Data Processing Agreement

pursuant to Art. 28 DSGVO (GDPR) · Version: 7 October 2026

between the customer using HelpYa (controller, hereinafter “Customer”) and FFM&M RE GmbH, Sybelstraße 31, 10629 Berlin, Germany (processor, hereinafter “HelpYa”). This Agreement forms part of the contract of use under the Terms and Conditions and applies without a separate signature.

1. Subject matter and duration

HelpYa processes personal data on behalf of the Customer in order to notify the Customer’s guests of the status of their order, table, appointment or job (digital pager) and – insofar as the Customer uses “Order & Pay” – to receive guests’ orders placed at their seats and pass them on to the Customer. In addition, HelpYa processes data insofar as the Customer grants it insight within the scope of a support access (no. 3(4)). The Agreement applies for the term of the contract of use.

2. Type of data and data subjects

Data subjects: guests or customers of the Customer who take a number or for whom the Customer creates a number; at garages, additionally keepers or users of vehicles; for “Emergency & Safety”, additionally the persons stored by the Customer as alarm recipients (e.g. owner, security company).

Data:

• collection number, random identifier, status and times (created, ready, collected, delivery confirmation),
• random device identifier (cookie), language, push address of the browser,
• where a wallet pass is used: identifier of the pass at Google or Apple,
• at garages: registration number, month of the next statutory roadworthiness test (Hauptuntersuchung), proof of consent (time, wording) and dispatch log of the reminders,
• for “Order & Pay”: ordered items and options, seat (e.g. table), special requests or note (free text), payment method, payment status, tip and the Stripe payment identifier (no card or account details),
• for “Emergency & Safety”: time and type of an alarm, location or text voluntarily provided by the guest, random device identifier (protection against misuse), acknowledgement, false-alarm or all-clear note and delivery log; name, role and mobile number of the alarm recipients and, where applicable, the address of the alarm webhook,
• during a support access: technical details of the Customer’s devices (device type, browser, screen, notification permission, connection, technical error messages) and a log of the pages accessed and changes made by support.

Names, telephone numbers or email addresses of guests are not collected. Special categories of personal data (Art. 9 DSGVO (GDPR)) are not the subject of the processing; the Customer does not enter such information as a number or free text.

3. Instructions

(1) HelpYa processes the data only on documented instructions from the Customer. The instructions result from this Agreement, the Terms and Conditions and the Customer’s use of the functions of the service; the Customer gives further instructions in text form (Textform).

(2) If HelpYa considers an instruction to be unlawful, it informs the Customer without undue delay and may suspend its execution until the matter has been clarified.

(3) Processing on the basis of a legal obligation remains unaffected; HelpYa informs the Customer of it in advance, unless the law prohibits this.

(4) Support access: If the Customer grants HelpYa insight in the customer area by means of a code, this constitutes an instruction to view the Customer’s data for the duration of the access (a maximum of 60 minutes) for support purposes and – only in “view and edit” mode – to change them in consultation with the Customer. Even then, support cannot change access credentials, team accesses, the plan, payment and bank details or the Customer’s payment account at Stripe. The Customer can end the access at any time; every page accessed and every change is logged.

4. Confidentiality

HelpYa only deploys persons who have committed themselves to confidentiality or are under a statutory obligation of confidentiality.

5. Technical and organisational measures

HelpYa takes the measures described in Annex 1 pursuant to Art. 32 DSGVO (GDPR). They may be developed further, provided that the level of protection is not reduced.

6. Sub-processors

(1) The Customer consents to the use of the sub-processors listed in Annex 2.

(2) HelpYa informs the Customer in text form (Textform) at least four weeks in advance of any intended changes. The Customer may object for good cause relating to data protection law; if no agreement is reached, the Customer may terminate the contract of use with effect from the date of the change.

(3) HelpYa contractually obliges sub-processors to a level of protection corresponding to this Agreement.

7. Assistance to the Customer

(1) HelpYa assists the Customer by appropriate measures in fulfilling the rights of data subjects (Art. 12–22 DSGVO (GDPR)). Guests can themselves unsubscribe from notifications and withdraw consents and can themselves delete vehicle data. If a guest contacts HelpYa directly, HelpYa forwards the request to the Customer.

(2) HelpYa assists the Customer with the obligations under Art. 32–36 DSGVO (GDPR), in particular with notifications of personal data breaches and any data protection impact assessments.

8. Personal data breaches

HelpYa notifies the Customer of a personal data breach without undue delay after becoming aware of it, with the information set out in Art. 33(3) DSGVO (GDPR), insofar as available.

9. Deletion and return

(1) During the term, HelpYa deletes or anonymises data automatically: collection numbers 24 hours after collection, for jobs lasting several days at the latest 30 days after creation; special requests and notes on orders after 24 hours; vehicle data without consent upon completion of the job, with consent at the latest three years after the last contact or immediately at the guest’s request; the log and device data of a support access after 30 days; location, text and device identifier of an alarm as well as rejected alarm attempts after 30 days, alarm recipients upon removal by the Customer. Items and amounts of orders without personal reference are retained for the Customer’s records.

(2) After the end of the contract, HelpYa deletes all remaining data of the Customer within 30 days, unless there is a statutory retention obligation. On request, HelpYa provides the Customer beforehand with a report without personal reference.

10. Evidence and audits

HelpYa makes available to the Customer the information necessary to demonstrate compliance with this Agreement and allows for audits by the Customer or by an auditor mandated by the Customer who is bound to confidentiality – after notice given in good time, during normal business hours and without disrupting operations.

11. Place of processing

The data are stored and processed in Germany. A transfer to third countries takes place only within the scope of the services listed in Annex 2 and only under the conditions of Art. 44 et seq. DSGVO (GDPR).

12. Liability and final provisions

Liability is governed by Art. 82 DSGVO (GDPR); otherwise the provisions of the Terms and Conditions apply. In the event of conflicts, this Agreement takes precedence over the Terms and Conditions in matters of data protection.

Annex 1 – Technical and organisational measures

• Data minimisation: no names, telephone numbers or email addresses of guests; random 128-bit identifiers; automatic deletion after fixed periods (no. 9).
• Encryption: transmission exclusively via TLS (HTTPS with HSTS); push notifications end-to-end encrypted in accordance with the Web Push standard.
• Physical and system access control: servers accessible only via SSH key, password login disabled; protection against repeated failed login attempts.
• Data access control: strict separation of data per customer (multi-tenancy separation); personal accounts with hashed passwords (PBKDF2) and roles (admin/staff), single-use invitation links with expiry; device logins can be revoked by the Customer at any time. HelpYa staff see a customer’s data only with that customer’s time-limited support access (code, a maximum of 60 minutes, can be ended at any time, blocklist for access and payment data, complete log).
• Input control: status and delivery events are logged per number; no access logs with IP addresses are stored.
• Availability: operation in a data centre in Germany (Hetzner, Nuremberg); data backup before every software change.
• Separation: test and production data are kept separate; development takes place only with test data.

Annex 2 – Sub-processors

• Hetzner Online GmbH, Industriestr. 25, 91710 Gunzenhausen, Germany – server operation (data centre in Nuremberg, Germany).
• Google LLC / Google Ireland Ltd. – Google Wallet (only if the guest saves the pass) and push delivery to Chrome/Android; EU-US Data Privacy Framework.
• Apple Inc. / Apple Distribution International Ltd. – push delivery to Safari/iOS and Apple Wallet (only if the guest saves the pass); EU-US Data Privacy Framework.
• Mozilla Corporation – push delivery to Firefox; EU-US Data Privacy Framework.
• seven communications GmbH & Co. KG, Kiel, Germany (seven.io) – sending of SMS for the staff’s silent alarm to the telephone numbers stored by the Customer (owner, security company; only if the Customer uses “Emergency & Safety” with numbers).
• Anthropic, PBC, USA – reading and translating the Customer’s menu (only if the Customer uploads a menu, names a website or saves menu content); only menu content is transmitted, no guest data; EU standard contractual clauses, no use for training.

The push services receive only encrypted content and the push address generated by the guest’s browser.

Guests’ online payments are processed by Stripe (Stripe Payments Europe, Ltd., Dublin) via the Customer’s own Stripe account. For this purpose, the Customer concludes its own contract with Stripe; to that extent, Stripe is not a sub-processor of HelpYa. HelpYa transmits the order items and amounts to Stripe and receives from Stripe only the payment status and a payment identifier.

Terms and Conditions · Privacy Policy · Data Processing Agreement · Legal Notice