Draft Data Processing Agreement
Working draft for the possibility that ReviewFlow processes personal data on the restaurant’s behalf under GDPR Article 28. Not executed or ready for signature.
Provisional Early Access draft — not a final document or a declaration of legal compliance. “To confirm” and “To validate” items must be resolved before starting personal-data processing. Free use does not remove these obligations.
Status and applicability
All clauses below are proposals to complete and validate, not verified operational commitments. First confirm each party’s actual role. This agreement applies only to processing on the restaurant’s behalf; it does not automatically cover the operator’s independent purposes. If roles differ, adapt the legal instrument. It must be binding before covered processing, even in a free pilot.
Parties — complete before signature
Controller (restaurant): [full/legal name, address, representative and contact]. Processor (ReviewFlow operator): [full/legal name, address and representative where applicable]. Proposed operational contact: reviewflow.geral@gmail.com. Do not populate these fields with an assumed company, tax number or registered activity. Identify signatories and their authority.
Annex A — subject, duration, nature and purpose
Proposed subject: providing ReviewFlow to the restaurant for 30 days of Early Access in a programme for 5 restaurants. Complete dates and termination, return and deletion arrangements. Operations: collection, recording, storage, organization, consultation, indicator calculation and local PDF generation of feedback, point configuration and manual Google tracking. Purpose: enabling the restaurant to understand and follow opinions about its service. Pilot duration does not define retention or automatically delete data.
Annex A — data and individuals
Data to confirm: ratings, topics, comments and other-topic text, restaurant/point/submission identifiers and dates; account or support details only insofar as processed on the restaurant’s behalf. Potential individuals: customers, staff or others identified in comments and authorized users. Feedback requests no names/contact details; free text can identify people. Collection of special-category data or specifically children’s data is not intended; it may occur inadvertently and handling must be defined. ReviewFlow’s own commercial contacts require separate treatment where the operator is controller.
Documented instructions and confidentiality — proposed clause
The processor shall process only on documented controller instructions, including transfers, unless required by applicable law and notified where permitted. It shall not reuse personal data for independent purposes without separate assessment and grounds. Authorized people shall be bound by confidentiality and limited access. The processor shall inform the controller if it considers an instruction unlawful. Complete instructions, authorized people, contact channels and change records.
Annex B — technical and organizational measures
Document and validate measures appropriate to risk under Article 32. Identified technical baseline: authentication, restaurant isolation, data-access restrictions, server-side administrator verification and submission validation. Complete operational evidence for access management, confidentiality, connection security, continuity, backups/restoration, updates, testing, logging and measure reviews. Do not state specific encryption, certification or security guarantees without evidence. The restaurant shall protect credentials and downloaded PDFs under terms to be agreed.
Annex C — other processors and transfers
For each relevant service, complete legal entity, function, data, location, contract, any international transfer and applicable mechanism. Investigation points: Lovable Cloud and managed email, hosting/visual resources/errors and Google services where part of covered processing; do not automatically classify all as subprocessors. Choose prior specific or general written authorization, notice of changes and opportunity to object; provide equivalent obligations and initial processor responsibility. The list and safeguards are unconfirmed: this draft grants no blanket authorization.
Rights, assistance and incidents — proposed clause
The processor shall assist the controller, taking account of processing and available information, with rights requests, security, impact assessments and prior consultation where applicable. It shall notify the controller of personal-data breaches without undue delay after awareness, with available information and updates. Complete contacts, escalation, records and minimum notice content. The controller shall assess authority and individual notifications; Article 33 requires notification to the authority where necessary, if feasible within 72 hours of awareness, explaining any delay. This statutory deadline is not a commercial support commitment.
Service end, evidence and audit — proposed clause
At the end, at the controller’s choice, return or delete personal data and delete copies unless legally required retention applies. Agree format, period/criteria, backups, confirmation and export responsibilities. Provide information needed to demonstrate Article 28 obligations and allow/contribute to audits, including inspections, by the controller or its mandated auditor. Define a proportionate process without excluding legal rights. No automatic mechanism currently executes this clause.
Completion and signatures — pending
Complete annexes A/B/C, instructions, dates, contacts, measures, retention and authorizations; review liability, applicable law and relationship to the Terms without removing mandatory duties. Obtain lawyer validation. Signatures: [controller, name/capacity/date] and [processor, name/capacity/date]. Do not start covered processing with this incomplete draft.