Version 1. Annex to the TableFai Terms of Service. This agreement meets the requirements of Article 28 of the General Data Protection Regulation (EU) 2016/679 ("GDPR").
1. Parties and roles
- Controller: the company that is a customer of TableFai (the "Customer").
- Processor: Tizfai Technologies AB, company registration number 559284-7379 ("TableFai").
The Customer decides the purposes of processing personal data about its guests and staff in TableFai. TableFai processes them only on the Customer's behalf and according to this agreement.
Guest accounts on tablefai.com, sign-in and security logs of the platform, and TableFai's own invoicing of the Customer are TableFai's own responsibility and are covered by TableFai's privacy policy, not by this agreement.
2. Subject matter, nature and purpose
TableFai provides table booking to the Customer: receiving and managing bookings (online, by phone and walk-ins), waiting lists and queues, floor plans and table assignment, a guest register with visit history, confirmations, reminders and other messages by e-mail and SMS, payments and guarantees through the Customer's own Stripe account, group bookings, pre-orders, reviews, reports, import and export.
3. Categories of data subjects and personal data
| Data subjects | Personal data |
|---|---|
| The Customer's guests | name, e-mail address, mobile number, language, bookings (date, time, party, table, source), requests, allergies and dietary preferences, notes, tags, visits and no-shows, marketing consent, reviews, payments (amount, the card's brand and last four digits; never the card number), the fact of a BankID verification (name and a pseudonym; never the personal identity number) |
| The Customer's staff | name, e-mail address, role, the restaurants the person works in, sign-ins and what the person did in the service (activity log) |
Allergies and dietary preferences may be data concerning health (Article 9 GDPR). The Customer is responsible for having a basis for processing them, and TableFai stores them encrypted.
4. Duration
The processing lasts as long as the Terms of Service apply and thereafter according to section 11.
5. The Customer's instructions
TableFai processes the personal data only on the Customer's documented instructions. The instructions are this agreement, the Terms of Service and the settings and actions the Customer makes in TableFai. If TableFai considers an instruction to infringe data protection law, TableFai tells the Customer without delay.
6. Confidentiality
Everyone working for TableFai with access to the personal data is bound by confidentiality. Access is given only to those who need it to run or support the service. Support access to a customer account is read-only, time-limited, given with a stated reason, and logged so that the Customer can see it.
7. Security (Article 32)
TableFai takes, among others, these measures:
- servers and backups in the EU;
- encrypted transfer (TLS) and encryption of guests' notes, requests and allergies in the database (AES-256-GCM);
- passwords stored with bcrypt; sign-in tokens, links and API keys stored as hashes; a new device needs a one-time code by e-mail;
- access by role (owner, admin, employee) and restaurant, checked on every request;
- an activity log that cannot be changed afterwards;
- card details handled only by Stripe, never reaching TableFai;
- regular updates, monitoring and restorable backups.
8. Sub-processors
The Customer gives TableFai a general prior authorisation to engage sub-processors. Today these are used:
| Sub-processor | What | Where |
|---|---|---|
| Hetzner Online GmbH | servers and storage for the service, e-mail and the SMS service | Germany and Finland (EU) |
| Stripe ([entity and country to be confirmed]) | payments and guarantees; the Customer's own Stripe account is also covered by the Customer's agreement with Stripe | EU, with transfers under Stripe's terms |
| Comviq (Tele2 Sverige AB) | delivery of SMS to the mobile networks | Sweden |
These are run by TableFai itself (Tizfai Technologies AB) on servers in the EU and are not sub-processors: the mail server (mail.tizfai.com), the SMS service (sms.tizfai.com) and Tizfai Identity (id.tizfai.com), which verifies guests with BankID when the Customer asks for it. BankID is provided by Finansiell ID-Teknik BID AB, which is independently responsible for its processing.
TableFai tells the Customer at least 30 days before a sub-processor is added or replaced. The Customer may object on reasonable grounds; if the parties cannot agree, the Customer may end the agreement. TableFai binds every sub-processor to the same obligations as in this agreement and is responsible for its processing.
9. Transfers to third countries
The personal data is processed within the EU/EEA. Any transfer outside the EU/EEA (for example at Stripe) is made only under Chapter V of the GDPR, such as the European Commission's standard contractual clauses or an adequacy decision.
10. Assistance to the Customer
TableFai helps the Customer to
- meet data subjects' rights: in TableFai the Customer can itself find, correct, export (Articles 15 and 20) and erase (Article 17) a guest's data;
- assess impacts and consult the Swedish Authority for Privacy Protection where needed (Articles 35–36);
- handle personal data breaches: TableFai tells the Customer without undue delay, and at the latest within 48 hours of becoming aware of a breach, with the information the Customer needs for its notification (Articles 33–34).
Assistance beyond what the service already does may be charged by agreement.
11. When the agreement ends
During the agreement and for 12 months after it ends, the Customer can export its data. After that TableFai erases the data after asking the Customer, or earlier if the Customer asks, unless the law requires it to be kept. Backups are overwritten within 14 days.
12. Information and audits
TableFai gives the Customer the information needed to show that this agreement is followed and allows audits by the Customer or an independent auditor, with at least 30 days' notice, during office hours and at the Customer's expense. An audit may not reveal other customers' data.
13. Liability and other terms
The parties' liability follows Article 82 GDPR and the limitation of liability in the Terms of Service, insofar as it is compatible with the GDPR. In case of conflict, this agreement prevails over the Terms of Service in matters of personal data. Swedish law applies and disputes are settled as in the Terms of Service.