Data Processing Agreement

"Personal Data" means any information relating to an identified or identifiable natural person (customer) processed through the Spevdo platform. "Processing" means any operation performed on Personal Data, including collection, storage, use, and deletion.

The restaurant is the Data Controller and determines the purposes and means of processing customer data. Spevdo is the Data Processor and processes customer data solely on behalf of the restaurant to provide the ordering, delivery coordination, and payment processing services.

Spevdo processes the following categories of personal data on behalf of the restaurant:

• Customer identity data: name, phone number, email address
• Delivery data: delivery address, GPS coordinates
• Order data: items ordered, amounts, payment method, order timestamps
• Preferences: language, channel preference (delivery/takeaway/dine-in)
• Courier data (staff the restaurant registers in Spevdo Driver): name, phone number, email address, precise location while a shift is open, delivery activity

Spevdo shall:

• Process personal data only on documented instructions from the restaurant, including transfers to third countries
• Ensure that persons authorized to process the data have committed themselves to confidentiality
• Implement appropriate technical and organizational security measures, including encryption in transit (TLS), access controls, and regular security reviews
• Not engage another processor without prior written authorization from the restaurant (see Section 5)
• Assist the restaurant in responding to data subject rights requests (access, rectification, erasure, portability)
• Delete or return all personal data upon termination of the service agreement, unless EU or Greek law requires storage. The shared verified phone record is the exception described in section 8
• Make available all information necessary to demonstrate compliance and allow for audits

The restaurant authorizes Spevdo to engage the following sub-processors. Spevdo will inform the restaurant of any intended changes to sub-processors, giving the restaurant an opportunity to object.

• Infobip (Croatia/EU) — SMS delivery for phone verification
• Viva Wallet (Greece/EU) — payment processing
• Cloudflare (US, EU SCCs in place) — content delivery, image hosting, DDoS protection
• Hetzner (Germany/EU) — server infrastructure and database hosting
• Google (US, EU SCCs in place) — Maps API for address autocomplete, geocoding and the map preview of the delivery location
• Mapbox (US, EU SCCs in place) — Directions API for delivery-ETA routing of the courier's position and the drop-off coordinates, and Geocoding API for server-side geocoding of the delivery address submitted with an order (temporary request storage only)
• Wolt Enterprises Greece (Greece/EU) — receives the courier's position during deliveries that originated from the Wolt marketplace

Where personal data is transferred outside the European Economic Area (EEA), Spevdo ensures appropriate safeguards are in place, including EU Standard Contractual Clauses (SCCs) with the relevant sub-processors (Cloudflare, Google, Mapbox).

Spevdo shall notify the restaurant without undue delay (and in any event within 72 hours) after becoming aware of a personal data breach. The notification shall include the nature of the breach, categories and approximate number of data subjects affected, likely consequences, and measures taken to address the breach.

This DPA is effective for the duration of the service agreement between the restaurant and Spevdo. Upon termination, Spevdo shall delete all customer personal data within 30 days, except where retention is required by Greek tax law (order data: 5 years). The verified phone record is not covered by this deletion: every Spevdo restaurant shares it, so Spevdo keeps it under its own retention period and deletes it 24 months after the phone's last SMS verification, or when the customer deletes their Spevdo account.

For any DPA-related inquiries, contact Spevdo's data protection contact at:

hello@spevdo.eu