Data processing agreement

1. Parties and subject

The controller is the user of the Pametni cenik service (venue operator). The processor is Luminus d.o.o., Kolodvorska 2, 8000 Novo mesto, registration no. 1201166000, VAT ID SI50032534, [email protected].

This agreement governs the processing of personal data the controller enters into the service and forms part of the Terms of service. It is concluded on registration and remains in force as long as the processor processes personal data for the controller.

2. Data, data subjects and purpose

• Data subjects: members of the controller's team (owner, staff), people in uploaded photos, contact persons on the venue website.
• Data: name, email address, role, venue phone and address, photos, texts entered by the controller.
• Purpose and nature of processing: storage, display and processing to provide the service (editing and publishing the menu, website, printed materials, AI import and translation).

The controller does not enter special categories of personal data (e.g. health data) into the service.

3. Processor obligations

• Processes data only on the controller's documented instructions, given through these terms and use of the service.
• Ensures that persons with access to the data are bound by confidentiality.
• Implements appropriate technical and organisational measures: encrypted connections, passwordless sign-in with one-time links, separate access per venue, backups, restricted staff access.
• Assists the controller in responding to data subject requests and in meeting obligations under Articles 32 to 36 GDPR.
• Notifies the controller of a personal data breach without undue delay, at the latest within 48 hours of becoming aware of it.
• Makes available the information needed to demonstrate compliance and allows audits to a reasonable extent with prior notice.

4. Sub-processors

The controller authorises the sub-processors listed in the Privacy policy (Cloudflare, Brevo, Stripe, Anthropic). The processor notifies the controller by email at least 14 days before adding or replacing a sub-processor; the controller may object on reasonable grounds or cancel the subscription.

The processor binds sub-processors to the same data protection obligations. Transfers outside the EEA are based on an adequacy decision or standard contractual clauses.

5. Controller obligations

The controller ensures it has a lawful basis for the personal data it enters (e.g. consent of people in photos) and has informed data subjects appropriately.

6. End of processing

After the service ends, the processor deletes personal data within 30 days unless required by law to keep it. On request it allows the controller to export the menu before deletion.

7. Final provisions

This agreement is governed by the law of the Republic of Slovenia. In case of any discrepancy the Slovenian version prevails. Data protection contact: [email protected].