← All documents

Data Processing Agreement

Version 1.0 · effective 25 October 2026

This Data Processing Agreement (the "DPA") is made between:

• the Customer, the restaurant, café or company for which a company account is opened in Margin Flow and which has accepted the Margin Flow Terms of Service (the "Controller"); and
• DAILYCARE LTD, HE 457941, Archiepiskopou Makariou III 232, Apollo Court, 6th floor, Office 602, 3030 Limassol, Cyprus (the "Processor", "we").

It sets out the terms required by Article 28(3) of the GDPR. It forms part of the Terms of Service. It is entered into when the Customer's owner or master account holder accepts the Terms at first login, or accepts updated terms in the Service. That acceptance is the Customer's signature of this DPA. No separate signature is needed.

1. Definitions

• "GDPR" means Regulation (EU) 2016/679.
• "Service" means Margin Flow, including the web account at app.marginflow.biz and the invoice intake Telegram bot @Invoiceinput_bot.
• "Personal Data" means personal data that the Processor processes on behalf of the Controller in providing the Service.
• "Sub-processor" means another processor engaged by the Processor.
• "User" means a person who has a login to the Controller's account.

Terms such as "processing", "data subject", "personal data breach" and "supervisory authority" have the meaning given in the GDPR.

2. Subject matter, duration, nature and purpose

2.1. Subject matter. The Processor processes Personal Data to provide the Service to the Controller: invoices and purchasing, supplier prices, dish costing, sales and reports, inventory analysis, recommendations, and the related integrations and support.

2.2. Duration. This DPA applies for as long as the Processor processes Personal Data for the Controller. That is the term of the Customer's account, plus the retention and deletion period in section 10.

2.3. Details. The nature and purpose of processing, the categories of Personal Data and the categories of data subjects are described in Annex 1.

3. Instructions

3.1. The Processor processes Personal Data only on documented instructions from the Controller. That includes transfers to third countries, unless EU or Member State law requires otherwise. In that case the Processor informs the Controller before processing, unless the law prohibits this.

3.2. The Controller's documented instructions are:

• the Terms, the Order and this DPA;
• the Controller's configuration of the Service, such as Users created, permissions, venues and integrations connected;
• actions taken by the Controller's Users in the Service, such as uploading an invoice or sending a document to the POS or back-office;
• other written instructions agreed between the parties.

3.3. POS and back-office. On the Controller's instructions, the Processor loads data from the Controller's POS or back-office system using access keys the Controller provides. Access is read-only. The Processor writes to the POS or back-office only when a User explicitly sends a document to it.

3.4. Aggregated statistics. The Controller authorises the Processor to derive aggregated or de-identified information from the processing, such as invoice recognition quality, errors and speed, and to use it to improve its products. Such information does not identify the Controller or any individual.

3.5. No other use. The Processor does not sell Personal Data, does not use it for advertising, and does not use the Controller's data to serve any other customer. The Controller's prices, volumes, terms and invoices are never shown to other customers.

3.6. The Processor informs the Controller immediately if, in its opinion, an instruction infringes data protection law.

3.7. The Controller is responsible for the lawfulness of its instructions and of the processing it initiates. This includes having a legal basis, informing data subjects (including its Users and staff whose names appear in POS data), and having the right to give the Processor access to its systems.

4. Confidentiality

The Processor ensures that persons authorised to process Personal Data are bound by confidentiality. Access is limited to persons who need it to operate, support or secure the Service.

5. Security

The Processor implements the technical and organisational measures in Annex 2, as required by Article 32 GDPR. It may update these measures, provided the overall level of protection is not reduced.

6. Sub-processors

6.1. The Controller gives a general authorisation for the Processor to engage Sub-processors. The current list is published on the Sub-processors page and forms Annex 3.

6.2. The Processor will notify the Controller of any intended addition or replacement of a Sub-processor at least 30 days in advance. It does so by email to the master account or by a notice in the Service, and by updating the Sub-processors page. The Controller may object on reasonable data protection grounds within that period. If the parties cannot resolve the objection, the Controller may terminate the affected part of the Service and receive a refund of any fees prepaid for the period after termination.

6.3. Where an urgent replacement is needed for security or continuity, the notice may be shorter. The Processor will then notify the Controller as soon as possible.

6.4. The Processor imposes data protection obligations on each Sub-processor that are substantially the same as those in this DPA, where the Sub-processor offers such terms. It remains liable to the Controller for the Sub-processor's performance, as provided in Article 28(4) GDPR. Telegram does not offer data processing terms. Its use is optional for every User, and its status is stated on the Sub-processors page.

7. International transfers

Personal Data is hosted on Hetzner Online GmbH servers in the EU (Germany and Finland). Where a Sub-processor processes Personal Data outside the EEA, the Processor ensures an appropriate safeguard under Chapter V GDPR. Examples are an adequacy decision (including the EU–US Data Privacy Framework for certified recipients) or the Standard Contractual Clauses adopted by the European Commission. The mechanism for each Sub-processor is listed in Annex 3.

8. Assistance

8.1. Data subject requests. The Processor assists the Controller, through appropriate technical and organisational measures, to respond to requests from data subjects exercising their rights. If the Processor receives a request directly, it forwards it to the Controller without undue delay, and in any case within 5 business days. It does not respond itself except to confirm receipt and redirect the person, unless the Controller instructs otherwise. The master account can view, correct and remove Users and data in the Service.

8.2. Other obligations. Taking into account the nature of processing and the information available to it, the Processor assists the Controller with:

• security of processing;
• breach notifications;
• data protection impact assessments;
• prior consultations with supervisory authorities (Articles 32–36 GDPR).

9. Personal data breaches

9.1. The Processor notifies the Controller without undue delay, and in any event within 48 hours, after becoming aware of a personal data breach affecting the Controller's Personal Data.

9.2. The notification includes, as far as then known:

• the nature of the breach;
• the categories and approximate number of data subjects and records concerned;
• the likely consequences;
• the measures taken or proposed;
• a contact point.

Information may be provided in phases.

9.3. The Processor takes reasonable steps to contain the breach and mitigate its effects. Notifying supervisory authorities and data subjects is the Controller's responsibility, and the Processor assists with it.

10. Deletion or return at the end of the Service

10.1. During the Service, the Controller can export its data using the exports built into the Service. On request, the Processor provides an export in a common machine-readable format.

10.2. After the account ends, the Processor keeps Personal Data for 90 days, so that the Controller can ask for a final export. After that period, the Processor deletes or anonymises the Personal Data in its live systems. Copies in encrypted backups are overwritten within a further 60 days.

10.3. Section 10.2 does not apply where EU or Member State law requires the Processor to keep the data.

11. Audits and information

11.1. The Processor makes available to the Controller the information necessary to demonstrate compliance with Article 28 GDPR. This includes answers to reasonable security questionnaires.

11.2. The Controller (or an independent auditor it mandates, bound by confidentiality) may audit the Processor's compliance:

• no more than once in any 12-month period, unless a breach or a supervisory authority requires otherwise;
• with at least 30 days' written notice;
• during business hours;
• in a way that does not disrupt the Service or compromise other customers' data.

Each party bears its own costs, unless the audit reveals a material breach by the Processor.

12. Liability and precedence

12.1. Liability under this DPA is subject to the limitations in the Terms of Service, except where the law prohibits such limitation.

12.2. In case of conflict between this DPA and the Terms or the Order on the processing of Personal Data, this DPA prevails.

12.3. This DPA is governed by the laws of the Republic of Cyprus. The courts of Limassol have jurisdiction.

---

Annex 1 — Details of processing

Data subjects:

• the Controller's owners, managers and employees who are Users of its account;
• contact persons of the Controller's suppliers, whose details appear on invoices, documents or supplier records;
• cashiers and other staff of the Controller whose names appear in data loaded from its POS or back-office;
• other persons who appear on documents that Users upload.

Categories of Personal Data:

• User data: login, name, email, interface language, role and permissions, Telegram user ID and Telegram name if the User links the bot;
• action log: who uploaded or changed what, and when;
• names, signatures and phone numbers of supplier contact persons, as they appear on invoices and documents (photos, PDF, Excel) and in supplier records;
• names of cashiers and other staff linked to POS operations such as voids, deletions and discounts;
• messages and invoice photos sent to the Telegram bot.

The Service also processes commercial data that is mostly not personal: suppliers, prices, purchases, stock, inventory counts, sales, recipes, costing and, if the Controller connects IzyShift, aggregated labour cost without personal details of staff.

The Processor processes User logins, login records and acceptance records (time, IP address, browser user agent) also as controller, for authentication, security and evidence, as described in the Privacy Policy.

Special categories: none. The Controller and its Users must not upload special categories of personal data (Article 9 GDPR).

Nature of processing: collection, recording, automatic recognition of invoices (including by the OpenAI API), organisation, storage, retrieval, calculation, display to authorised Users, transmission through the Telegram bot (if linked), export, sending documents to the POS or back-office when a User explicitly chooses to, deletion.

Purpose: providing the Service to the Controller: invoice intake and purchasing, supplier prices, dish costing, sales and reports, inventory analysis, control of POS operations, recommendations, support and security; and deriving aggregated or de-identified information to improve the Processor's products (section 3.4).

Frequency: continuous, for the duration of the Service.

Retention: as set out in section 10, and subject to the Controller's own deletions.

Annex 2 — Technical and organisational measures

1. Hosting and location. Hetzner Online GmbH servers in the EU (Germany and Finland).
2. Encryption in transit. All web and bot traffic to the Service uses TLS.
3. Passwords. Passwords are stored only as hashes, never in plain text.
4. Login protection. Login attempts are limited.
5. Separation of customers. Each company's data is isolated (separate databases or tenants).
6. Access control. Permissions are set by role. The master account decides which Users can see which venues and data, and what they can do.
7. Action log. The Service records who uploaded or changed what, and when.
8. Backups. Backups are encrypted before they leave the server. The key is held only by the Processor.
9. Administrative access. Access to the servers is restricted to the Processor's authorised administrators and uses SSH keys only.
10. Data minimisation. Access to the Controller's POS is read-only, except when a User explicitly sends a document. Labour cost from IzyShift is received only in aggregated form. There is no analytics or advertising tracking.
11. Incident handling. Breaches are assessed and the Controller is notified as in section 9.
12. Personnel. Access is limited to persons bound by confidentiality, on a need-to-know basis.

Annex 3 — Sub-processors

The current list, with each Sub-processor's purpose, data, location and transfer safeguard, is published on the Sub-processors page and is incorporated by reference.