Data processing annex (GDPR) — English summary
Article 28 GDPR annex to the SimplyRestau terms and conditions
This page is not a contract. It is an unofficial, informational summary provided as a courtesy to English-speaking readers. The only binding text is the French document Annexe relative au traitement des données personnelles (version 2026.10.1). In the event of any discrepancy, omission or ambiguity, the French version prevails. This summary is not a data processing agreement and cannot be signed, relied on or produced in its place.
Version 2026.10.1
Version 2026.10.1 adds the “Loyalty programme” processing (new article 5, following articles renumbered): SimplyRestau hosts the guests’ loyalty cards on behalf of the client — the token fingerprint, visit and reward counters and the dates of the last visit and last reward, with no identity or contact details. A card with no new visit for twenty-four months is deleted automatically, and a guest who presents the token can have the card erased. At the end of the services, data are returned as a copy sent by support within thirty days of the request.
Main additions in version 2026.09.1
The annex now covers bookings and takeaway orders processed on the restaurant's behalf. It describes confirmations and reminders, configurable retention and anonymisation, payment-reference boundaries and the standing instruction for guest erasure requests. Card data remains with the restaurant's own payment provider.
Roles
For the data you enter into the solution for your own purposes, you act as the controller and DevMeOn as the processor within the meaning of Article 28 of the GDPR. Each party complies with the obligations that fall to it.
Instructions and scope of processing
DevMeOn processes the data only on your documented instructions, in order to host, secure, display, maintain, back up and return the content of the solution for the duration of the agreement. Data subjects may include authorised users, guests who book a table or place a takeaway order, and people identifiable in the content submitted. The data may include identity and contact details, booking or order details, permissions, technical logs, images and menu content.
Confidentiality and security
DevMeOn ensures that authorised personnel are bound by confidentiality and implements measures appropriate to the risk: access control, encryption of communications, patch management, backups, relevant logging and incident management procedures.
Sub-processors
You give general authorisation for the use of the providers needed for hosting, email delivery, translation, monitoring and payment. DevMeOn informs you of any substantial change and lets you raise a reasoned objection on data protection grounds. Sub-processors are bound by equivalent obligations.
Transfers
DevMeOn informs you of the relevant location of processing and frames any transfer outside the European Economic Area using a mechanism recognised by the GDPR, supplemented where necessary by appropriate measures.
Assistance
Taking into account the nature of the processing, DevMeOn reasonably assists you in responding to data subject requests, securing processing, notifying breaches and carrying out impact assessments. Manifestly excessive requests, or requests unrelated to the service, may be quoted for separately.
Personal data breaches
DevMeOn informs you as soon as possible after becoming aware of a breach affecting data processed on your behalf, and passes on the available information you need to meet your own obligations.
Return and deletion of data
At the end of the services concerned, DevMeOn returns or deletes the data according to your choice and the features available, unless the law requires it to be kept. Backup copies are purged on their normal cycle and remain protected until they are deleted.
Audit
DevMeOn makes available the information reasonably needed to demonstrate compliance with the annex. A further audit may be carried out at most once a year, on reasonable notice, without disrupting the service, under confidentiality and at your expense — except where an incident or breach has been established.
Read the binding text
This summary does not reproduce the annex in full. The binding document is the French text: Annexe relative au traitement des données personnelles (version 2026.10.1) — SHA-256 fingerprint 8d9792180a12d151b11b85905b275f9baab70cb2c8c42e1729d7b6297a9cf5cc, taken from the published document catalogue, so you can verify you are reading the accepted text. Questions in English are welcome at contact@simplyrestau.fr, but only the French text is legally binding.