Data Processing Agreement

For the guest, booking and guest-book data it manages in AlpineTable, the customer is the controller and Marques Holdings B.V. is its processor. Where the customer itself acts as a processor (for example for a group or another venue), Marques Holdings B.V. is a sub-processor. Data that AlpineTable processes for its own purposes, such as restaurant account, login, billing and website data, is covered by the Privacy Notice, not by this DPA.

The subject matter is the provision of AlpineTable to the customer. Processing lasts for as long as the customer uses AlpineTable, plus the export and deletion period described below.

AlpineTable stores, organises, displays and transmits personal data so the customer can: take bookings through its public booking page, widget and partner links; manage the waitlist, tables and service; keep a guest book; send booking emails and, where the customer chooses, marketing emails; export data; and use optional features the customer turns on, such as the Telegram and WhatsApp owner assistant, AI drafting, voice-note transcription and menu parsing.

Guests and prospective guests who book, join a waitlist or are recorded by the restaurant; recipients of the restaurant’s booking and marketing emails; contacts at partner businesses (such as hotels, chalets and ski schools) that the restaurant adds; and the restaurant’s own staff users.

Names, email addresses, phone numbers and preferred language; booking details (date, time, party size, service, table preference, arrival access, gear, notes, status, source and cancellation reason); guest-book data (visit, cancellation and no-show counts, last visit, tags, preferences, dietary notes and internal notes); marketing consent and unsubscribe records; email delivery events; waitlist entries; messages exchanged through the service; staff names, emails and roles; and technical data such as IP addresses used for security. Dietary notes can reveal health information (such as allergies) or religious beliefs. The customer should record only what is needed to serve the guest.

Marques Holdings B.V. processes the data only on the customer’s documented instructions. These consist of the Terms, this DPA and the customer’s configuration and use of AlpineTable. It does not sell the data or use it for its own marketing. If an instruction appears to breach data-protection law, Marques Holdings B.V. will tell the customer. If the law requires other processing, it will tell the customer first unless the law forbids it.

Only people who need access to provide, secure or support the service can access the customer’s data, and they are bound by confidentiality obligations.

Current measures include: encrypted HTTPS connections; database encryption at rest described in Railway’s DPA; hashed passwords; API, device and staff-invite tokens stored only as hashes; per-restaurant separation of data; owner, manager and employee roles with different permissions; email verification and ownership checks before a new listing becomes public; bot protection and rate limits on signup; signature checks on incoming webhooks from email and messaging providers; explicit confirmation before higher-risk AI actions; and an audit log of significant changes. Measures may change over time but will not reduce the overall level of protection. The production backup schedule and restore procedure must be verified before this DPA becomes effective.

The customer gives general authorisation for the sub-processors listed in the public register. Marques Holdings B.V. will give at least 30 days’ notice, by email and in that register, before adding or replacing a sub-processor. The customer can object on reasonable data-protection grounds; if no solution is found, the customer can end the affected service and receive a pro-rata refund of any prepaid period. Each sub-processor is bound by data-protection obligations equivalent to this DPA, and Marques Holdings B.V. remains responsible for them.

AlpineTable has configured EU processing regions where available, but some providers store or access data outside the European Economic Area. Any such access or transfer requires an applicable adequacy decision or other lawful safeguard, such as the European Commission’s Standard Contractual Clauses. Provider-specific locations and safeguards are described in the public register; remaining account-level settings must be verified before this DPA becomes effective.

AlpineTable gives the customer tools to answer guest requests: editing and deleting guest records, CSV exports of bookings and guests, and unsubscribe links in marketing emails. If a guest contacts AlpineTable directly about the customer’s data, Marques Holdings B.V. will pass the request to the customer without undue delay. It will also give reasonable help with security, breach notifications and data-protection impact assessments.

Marques Holdings B.V. will notify the customer without undue delay, and no later than 48 hours after becoming aware of a personal-data breach affecting the customer’s data. The notice will describe what happened, the data and people likely affected, the likely consequences and the measures taken or proposed, as far as this information is available.

On account closure, the customer may export its data from the dashboard or request an export. Marques Holdings B.V. deletes or anonymises customer guest data within six months of the recorded closure date, including backups as they rotate, unless law requires longer retention. The restaurant sets and discloses its post-visit retention period while the account is active; seasonal Pause Mode is not account closure.

Marques Holdings B.V. will provide the information needed to show compliance with this DPA, starting with written answers to reasonable questionnaires. If that is not enough, the customer may carry out an audit, or have an independent auditor do so, once a year and on at least 30 days’ notice, at its own cost and under confidentiality. An extra audit is possible after a personal-data breach.

Liability under this DPA follows the Terms. If this DPA and the Terms conflict on data protection, this DPA prevails. This DPA is governed by the same law as the Terms. Questions: hey@pedromarques.io.