Data Processing Agreement

This Data Processing Agreement (“DPA”) forms part of the Terms and Conditions between WaitQ and the customer (“Customer”). It applies automatically whenever WaitQ processes personal data on Customer’s behalf. No separate signature is needed. If Customer needs a signed copy, email support@waitq.app.

1. Definitions

Terms not defined here have the meaning given in the Terms or in Data Protection Law.

• Data Protection Law means the EU General Data Protection Regulation 2016/679 (“GDPR”), the UK GDPR and the UK Data Protection Act 2018, and any other data protection law that applies to the Processing.
• Personal Data, Processing, Controller, Processor, Data Subject and Supervisory Authority have the meanings given in the GDPR.
• Customer Personal Data means Personal Data that WaitQ processes on Customer’s behalf through the Service.
• Subprocessor means a third party WaitQ engages to process Customer Personal Data.
• Security Incident means a breach of security leading to the accidental or unlawful destruction, loss, alteration, unauthorised disclosure of, or access to, Customer Personal Data.
• Standard Contractual Clauses means the clauses approved by the European Commission in Implementing Decision (EU) 2021/914, and the UK International Data Transfer Addendum where UK law applies.

2. Roles

Customer is the Controller of Customer Personal Data, and WaitQ is its Processor. WaitQ acts as an independent Controller for the account, billing, support, security and website data described in its Privacy Policy. This DPA does not cover that data.

3. Customer’s obligations

Customer is responsible for:

1. having a lawful basis to collect Customer Personal Data and to have WaitQ process it;
2. giving Data Subjects the notices that Data Protection Law requires;
3. obtaining any consent needed to contact End Users by SMS, WhatsApp, email or push notification, and honouring opt-outs;
4. configuring check-in forms so they collect only the data Customer needs. Customer must not use the Service to collect special categories of Personal Data under Article 9 GDPR.

4. WaitQ’s obligations

WaitQ will:

1. process Customer Personal Data only on Customer’s documented instructions, including for international transfers, unless the law requires otherwise. The Terms, this DPA and Customer’s configuration of the Service are Customer’s complete instructions. WaitQ will tell Customer if it believes an instruction breaches Data Protection Law;
2. ensure that everyone authorised to process Customer Personal Data is bound by confidentiality;
3. maintain the technical and organisational measures in Annex II;
4. assist Customer, taking into account the nature of the Processing, in responding to Data Subject requests and in meeting its obligations under Articles 32 to 36 GDPR;
5. pass to Customer any Data Subject request it receives about Customer Personal Data, without responding to it except on Customer’s instructions;
6. make available the information reasonably necessary to demonstrate compliance with this DPA.

5. Subprocessors

1. Customer gives WaitQ general authorisation to engage Subprocessors. The current list is published at waitq.app/subprocessors.
2. WaitQ will notify Customer at least 30 days before adding or replacing a Subprocessor, by email to the account owner and by updating that page.
3. Customer may object on reasonable data protection grounds within those 30 days. The parties will discuss the objection in good faith. If they cannot resolve it, Customer may terminate the affected part of the Service.
4. WaitQ will impose data protection obligations on each Subprocessor that protect Customer Personal Data to the standard of this DPA. WaitQ remains responsible to Customer for its Subprocessors’ performance of those obligations.

6. International transfers

WaitQ’s database and application are hosted in the United States, and some Subprocessors process data there. Where Processing involves a transfer of Customer Personal Data outside the European Economic Area or the United Kingdom to a country without an adequacy decision, WaitQ ensures the transfer is covered by the Standard Contractual Clauses with the relevant Subprocessor.

7. Security Incidents

WaitQ will notify Customer without undue delay after becoming aware of a Security Incident. The notice will describe, as far as WaitQ then knows:

1. the nature of the incident, and the categories and approximate number of Data Subjects and records concerned;
2. its likely consequences;
3. the measures taken or proposed to address it and limit its effects;
4. a contact for further information.

WaitQ will update Customer as more information becomes available. Notice of a Security Incident is not an admission of fault or liability.

8. Audits

WaitQ will answer Customer’s reasonable written questions about its compliance with this DPA, including security questionnaires. Customer agrees that the SOC 2 Type 2 attestations of WaitQ’s infrastructure providers may be used to help demonstrate compliance.

If that information is not enough to show compliance, or a Supervisory Authority requires it, Customer may carry out an audit, or have an independent auditor bound by confidentiality do so. Customer must give at least 30 days’ written notice. Audits are limited to once a year, take place during business hours, are at Customer’s cost, and must not disrupt the Service or expose other customers’ data.

9. Deletion and return

Customer can delete Customer Personal Data in the Service at any time. During the subscription, WaitQ keeps Customer Personal Data until Customer deletes it. Depending on Customer’s plan, the Service shows queue, booking and guest list history for up to 90 days after the relevant visit or booking. That window limits what Customer can view and export. It does not delete data.

When the subscription ends, Customer has 30 days to export Customer Personal Data. WaitQ will then delete it, unless EU or Member State law requires continued storage. Deleted data is removed from backups as they rotate.

10. Liability

Each party’s liability under this DPA is subject to the limitations of liability in the Terms. Nothing in this DPA limits either party’s liability to Data Subjects, or any liability that cannot be limited under Data Protection Law.

11. Duration and order of precedence

This DPA lasts as long as WaitQ processes Customer Personal Data. If documents conflict, the following order applies: the Standard Contractual Clauses, then this DPA, then the Terms.

Annex I: Details of processing

Annex II: Technical and organisational measures

Annex III: Subprocessors

The current list of Subprocessors, with their purpose and location, is published at waitq.app/subprocessors.