for this: downloading account data, correcting the profile, deleting an account, exporting loyalty members and deleting or anonymising a guest.
• A data subject request concerning business data that reaches the processor is forwarded to the controller within 5 working days; the processor does not answer it on the merits unless agreed otherwise.
• The processor provides the controller with information needed for security, data protection impact assessments and prior consultation (Articles 32 to 36 GDPR).
• The processor notifies the controller of a personal data breach affecting the business without undue delay and at the latest within 48 hours of becoming aware of it, by email to the business owner, stating the nature of the breach, categories and approximate numbers of people and records concerned, likely consequences and measures taken, and supplementing what is not yet known. Notification to the supervisory authority and data subjects is made by the controller with the processor's help.

13. Retention, erasure and return

• During the contract these periods apply as the controller's instruction: an inactive guest account (no visit, order, booking or app opening) is anonymised after 24 months, with an email 30 days before offering to keep it; the business change log is deleted after 3 years; in-app notifications after 365 days. A business whose subscription (or trial) ended and which nobody uses for 90 days is deleted with its data under section 19 of the business terms, only after emailing the owner and subscription managers at least 30 days and again 7 days before.
• When an employee or guest deletes their account, their personal data is deleted or anonymised. Records the business needs for operations and by law (shifts, attendance, closings, handled orders) remain without the name.
• When the contract ends, the processor returns the data at the controller's choice (export under section 20 of the business terms) and erases it within the periods stated there. Copies in backups disappear within 30 days at the latest. The processor keeps only data whose storage is required by EU or Czech law.

14. Information and audits

On request the processor provides the controller with the information needed to demonstrate compliance with this agreement (description of measures, list of subprocessors and their data processing agreements, answers to a security questionnaire). It allows audits or inspections by the controller or an auditor bound by confidentiality, announced at least 30 days in advance, at most once a year (except after a breach or at an authority's request), at the controller's cost and without disrupting the service or the protection of other businesses' data. Data centre audits are replaced by the certifications and reports of the infrastructure providers.

15. When Managero is an independent controller

This agreement does not cover processing whose purpose the provider determines itself: user accounts and sign-in (including the guest account that works across businesses), security and abuse prevention, support, billing of businesses, content moderation and notices under the Digital Services Act, and aggregated anonymous statistics. These are described in the privacy policy.

16. Liability and final provisions

• Each party is liable for breaching its own GDPR obligations. Between the parties the limitation of liability in section 17 of the business terms applies; it does not affect liability towards data subjects (Article 82 GDPR) or fines imposed by an authority.
• Changes to and assignment of this agreement follow sections 18 and 21 of the business terms. In matters of personal data this agreement prevails over the business terms; in case of conflict with the GDPR, the GDPR applies.
• This agreement applies from 21 October 2026 (version 2026-10-21).