Data processing agreement

Version 1.1.0In effect from Oct 24, 2026

1. The parties

1.1 Processor: Berényi Levente egyéni vállalkozó (sole trader), registered seat: 1016 Budapest, Bérc utca 12. fszt. 3., Hungary, sole trader registration number: 57183503, tax number: 58997976-2-41, email: support@bitecard.app (the "Provider").

1.2 Controller: the Customer that subscribes to the Bitecard service under the General Terms and Conditions (ÁSZF).

1.3 This agreement forms part of the ÁSZF and is concluded by accepting the ÁSZF. Terms defined in the ÁSZF have the same meaning here.

2. Subject matter and details of the processing

2.1 Subject matter and purpose: providing the Bitecard menu service. This includes storing and editing Customer content and displaying it on the public menu page. Inviting Staff members and their accounts are not covered by this agreement: the Provider processes those as controller, under its privacy policy.

2.2 Duration: the term of the service contract plus the deletion period in section 9.

2.3 Nature of the processing: storage, organisation, display on the public menu page, export, erasure.

2.4 Categories of data subjects:

• the Customer's staff whose data it uploads or publishes;
• the Customer's contact persons, where their contact details are personal data (for example a sole trader);
• people who appear in photos the Customer uploads;
• anyone whose personal data the Customer writes into the menu or introduction text.

2.5 Types of personal data: name, email address, phone number, image (in a photo), and other data written into free-text fields.

2.6 Special categories of data: the Service needs no special categories of data. The Customer does not enter special categories of data (for example health data) into the Service.

3. Instructions

3.1 The Provider processes personal data only on the Controller's documented instructions, including with regard to transfers outside the EEA. The ÁSZF, this agreement, and the way the Customer configures and uses the Service count as instructions.

3.2 If the law requires processing that differs from this, the Provider tells the Controller before processing, unless the law prohibits that.

3.3 If the Provider considers that an instruction infringes the law, it tells the Controller without delay.

4. Confidentiality

The Provider ensures that every person who has access to the personal data has committed to confidentiality or is under a statutory obligation of confidentiality. At present, only Berényi Levente has access to the data at the Provider.

5. Security

The Provider applies technical and organisational measures appropriate to the risk, as required by Article 32 GDPR. They are listed in the annex.

6. Sub-processors

6.1 The Controller gives the Provider general authorisation to engage sub-processors. The current list of sub-processors: https://bitecard.app/en/landing/subprocessors.

6.2 The Provider notifies the Controller by email at least 30 days before engaging a new sub-processor or replacing an existing one. The Controller may object during that time. If the parties cannot agree, the Controller may end the contract before the change takes effect.

6.3 The Provider imposes on its sub-processors, by contract, the same data protection obligations that bind it under this agreement, and remains liable for their performance.

7. Assistance

7.1 The Provider helps the Controller answer data subject requests. The Controller can correct and delete data itself in the admin app: it can edit the restaurant's details, delete photos, revoke invitations and remove Staff members. It can download the data itself in a machine-readable format (JSON) under Settings → Privacy. Anything it cannot do in the app, the Provider does on request.

7.2 The Provider helps the Controller, with the information available to it, with its obligations under Articles 32–36 GDPR, including a data protection impact assessment and prior consultation.

7.3 If a data subject contacts the Provider directly about data the Controller controls, the Provider forwards the request to the Controller without undue delay.

8. Personal data breach

8.1 The Provider notifies the Controller of a personal data breach without undue delay, and within 48 hours of becoming aware of it at the latest.

8.2 The notice contains, as far as known at the time:

• the nature of the breach, the categories and approximate number of data subjects and records concerned;
• the name and contact details of the contact person;
• the likely consequences of the breach;
• the measures taken or proposed.

What is not yet known at the time of the notice, the Provider may supply later, in phases.

9. Deletion at the end of the contract

9.1 After the contract ends, the Controller can still download its data after signing in.

9.2 On the 30th day after the end, the Provider warns the Account owner by email of the coming deletion, and on the 60th day, but never less than 30 days after the warning, it deletes the personal data, together with the uploaded images. The data disappears from backups within 7 days.

9.3 The Provider does not delete data that the law requires it to keep.

10. Audits

10.1 The Provider makes available to the Controller all information needed to demonstrate compliance with this agreement.

10.2 The Controller, or an auditor it appoints who is bound by confidentiality, may carry out an audit at the Provider after reasonable prior notice, during working hours, without disrupting the Service.

11. Transfers outside the EEA

Some sub-processors are established outside the EEA, or may access the data from there. The sub-processors concerned and the safeguards for the transfer (an adequacy decision, that is the EU-US Data Privacy Framework, or the Standard Contractual Clauses adopted by the European Commission, SCCs) are set out in the list of sub-processors.

12. Liability

The parties' liability to each other is governed by section 11 of the ÁSZF. This does not affect liability to data subjects under Article 82 GDPR.

13. Term

This agreement takes effect together with the service contract and remains in force for as long as the Provider processes personal data on the Controller's behalf, including the deletion period in section 9.

Annex: technical and organisational measures

• Encrypted connections: all traffic runs over HTTPS.
• Location: the application and the image store run in the European Union (Vercel, Frankfurt, fra1), and so does the database (Prisma Postgres, Frankfurt, eu-central-1). Analytics run on PostHog's EU servers (Frankfurt), and error monitoring in Sentry's EU region (Germany).
• Authentication: there are no passwords. Sign-in is by a one-time link sent by email. The session cookie carries the __Secure- prefix and is sent over HTTPS only. There is no two-factor authentication; the Account's security depends on the security of the Account owner's email account.
• Access separation: the server limits every read and write to the restaurant's own account and checks the user's permissions. Owner actions require the owner role.
• Data-minimising error monitoring and logging: names, email addresses, phone numbers, tokens, cookies and submitted form data are removed from error reports before sending. Email addresses are masked in the server's logs.
• Analytics: product analytics that can be linked to a person run only after consent. The server records business events (subscriptions, menu publishing) with a random identifier, not linked to a user or an IP address. All text and every input field are masked in session recordings. The public menu page records only an anonymous view count, without IP addresses.
• Abuse protection: requests are rate-limited, and IP addresses are kept for at most 25 hours (until the next daily clean-up after the one-hour window), partly as a keyed hash.
• Secrets: access keys are held in the hosting provider's environment variables and never enter the source code.
• Development and test data: development and test environments run on invented data and use no production data.
• Access at the Provider: only the Provider himself, Berényi Levente, has access to production data, through the Prisma Console and the database credentials held in Vercel's environment variables. No one else has access. Access is not logged separately.
• Incident handling: Berényi Levente is responsible for incidents. Incidents become known through Sentry error alerts, Vercel and Prisma notifications, and reports sent to support@bitecard.app and abuse@bitecard.app. He assesses each incident, notifies the NAIH within 72 hours where Article 33 GDPR requires it, and notifies the Controllers concerned within 48 hours under section 8.
• Backups: the database is backed up automatically every day, and Prisma keeps the backups for 7 days.