Data Processing Agreement

• Controller: the restaurant client who decides why and how customer data is used.
• Processor: SwiftManage, which processes data on the controller's behalf to deliver the platform.
• Personal data: any information relating to an identified or identifiable person.
• Customer data: data clients enter into the platform about their own customers and staff.

As the controller, you are responsible for having a lawful basis for collecting customer data and for telling your customers how their data is used. You're responsible for the accuracy of the data you enter and for responding to your customers' data requests.

As the processor, SwiftManage will:

• Process customer data only on your documented instructions.
• Keep data secure and confidential.
• Help you meet your obligations under UK GDPR, including data subject requests and breach notifications.
• Notify you without undue delay if we become aware of a data breach.

The platform may process the following categories of data on your behalf:

• Contact details (name, email, phone).
• Reservation and booking details.
• Loyalty programme information.
• Staff account details and permissions.
• Payment-related data (processed by Stripe).

Reservation data includes customer name, contact details, party size, date, time and any notes you or your customer add. We use it to deliver and manage bookings. You control how long it's retained (see our Data Retention Policy).

Staff account data includes names, email addresses, roles and permissions you assign. We use it to provide portal access and apply role-based permissions. You can remove staff accounts at any time.

Loyalty data includes points, rewards and visit history for your customers. We process it to run the loyalty features you've enabled. Customers can ask you to remove their loyalty data at any time.

Payment data is handled by Stripe, our payment provider. SwiftManage never stores full card numbers or bank account details. We store only the references needed to manage subscriptions and display payment status.

We retain customer data for as long as your subscription is active, plus any transition period after it ends. Full retention periods are in our Data Retention Policy.

We protect customer data with encryption, secure authentication, role-based permissions and daily backups. Full details are on our Security page.

Customer data is primarily stored in the UK and EU. Where any data is transferred outside the UK, we rely on appropriate safeguards such as UK International Data Transfer Agreements and only transfer data where it's protected to a UK-standard level.

We use trusted sub-processors to deliver the platform:

• Stripe: payment processing.
• Cloud hosting: infrastructure and database hosting.
• Email delivery: transactional email.

We require all sub-processors to meet equivalent security and data protection standards.

If a personal data breach occurs, we'll notify you without undue delay and provide the information you need to meet your own notification duties. Our full process is in our Incident Response Policy.

You can exercise the following rights over your customer data at any time:

• Access: request a copy of your data.
• Rectification: correct inaccurate data.
• Erasure: request deletion where applicable.
• Portability: receive your data in a structured format.

To request deletion of your data, contact support. We'll action verified requests within 30 days and confirm once complete. Some data may be kept where required by law or to defend legal claims.

On termination of your subscription, we'll help you export your data and then securely delete it after a reasonable transition period, unless law requires us to keep it longer.