POSPal · Legal
Data Processing Addendum (DPA)
The Greek text controls. This English version is provided for convenience only.
Provider / Licensor:
ZOUMPOULIS ERI ROMPERTOS tou EFSTRATIOU
Greek legal name: ΖΟΥΜΠΟΥΛΗΣ ΕΡΗ ΡΟΜΠΕΡΤΟΣ του ΕΥΣΤΡΑΤΙΟΥ
Sole proprietorship — trading as POSPal
Registered address: ΚΥΒΟΠΟΥΛΟΥ ΠΕΤΡΟΥ 13Β, ΜΥΤΙΛΗΝΗ / ΛΕΣΒΟΣ, 81100, Ελλάδα
AFM: 159497740
GEMI: 195335742000
EUID: ELGEMI.195335742000
Controller and licensor: the provider identified above. POSPal currently operates under the Greek small-business VAT exemption regime, so VAT is not added to the subscription fee. Contact: [email protected].
This DPA forms part of the B2B contract only when POSPal processes personal data on the merchant's behalf and it has been incorporated into a binding order/contract or accepted through a recorded written or electronic action. Continued use alone is not presented as standalone proof of acceptance.
1. Roles and scope
The merchant is controller and POSPal is processor for personal data the merchant chooses to send to a public Customer Menu, support, or another cloud feature on its behalf. POSPal is an independent controller for licensing, security, billing, and its legal duties as described in the Privacy Notice.
2. Processing description
| Item | Description |
|---|---|
| Duration | Subscription plus Privacy Notice retention |
| Nature/purpose | Hosting published menus, technical support, merchant-requested cloud features |
| Data | Menu content and personal data the merchant includes; report details/diagnostics |
| Subjects | Staff, customers, suppliers, or others included by merchant |
3. Instructions/confidentiality
POSPal processes only on documented instructions expressed through feature use and contract, unless law requires otherwise. If an instruction infringes the GDPR or other applicable data-protection law, POSPal informs merchant before acting unless law prohibits notice. Authorised persons owe confidentiality. Merchant gives no unlawful instructions and avoids special-category/payment data.
4. Security
Verifiable measures for this release include HTTPS in transit to cloud APIs, hashing of selected identifiers, minimisation/redaction of selected diagnostics, account/repository access controls, and logging of selected important events. The incident procedure and current internal technical and organisational measures schedule are documented separately and reviewed. No certification, complete environment separation, or absolute security is claimed. Merchant secures devices, LAN, accounts, PINs, and backups.
5. Subprocessors/transfers
Merchant gives general written authorisation for the Subprocessor List only when this DPA has been bindingly incorporated into the contract. For a material new processor, the list is updated and notice is sent to the available billing/email address normally 30 days beforehand where practicable, allowing a substantiated objection. If no reasonable solution exists, either party may discontinue the affected feature under the contract. Appropriate contractual duties and verified lawful transfer mechanisms must be in place before the relevant processing.
6. Compliance assistance
Taking account of processing, POSPal reasonably assists with data-subject requests, security, breach notification, DPIAs, and consultation. Merchant remains responsible for decisions/communications. POSPal will notify merchant without undue delay after becoming aware of a personal-data breach involving its data; initial notice may be supplemented as facts are confirmed.
7. Return/deletion
On termination, merchant exports local data using available means. At merchant's choice through support, cloud data is returned where an export format is available and then deleted, or deleted without return. Deletion covers copies controlled by POSPal and backups as their cycles expire, unless law requires retention. If no choice is given, the retention schedule applies. Enforcement is currently manual quarterly review, not automated.
8. Audits
Available compliance information is supplied on reasonable request. One reasonable annual audit may be agreed under confidentiality, without access to other customers, secrets, or vulnerabilities and without undue disruption. Additional audit may follow a material incident or authority demand.