Data Processing Agreement
آخر تحديث: 2026-10-11 · v1.2
هذا المستند منشور بالإنجليزية فقط، والنص الإنجليزي هو النص المُلزِم.
This agreement is between RI Norby AB (org. no. 559532-4301), a company registered in Sweden and trading as Matvy (“Matvy”), and the venue that holds a Matvy account (“the Customer”). It forms part of the Terms of Service and applies automatically to every Customer; no separate signature is required, although Matvy will sign a copy on request.
It is the agreement Article 28 of the GDPR requires between a controller and a processor. Its purpose is to let the Customer show, to their own guests and to a supervisory authority, exactly what happens to personal data they are responsible for once it reaches Matvy.
1. Which of us is responsible for what
For everything about a guest — their name, their telephone number, their email address, the note they left with a booking — the Customer is the controller and Matvy is the processor. The guest is the Customer’s guest. Matvy holds that data only in order to run the service the Customer asked for.
For the Customer’s own account, Matvy is the controller in its own right: the names and email addresses of the Customer’s staff, login and security records, subscription and billing history, and the audit log of who did what in the product. Matvy needs those to provide and bill for a service and to keep it secure, and decides itself how they are handled. They are covered by Matvy’s privacy policy rather than by this agreement.
Nothing here makes Matvy a controller of guest data, and nothing here makes the Customer responsible for how Matvy runs its own business.
2. What is processed, and for how long
Subject matter and purpose: providing the Matvy platform — taking and managing table bookings, sending the guest confirmations and reminders about their own booking, and, where the Customer has switched them on, taking deposits and orders.
Duration: for as long as the Customer has an account, and afterwards only for the short period described below under what happens when the Customer leaves.
Nature of the processing: storing, organising, retrieving, transmitting, anonymising and deleting personal data by automated means.
3. Whose data, and which data
Categories of data subject: the Customer’s guests, and any person a guest names in a booking.
- Name, telephone number and email address given when booking.
- The booking itself: date, time, party size, table, occasion, and any note the guest or the Customer’s staff added.
- Where the ordering module is in use: the items ordered, the amount, and the collection time.
- A record of the messages sent to that guest about their booking — which channel, when, and whether the provider accepted and delivered it. Not the content.
- Whether the guest agreed to receive marketing from the Customer.
Matvy does not ask for and has no use for special categories of personal data under Article 9. The note field is free text and a guest could write anything in it, including an allergy; the Customer decides what its staff record there and should instruct them accordingly.
Card details are never sent to or stored by Matvy. Payments are taken on Stripe’s own hosted pages.
4. Matvy acts only on instructions
Matvy processes guest personal data only on the Customer’s documented instructions. Using the product — taking a booking, sending a confirmation, setting a retention period, exporting a guest list — is such an instruction. This agreement and the Terms of Service are the rest of them.
Matvy will tell the Customer if an instruction appears to breach data protection law, and may decline to carry it out.
Matvy does not sell guest data, does not share it with other customers, and does not use it to train anything. Every query in the platform is scoped to a single venue’s identifier, and that is enforced by automated tests which must pass before any change is released.
5. Confidentiality
Everyone Matvy authorises to access personal data is bound to keep it confidential. Matvy is operated by a single named person; where that changes, this clause covers whoever comes after.
6. When Matvy opens a venue’s account
Matvy’s platform-owner account can open a venue’s account without an invitation, in order to set the venue up at the Customer’s request, to answer a support question, or to investigate a fault or a security matter. It is not used for any other purpose. Accepting the Terms of Service is the Customer’s instruction for this access.
- It is available only to Matvy’s platform-owner account, which must have signed in with a second factor.
- Each visit ends after four hours at most, or sooner when the operator leaves.
- The start of every visit is written to the venue’s own audit log with the operator’s identity before access is given, and every change made during it is logged in the same way as a change by the venue’s own staff.
- The date of the most recent visit is shown to the venue’s administrators on their Team page.
- During a visit the operator cannot change the venue’s subscription or payment card, its payout account or its administrators, and cannot issue refunds or send campaigns to guests.
The Customer may ask Matvy at any time for the record of these visits to its account.
7. Security
Matvy maintains appropriate technical and organisational measures under Article 32. In concrete terms, as the platform stands today:
- All traffic is over HTTPS, and data is encrypted at rest by the database and storage providers.
- Passwords are never stored in a readable form, and administrator accounts can be required to use a second factor — which is compulsory for Matvy’s own platform-owner account.
- Each venue’s data is separated by an identifier applied in every query, covered by cross-tenant tests that must pass before a release.
- Every change to a booking or a setting is written to an audit log recording who made it, when, and the state before and after.
- Sign-in and other sensitive endpoints are rate limited.
- Credentials are held as environment variables, never in the source code, and are rotated if exposed.
- The database keeps a change history allowing a recent state to be restored.
Matvy is a small company and holds neither ISO 27001 nor SOC 2 certification. The measures above are set out so the Customer can judge them rather than take a badge on trust.
8. Sub-processors
The Customer gives general authorisation for Matvy to engage sub-processors. The current list, with what each does and where the data sits, is published at matvy.com/subprocessors and forms part of this agreement.
Matvy will give at least 30 days’ notice before adding or replacing a sub-processor. If the Customer objects on reasonable data protection grounds within that period, they may terminate the affected part of the service without penalty and receive a refund of anything paid for the period after termination.
Matvy imposes the same obligations on each sub-processor as it has under this agreement, and remains fully liable to the Customer for their performance.
9. Transfers outside the EEA
The database holding bookings and guest contact details is hosted in Frankfurt, Germany, and menu photographs are stored in Western Europe. Guest data at rest stays inside the EEA.
Some providers used for sending messages and taking payments are established in the United States. Where personal data is transferred to them, that transfer relies on the European Commission’s Standard Contractual Clauses, or on the EU–US Data Privacy Framework where the provider is certified under it. The published sub-processor list marks which providers this applies to.
10. Helping the Customer meet their own obligations
If a guest asks the Customer for access to their data, for a correction, for deletion, or for a copy, Matvy will help. The product covers most of it already: a venue can see, edit and delete any booking, and export its guest list. For anything the product does not cover, Matvy will assist within 10 working days of a request, at no charge.
Matvy will also give the Customer whatever it reasonably needs to carry out a data protection impact assessment or to consult a supervisory authority, taking into account how little Matvy knows about the Customer’s own operations.
11. If something goes wrong
Matvy will notify the Customer of a personal data breach affecting their data without undue delay, and in any case within 48 hours of becoming aware of it. The notification will describe what happened, which data and roughly how many people are affected, the likely consequences, and what Matvy is doing about it — and will say plainly where Matvy does not yet know.
Notifying a supervisory authority and, where required, the guests themselves is the Customer’s decision as controller. Matvy will not make it on their behalf, and will provide what the Customer needs in order to make it.
12. What happens to the data when the Customer leaves
Before closing an account, the Customer can export their guest list and their bookings from the product at any time.
Deleting an account removes the venue and its bookings from the live platform immediately. A single recovery snapshot is kept for 30 days so that an accidental deletion can be undone, and is then permanently erased by an automated daily job. After those 30 days Matvy holds no copy of the Customer’s guest data, other than what Matvy is required by law to keep — in practice accounting records of what the Customer themselves paid, which contain no guest data.
Backups and change history held by the database provider roll off on their own schedule and are not restored except to recover the service.
A Customer who wants the recovery snapshot destroyed sooner than 30 days can ask, and Matvy will do it.
13. Retention while the account is open
Matvy keeps guest data for as long as the Customer keeps it, because it is the Customer’s to decide. The product offers a retention setting: choose a number of days, and bookings older than that have the guest’s name, telephone number, email address and note removed automatically, while the date, time and party size are kept so the venue’s own reports still work.
That setting is off by default, which means “keep until deleted”. Matvy recommends turning it on, and states plainly here that leaving it off is the Customer’s decision and the Customer’s responsibility as controller.
14. Audits
Matvy will make available the information needed to demonstrate compliance with this agreement, and will answer a written security questionnaire once in any twelve-month period at no charge.
The Customer may audit Matvy, or appoint an independent auditor to do so, on 30 days’ written notice, no more than once a year unless a breach has occurred or a supervisory authority requires it. Audits take place during business hours, must not disrupt the service, and the auditor must be bound by confidentiality and must not be a competitor of Matvy.
15. Liability, changes and law
Each party is liable for its own breaches of data protection law. Any limitation of liability in the Terms of Service applies to this agreement as well, except where the law does not allow it to.
Matvy may update this agreement to reflect a change in the law or in how the platform works. Material changes are notified at least 30 days in advance to the account’s registered email address. The current version, its number and its date are always published at matvy.com/dpa.
This agreement is governed by Swedish law, and disputes belong to the Swedish courts, with Stockholm District Court as the court of first instance.
This agreement is published in Swedish, English and Italian. If the versions differ, the English version governs.