1. Parties and scope
This Data Processing Agreement ("DPA") is entered into between the Customer (the controller) and Verimly, KvK 42197957, Newtonplein 20 A, 2562 JT 's-Gravenhage, The Netherlands (the processor, "Verimly"). It forms part of the Terms of Service and applies automatically when the Customer accepts those Terms. It applies to all personal data that Verimly processes on behalf of the Customer in providing the Service ("Customer Personal Data").
Terms such as "personal data", "processing", "controller", "processor", "data subject", "personal data breach" and "supervisory authority" have the meaning given in the General Data Protection Regulation (EU) 2016/679 ("GDPR").
This DPA does not apply to data for which Verimly is itself the controller, as described in the Verimly Privacy Policy and the Knownbee Privacy Notice, such as back-office account and billing data and the Knownbee accounts that guests create themselves.
2. Subject matter, nature and purpose
Verimly processes Customer Personal Data only to provide the Service as described in the Terms, the documentation and the Customer’s settings: recording and processing orders and payments, managing staff, roles, devices and cash sessions, time registration and labour planning, tip calculation, reservations, online and QR ordering, the Customer’s customer and loyalty records, gift cards, business websites, reports, audit logs, support, and security of the Service. Details are set out in Annex 1.
The processing lasts for the term of the agreement and the period after termination described in section 12.
3. Instructions
- Verimly processes Customer Personal Data only on documented instructions from the Customer. The Terms, this DPA, the Customer’s configuration of the Service and the actions of its Users in the Service are the Customer’s complete instructions. Additional instructions must be agreed in writing and may be subject to reasonable costs.
- The Customer instructs Verimly, for every customer record that the Customer creates or that is created by a guest through the Customer’s ordering or reservation pages, to link that record to a Knownbee identity based on the email address or phone number, so that the guest can claim and view their loyalty card and gift cards in the Knownbee app. Until the guest activates a Knownbee account, that identity holds only the contact detail and is processed on the Customer’s behalf. When the guest activates their account and accepts the Knownbee terms, Verimly becomes the controller of the Knownbee account itself, while the Customer remains the controller of its own customer record.
- Verimly may process Customer Personal Data otherwise only where required by EU or member state law. In that case Verimly informs the Customer before processing, unless the law prohibits this.
- When a User asks the assistant to look something up, or connects an AI agent to Verimly, that is an instruction of the Customer to process the data the User is allowed to see (and, for changes, confirms) for that purpose. Verimly masks guest contact details in tool results that go to AI models and never sends payment card data to them.
- Verimly informs the Customer immediately if, in its opinion, an instruction infringes the GDPR or other data protection law.
4. The Customer’s responsibilities
- The Customer is responsible for having a lawful basis for the processing, for informing data subjects (staff and guests) in accordance with articles 13 and 14 GDPR, and for obtaining any consent that is required, including for marketing.
- The Customer decides which data it enters. The Service is not designed to process special categories of personal data. Where free-text fields (such as order notes, reservation notes, customer notes, time-off notes or time entry notes) are used for information such as allergies, dietary requirements or health reasons for absence, the Customer is responsible for limiting this to what is necessary and for the lawfulness of that processing. In particular, the reason for sick leave should not be recorded beyond the fact of absence.
- The Customer is responsible for giving Users only the access they need, using the roles and permissions in the Service, and for removing access when it is no longer needed.
- Where the Customer uses the AI assistant or connects AI agents, it is responsible for deciding which Users may do so, for the permissions and scopes it grants, for the AI agents and clients it authorises and the data they receive, and for not using AI Features for decisions about staff or guests that have legal or similarly significant effects. Agents and clients the Customer authorises are not sub-processors of Verimly; the Customer is responsible for its own arrangements with them.
- Where the Customer uses staff scoring, time registration or labour planning, it is responsible for complying with employment law and, where applicable, for involving its works council or staff representatives.
5. Confidentiality
Verimly ensures that persons authorised to process Customer Personal Data are bound by confidentiality, have access only to the extent necessary for their tasks, and are trained on data protection. Verimly’s staff access Customer Personal Data only where necessary to provide, maintain or secure the Service, to provide support requested by the Customer, or to comply with law.
6. Security
Verimly implements appropriate technical and organisational measures to ensure a level of security appropriate to the risk, as required by article 32 GDPR. The measures in place are described in Annex 2. Verimly may update these measures as long as the overall level of security is not reduced.
7. Sub-processors
- The Customer gives Verimly general authorisation to engage sub-processors. The current sub-processors are listed on the Subprocessors page, which forms Annex 3 of this DPA.
- Verimly informs the Customer of any intended addition or replacement of a sub-processor at least 30 days in advance, by email to the account owner or by a notice in the back office. The Customer may object on reasonable data protection grounds within that period. If the parties cannot resolve the objection, the Customer may terminate the affected part of the Service before the change takes effect and receives a pro rata refund of prepaid fees for the remaining period.
- Verimly imposes on each sub-processor, by written contract, data protection obligations that offer at least the same level of protection as this DPA, and remains responsible to the Customer for the sub-processor’s performance.
- Stripe, which provides payment services under the Customer’s own Stripe account, is not a sub-processor of Verimly. Stripe processes payment data as an independent controller and processor under the Customer’s agreement with Stripe.
8. International transfers
Verimly stores Customer Personal Data in the European Economic Area. Verimly transfers Customer Personal Data outside the EEA only to recipients that are in a country with an adequacy decision of the European Commission (including certified organisations under the EU–U.S. Data Privacy Framework) or that have agreed to the European Commission’s Standard Contractual Clauses, with additional safeguards where needed. Annex 3 indicates where a sub-processor may access data from outside the EEA. Anthropic and Voyage AI, used only for the AI assistant and agent access, process data in the United States under the Standard Contractual Clauses.
9. Assistance with data subject rights
Taking into account the nature of the processing, Verimly assists the Customer in responding to requests from data subjects. The Service includes self-service tools for this purpose, including exporting and erasing a guest’s customer profile (which anonymises that guest’s reservations and removes their contact details from orders while keeping the financial records), deactivating staff, and data exports.
If Verimly receives a request directly from a data subject concerning Customer Personal Data, it forwards the request to the Customer without undue delay and does not respond to it itself, except to tell the data subject that the request has been forwarded. A guest who leaves a venue or deletes their account in the Knownbee app exercises that right directly; the Service then erases the Customer’s customer profile for that guest automatically, and the Customer can see this in its audit log.
10. Personal data breaches
- Verimly notifies the Customer without undue delay, and in any event within 48 hours, after becoming aware of a personal data breach affecting Customer Personal Data.
- The notification describes, to the extent known, the nature of the breach, the categories and approximate number of data subjects and records concerned, the likely consequences, and the measures taken or proposed. Information that is not available at first is provided as it becomes available.
- Verimly takes reasonable measures to contain the breach and limit its consequences, and assists the Customer with its obligations to notify the supervisory authority and data subjects. The Customer decides whether to notify the authority and data subjects.
11. Data protection impact assessments and audits
- Verimly provides reasonable assistance to the Customer with data protection impact assessments and prior consultations with supervisory authorities, to the extent the Customer cannot do so with information available to it.
- Verimly makes available to the Customer the information necessary to demonstrate compliance with article 28 GDPR, including this DPA, the Security page and, where available, summaries of independent certifications or audit reports of Verimly or its hosting providers.
- If that information is not sufficient, the Customer may, at most once a year and with at least 30 days’ notice, have an audit performed by an independent auditor bound by confidentiality, during business hours and without disproportionate disruption. The Customer bears the costs of the audit, unless it reveals a material breach of this DPA by Verimly. Audits by a supervisory authority are always permitted.
12. Return and deletion
After the subscription ends, the Customer’s access ends as described in the Terms. Verimly keeps Customer Personal Data for 90 days so that the subscription can be reactivated, and during that period provides an export in a common machine-readable format on the Customer’s written request. Verimly then deletes Customer Personal Data from its production systems within 30 days, and from backups in the normal rotation within a further 35 days, unless EU or member state law requires Verimly to keep it. On request, Verimly confirms the deletion in writing.
13. Liability and term
The limitations of liability in the Terms apply to this DPA, except where the GDPR does not allow a limitation. This DPA remains in force as long as Verimly processes Customer Personal Data. If this DPA and the Terms conflict on the processing of personal data, this DPA prevails. This DPA is governed by Dutch law and disputes are submitted to the court named in the Terms.
Annex 1. Description of the processing
| Data subjects | Personal data | Purpose in the Service |
|---|---|---|
| Staff of the Customer | Name, employee code, phone number, email address (staff portal), role and permissions, hashed PIN, devices and last sign-in, actions recorded in the audit log (including device and IP address of back-office actions), time entries, breaks and corrections, schedules, open shifts and shift requests, availability and unavailable dates, time-off requests and their type, hourly wage and employer cost (where entered), sales attributed to the staff member, tip shares, tip scores and score changes, staff portal notification preferences and inbox messages. | POS sign-in and accountability, permissions and approvals, time registration, labour planning, tip pooling, staff portal, reports, audit trail. |
| Guests and customers of the Customer | Name, email address, phone number, birthday (if entered), marketing consent and its date, notes and tags, order history and loyalty balance, loyalty transactions and member code, orders and order notes, table or tab name, payments (card brand, last four digits, amount, tip, Stripe reference), refunds and disputes. | Taking and fulfilling orders, payments, customer and loyalty records, customer display, receipts, reports. |
| Reservation guests | Name, phone number, email address, party size, date and time, language, notes, status (including no-show), source. | Managing reservations. |
| Online and QR ordering guests | Name, email address, phone number, order contents and notes, marketing consent, payment status; a receipt email address passed to Stripe. | Taking, paying for and handing over orders. |
| Gift card buyers and recipients | Recipient name and email address or phone number, sender name, gift message, delivery date and status, balance and transactions. | Issuing, delivering and redeeming gift cards. |
| Contacts at suppliers | Name, email address, phone number, address, VAT ID, notes. | Purchasing and stock management. |
| Users of the business website | No personal data is collected by the website itself. Visitors who click "Show map" load Google Maps directly from Google. | Publishing the Customer’s website. |
Special categories of personal data: not intended. Free-text notes may contain information about allergies, dietary requirements or health; see section 4. The type "sick" of a time-off request indicates absence for health reasons.
Frequency: continuous, for the term of the agreement.
Automated decision-making: the Service does not take decisions based solely on automated processing. When the Customer uses score-based tip pooling, the Service calculates a suggested coefficient from punctuality, attendance and sales per hour (compared with the team average, capped at 1.25 times) and from manual scores entered by managers. A manager reviews and finalises each tip pool before it takes effect.
Annex 1A. AI assistant and agent access
Purpose: letting Users ask questions about, and prepare changes to, the Customer’s data in natural language, and letting Users connect AI agents of their choice to the Customer’s data.
Data and data subjects: the same categories as in the table above, but only those that the requesting User can see in the Service and only to the extent a tool returns them. Guest phone numbers, email addresses and addresses are masked in tool results by default; card data is never returned; analysis tools return totals. Conversation content that the User types may include any personal data the User chooses to enter.
Recipients: Anthropic (language model) and Voyage AI (search over public help text; personal data is removed from queries). Both are sub-processors listed in Annex 3. Agents the Customer connects receive data under the Customer’s own responsibility.
Retention: assistant conversations, including files the User attached to them, 90 days (the User can delete them earlier; attached files never sent are deleted after 24 hours); tool-call and approval records 1 year; deleted on termination as described in section 12. At Anthropic, requests and answers are deleted within 30 days under its current terms.
Controls: the assistant and agents act with the User’s own permissions; changes need confirmation by a User; refunds, voids and payments are not available; the owner can switch off the assistant and agent access and revoke clients at any time; usage is logged.
Annex 2. Technical and organisational measures
- Hosting in the European Union with providers that maintain recognised security certifications (such as ISO 27001 and SOC 2). Production databases are located in the Netherlands.
- Encryption of all data in transit with TLS. Data at rest is encrypted by the hosting provider at storage level. The link between a POS device and the customer display on the local network is encrypted (AES-GCM).
- Strict tenant isolation: every database query on Customer data is automatically limited to the Customer’s organisation.
- Back-office passwords hashed with a modern password hashing algorithm; optional two-factor authentication (TOTP) with backup codes; all sessions are revoked when a password is reset.
- Staff PINs stored only as keyed hashes (HMAC-SHA-256 with a secret pepper); throttling of PIN and pairing attempts per device and IP address; automatic POS lock after inactivity; optional restriction to one active terminal per staff member.
- Device tokens, one-time codes, sign-in links, staff portal invitations, calendar feed links and gift card till codes stored only as hashes and, where applicable, short-lived (5 to 10 minutes for codes).
- Role-based access control with granular permissions and numeric approval limits; manager approval for sensitive actions; an audit log of who did what, on which device and when, with before and after values.
- Rate limiting of public and authentication endpoints; security headers; restricted cross-origin access.
- Minimisation in logs: recipient contact details of messages are stored only as keyed hashes; contact details are masked in staff views; images uploaded for websites are re-encoded and stripped of metadata.
- AI features: the assistant and agent interface run with the signed-in User’s own permissions and are limited further by token scope; every change is a proposal that a User confirms; guest contact details are masked and card data is never passed to AI models; agent keys and tokens are stored only as hashes, can be revoked, and are rate limited; all tool calls are logged.
- Secrets and keys stored in a managed secret store, not in the database or source code.
- Point-in-time recovery backups of the production database; tested restoration procedures.
- Access to production systems limited to authorised personnel, protected with multi-factor authentication, and logged.
- Confidentiality obligations for personnel; data protection awareness; a documented incident response procedure; coordinated vulnerability disclosure (see the Security page).
Annex 3. Sub-processors
The list of sub-processors, with their location, purpose and transfer mechanism, is published on the Subprocessors page and forms part of this DPA.