Data Processing Agreement (DPA)
Last updated: June 2026
This agreement (“DPA”) forms an integral part of the Terms of Service and applies as soon as you — the restaurant, the “Controller” — use qartine to process your customers' personal data. qartine (Kube IT Consulting FZCO, the “Processor”) processes that data on your behalf, in accordance with Article 28 GDPR.
1. Roles
You are the controller of your customers' (diners') data. qartine acts as processor, solely on your instructions and to provide you the service.
2. Subject-matter, duration, nature and purpose
Subject-matter: providing the multilingual QR menu and ordering. Duration: the term of your account. Nature and purpose: hosting your menu, serving the public page, receiving orders and, if enabled, running a loyalty list — on your behalf.
3. Data and data subjects
Data subjects: your venue's diners. Data: name and, with their explicit consent, phone and email (order / loyalty), plus order details. No special categories are required — do not add any in free-text fields.
4. Instructions
qartine processes data only on your documented instructions (your use of the service and your written requests). qartine informs you if, in its view, an instruction infringes the GDPR.
5. Confidentiality
Persons authorised to process the data are bound by confidentiality.
6. Security (Art. 32)
Encryption in transit (HTTPS), hashed passwords, access control, EU hosting of images and menus, monitored infrastructure, and automatic deletion of order data 24h after the order.
7. Sub-processors
You authorise the use of: Stripe (payment), Resend (email), Cloudflare (storage/CDN) and a machine-translation service (OpenRouter/DeepSeek, MyMemory fallback) — to which only menu text is sent, never personal data. qartine imposes equivalent obligations on each and notifies you of changes so you may object.
8. International transfers
qartine is established in the United Arab Emirates (a third country with no adequacy decision). Necessary transfers rely on the European Commission's Standard Contractual Clauses and appropriate supplementary measures; menus and images are hosted in the EU.
9. Assistance
qartine helps you respond to data-subject requests (access, erasure, portability — via the built-in export and delete features) and with your obligations under Art. 32–36.
10. Data breaches
qartine notifies you without undue delay after becoming aware of a personal-data breach. Contact: [email protected].
11. Deletion / return
On termination, data is deleted (account deletion) or returned (export), save for any legal retention obligation.
12. Audit
qartine makes available the information necessary to demonstrate compliance with Article 28.