Data Processing Addendum

1. Definitions

• “Data Protection Law” means the data-protection and privacy laws that apply to the processing of Venue Personal Data. Depending on where you operate, these include the EU General Data Protection Regulation (“EU GDPR”), the UK GDPR and the UK Data Protection Act 2018, the Swiss Federal Act on Data Protection (“FADP”), Japan's Act on the Protection of Personal Information (“APPI”), Korea's Personal Information Protection Act (“PIPA”), and US state privacy laws.
• “Venue Personal Data” means the personal data we process on your behalf to provide GameLedger, as described in Annex 1. It is mainly data about your guests.
• “Controller,” “processor,” “data subject,” “personal data,” “personal data breach,” and “processing” have the meanings given in the GDPR. Where another Data Protection Law uses equivalent terms (for example, “business” and “service provider”), they apply in the same way.
• “Sub-processor” means a provider we engage that processes Venue Personal Data.
• “EU SCCs” means the standard contractual clauses approved by the European Commission in Implementing Decision (EU) 2021/914 of 4 June 2021.
• “UK Addendum” means the International Data Transfer Addendum to the EU SCCs issued by the UK Information Commissioner under section 119A of the Data Protection Act 2018 (version B1.0, in force from 21 March 2022), as revised under Section 18 of its Mandatory Clauses.

2. Roles and scope

2.1 You are the controller of Venue Personal Data, and we are your processor. If you are yourself a processor acting for another controller, you confirm you have that controller's authority to give us instructions, and we are your sub-processor.

2.2 For account data about you and your team (such as logins, names, roles, and platform usage), and for what you send us through our own website, we are a controller and our Privacy Policy applies instead of this DPA.

2.3 Annex 1 describes the processing: its subject matter, duration, nature and purpose, the types of personal data, and the categories of data subjects.

2.4 Where US state privacy laws (such as the California Consumer Privacy Act) apply, we act as your service provider. We will not sell or share Venue Personal Data; retain, use, or disclose it for any purpose other than the business purposes described in Annex 1 (taking and managing bookings, sending the emails you turn on, tracking payment status, reporting, and support), or outside our direct business relationship with you; or combine it with personal data we receive from anyone else, except as those laws permit. We will comply with the obligations those laws place on service providers and give Venue Personal Data the same level of protection they require of you; we will tell you if we can no longer meet those obligations; and on notice, you may take reasonable steps to stop and remediate any use of Venue Personal Data that those laws do not allow. We certify that we understand these restrictions.

3. Your instructions

3.1 We process Venue Personal Data only on your documented instructions, unless a law that applies to us requires otherwise. In that case we will tell you before processing, unless that law forbids it. Your instructions are the Terms and this DPA, the way you use and configure GameLedger (for example, the booking questions you ask guests and the emails you turn on), and any other written instructions you give us that we agree to. Where the EU SCCs apply, their Clauses 14 and 15 govern how we handle other laws and requests from public authorities.

3.2 We will tell you immediately if we believe an instruction breaks Data Protection Law.

3.3 You are responsible for having a lawful basis for the processing, for the privacy notices you give your guests (including any notice of transfer abroad; see sections 12 to 14), and for the lawfulness of your instructions.

4. Confidentiality

Everyone we allow to process Venue Personal Data is bound by a duty of confidentiality, by contract or by law, and has access only as needed to provide, support, and secure GameLedger.

5. Security

5.1 We apply the technical and organizational measures in Annex 2, which are appropriate to the risk of the processing. We may update them over time, provided the overall level of protection does not decrease.

5.2 You are responsible for the security choices within your own account, including who you invite to your team, the permissions you give them, and keeping your login details safe.

6. Sub-processors

6.1 You give us general authorization to engage sub-processors. The current sub-processors are listed in Annex 3 and in our Privacy Policy.

6.2 We bind each sub-processor by written contract to data-protection obligations that protect Venue Personal Data at least as well as this DPA. We remain responsible to you for each sub-processor's performance of those obligations.

6.3 Before a new sub-processor starts processing Venue Personal Data, we will update Annex 3 and email the owner of your venue account at least 30 days in advance.

6.4 You may object to a new sub-processor on reasonable data-protection grounds by emailing support@gameledger.io within that notice period. We will discuss your concerns in good faith and try to find a solution. If we cannot, you may stop using GameLedger and close your account before the change takes effect, and we will refund any fees you have paid in advance for the period after closure.

7. Help with guests' requests

7.1 Taking into account the nature of the processing, we will help you, by appropriate technical and organizational measures where possible, to respond to guests exercising their rights, such as access, correction, deletion, restriction, portability, and objection.

7.2 You can view and update guests' details on their bookings yourself, and export your bookings and customers as a spreadsheet (CSV). For anything you cannot do yourself, such as deleting a guest's records, email support@gameledger.io and we will carry it out.

7.3 If a guest contacts us directly about their data at your venue, we will pass the request to you without undue delay. We will not answer it ourselves, except to tell the guest we have passed it on, unless you ask us to or the law requires us to.

8. Impact assessments and regulators

Taking into account the nature of the processing and the information available to us, we will give you reasonable information and help for your data-protection impact assessments, any prior consultation with a supervisory authority, and your own security obligations.

9. Personal data breaches

9.1 We will tell you without undue delay, and in any event within 72 hours, after we become aware of a personal data breach affecting Venue Personal Data. We will email the owner of your venue account.

9.2 Our notice will describe, as far as we know at the time, what happened; the categories and approximate number of guests and records concerned; the likely consequences; the steps we have taken or propose to take; and who to contact for more information. If we don't yet know everything, we will send what we have and follow up as we learn more.

9.3 We will take reasonable steps to contain and investigate the breach and to reduce its effects, and we will help you meet your own obligations to notify regulators and guests. Telling you about a breach is not an admission of fault.

10. Deletion or return at the end

10.1 When you stop using GameLedger, you can export your bookings and customers yourself, or ask us at support@gameledger.io for a copy of your Venue Personal Data in a common format such as CSV.

10.2 We will delete Venue Personal Data, or anonymize it so it no longer identifies anyone, within 90 days after your account closes (to close it, email support@gameledger.io), or after you ask us to delete the data, if that is earlier. The exceptions are: (a) data the law requires us to keep, which we will keep secure and use only for that purpose; (b) records of earlier text-message opt-ins and opt-outs, which we keep as an independent controller to meet our own legal obligations, as described in our Privacy Policy, and use for nothing else; and (c) copies in backups, which are overwritten in the normal backup cycle.

11. Information and audits

11.1 We will make available the information you need to check that we meet our obligations under this DPA and Article 28 of the GDPR, by answering your reasonable written questions (such as a security questionnaire) and sharing relevant documents, including our sub-processors' certifications and audit reports where they allow it.

11.2 You (or an independent auditor you appoint who is bound by confidentiality) may audit our compliance, including by inspection, at reasonable intervals, or at any time if there are indications of non-compliance or a regulator requires it. Audits need at least 30 days' written notice (less after a personal data breach), take place during business hours, are at your cost, and must not put other customers' data or our security at risk. We may first offer a remote review.

12. International transfers

12.1 Venue Personal Data is stored and processed in the United States: our database, sign-in, and file storage are hosted by Supabase in Ohio, and the application runs on Vercel in Washington, D.C. Annex 3 shows where each sub-processor processes data. By using GameLedger, you instruct us to transfer Venue Personal Data to the United States to provide it.

European Union and European Economic Area

12.2 Where the EU GDPR applies to the transfer of Venue Personal Data to us, the EU SCCs are incorporated into this DPA, with you as data exporter and us as data importer, as follows: (a) Module Two (controller to processor) applies where you are a controller, and Module Three (processor to processor) where you are a processor; (b) the docking clause in Clause 7 applies; (c) in Clause 9, Option 2 (general written authorization) applies, with the notice period in section 6.3; (d) the optional wording in Clause 11 does not apply; (e) the competent supervisory authority under Clause 13 is the one determined in accordance with Clause 13(a); (f) in Clause 17, Option 1 applies and the governing law is the law of Ireland; (g) under Clause 18, disputes are resolved by the courts of Ireland; and (h) Annexes I, II, and III of the EU SCCs are Annexes 1, 2, and 3 of this DPA.

Switzerland

12.3 Where the FADP applies, the EU SCCs apply as in section 12.2, except that references to the GDPR are to the FADP, the competent supervisory authority is the Swiss Federal Data Protection and Information Commissioner, and “Member State” in Clause 18(c) includes Switzerland, so that guests in Switzerland can bring claims where they live.

United Kingdom

12.4 Where the UK GDPR applies, the UK Addendum is incorporated into this DPA and supplements the EU SCCs as set out in section 12.2, with: in Table 1, you as exporter and us as importer, with the details in Annex 1 and a start date of the date this DPA starts to apply to you; in Table 2, the modules and options in section 12.2; in Table 3, the information in Annexes 1 to 3; and in Table 4, either party may end the UK Addendum as set out in its Section 19. The Mandatory Clauses of the UK Addendum apply.

How we protect transferred data

12.5 Data is encrypted in transit and at rest (Annex 2). If a public authority asks us for Venue Personal Data, we will tell you, unless the law forbids it; we will challenge a request we consider unlawful; and we will disclose only the minimum the request requires. We will give you the information you reasonably need for your own assessment of the transfer.

12.6 If this DPA conflicts with the EU SCCs or the UK Addendum, those clauses prevail.

13. Venues in Japan (APPI)

Where APPI applies to you, Venue Personal Data you entrust to us is provided to a business in a foreign country (the United States). To support your obligations under APPI, we will:

• handle Venue Personal Data with measures equivalent to those APPI requires of a business handling personal information: using it only for the purposes you set, keeping it accurate, applying the security measures in Annex 2, supervising everyone who handles it and our sub-processors, not providing it to third parties except as this DPA allows, and helping you respond to guests' requests;
• tell you promptly about any leak, loss, or damage of Venue Personal Data (section 9), so you can report it to the Personal Information Protection Commission and tell the guests concerned;
• tell you promptly if we can no longer carry out these measures, or if we learn of a law or practice in the United States that could prevent us from doing so, so that you can take action, including stopping the transfer; and
• give you, on request, the information you need to check that these measures continue and to answer a guest who asks about them: a description of our measures, the country where the data is processed, any US law we know of that could affect them, and any problem in carrying them out and what we did about it; and, once a year on request, a written confirmation that these measures continue. The Personal Information Protection Commission publishes information about the United States' personal-information protection system.

14. Venues in Korea (PIPA)

14.1 Where PIPA applies to you, our processing for you is entrusted processing and an overseas transfer of personal information. This DPA sets out the purpose and scope of the entrusted work, the ban on processing for other purposes, the technical and managerial protection measures (Annex 2), the rules for sub-processors (section 6), and how you can check our compliance (section 11). Our liability for damage caused by a breach of this DPA is as set out in the Terms and section 15.

14.2 You must tell your guests about the entrustment and the overseas transfer, usually in your privacy policy, and Korean guests should get the notice in Korean. You can use the text below; replace the parts in square brackets with your own details. If you can take a booking without entering it in GameLedger (for example, on paper), say so in the “How to refuse” line.

15. Liability, duration, and changes

15.1 Liability arising from this DPA is subject to section 10 of the Terms, which does not limit liability under the EU SCCs or the UK Addendum.

15.2 This DPA lasts for as long as we process Venue Personal Data for you, including after the Terms end, until the data is deleted under section 10.

15.3 If the Terms and this DPA conflict on how personal data is handled, this DPA applies; section 12.6 sets out how the EU SCCs and the UK Addendum rank.

15.4 We may update this DPA when the law or GameLedger changes. We will give you notice of material changes as described in the Terms, and no change will reduce the overall protection of Venue Personal Data unless the law requires it.

15.5 If the law where you operate requires terms this DPA does not cover, email support@gameledger.io and we will work with you in good faith.

Annex 1: Details of the processing

A. The parties

• Data exporter: the Venue, as identified in its GameLedger account (its name and address, and its account owner's contact details). Role: controller (or processor). Activities: using GameLedger to take bookings and run the venue. Signature and date: accepting the Terms, which also accepts this DPA and the clauses it incorporates.
• Data importer: Fox Software LLC (GameLedger), 285 Mayson Avenue Northeast, Apt 373, Atlanta, GA 30307, USA. Contact: support@gameledger.io. Role: processor (or sub-processor). Activities: providing GameLedger. Signature and date: by publishing the Terms and accepting the Venue's agreement to them.

B. Description of the processing

• Data subjects: the Venue's guests and customers, meaning people who book, join a waiting list, check in at a table, or leave feedback after a visit.
• Personal data: name, email address, and phone number; party size, booking dates and times, and booking history; booking notes, answers to the Venue's booking questions, and notes the Venue's team adds; games reserved with a booking, occasion, and discount code; waiting-list entries; table check-ins and the games played; ratings and comments left after a visit; payment status, amounts, and refunds (card details are entered into Stripe's or Square's own forms and never reach GameLedger); email delivery and unsubscribe records; technical data (IP address, browser and device details in request logs, and the table-session cookie), which we also use as an independent controller to keep GameLedger secure and to count page views, as described in our Privacy Policy; and records of earlier text-message opt-ins and opt-outs (kept by GameLedger as controller after deletion; see section 10.2).
• Sensitive data: GameLedger does not ask for special categories of data, such as health information. A guest may choose to mention, for example, an accessibility or dietary need in a booking note. That note is protected by the same measures in Annex 2 and seen only by the Venue's team and, when needed for support, by us. Venues should not ask guests for sensitive data they don't need.
• Frequency: continuous, for as long as the Venue uses GameLedger.
• Nature of the processing: hosting, storage, organization, display to the Venue's team, sending the emails the Venue turns on, tracking payment status, reporting for the Venue, support, and deletion.
• Purpose: to provide GameLedger to the Venue under the Terms: taking and managing bookings, sending the emails the Venue turns on, tracking payment status, reporting, and support.
• Retention: for as long as the Terms apply, then deleted under section 10.
• Transfers to sub-processors: to the sub-processors in Annex 3, for the same subject matter and purpose, and for as long as they are needed to provide GameLedger.

C. Competent supervisory authority

As set out in sections 12.2 to 12.4.

Annex 2: Security measures

• Encryption: every connection to GameLedger uses HTTPS (TLS). The database is encrypted at rest by our hosting provider. Access tokens for a venue's connected Square account are additionally encrypted (AES-256-GCM) before they are stored.
• Separation between venues: access checks in our server code, database access rules, and database credentials that never leave our servers keep each venue's data separate. Within a venue, the owner decides who joins the team and what each member can see and change.
• Access by GameLedger: production systems are accessible only to GameLedger's founder and, under the founder's supervision, the AI development tools listed in Annex 3, and only to provide, support, and secure the service. Those tools work with code, database structure, counts, venue and team account details, and test data. They are never used to read guests' personal data, and if a guest's details appear in passing (for example, in an error log), they are not copied elsewhere or used for anything.
• Passwords and sign-in: passwords are stored by our sign-in provider only as one-way hashes, never in plain text.
• Payment cards: card details are entered directly into Stripe's (or Square's) own secure forms and never reach GameLedger's servers.
• Browser protections: our pages send a Content Security Policy, and only GameLedger may embed them, except the booking and games pages, which venues can embed on their own websites.
• Backups: the database is backed up daily by our hosting provider.
• Data minimization: emails and phone numbers are removed from Settings questions before they are sent for matching, and our page analytics set no cookies and never record pages that carry a booking link, an invitation, or an email address.
• Changes and testing: every change goes through a pull request the founder approves before it reaches production, changes to what people see are tried on an access-protected preview deployment first, and automated tests cover payment, permission, and availability logic.
• Helping with guests' requests: venues can view, correct, and export guest data themselves (section 7.2), and we carry out deletions and other requests on the venue's instruction.
• Logging and incidents: hosting and database logs are kept for a limited period to investigate security events, and breaches are handled as set out in section 9.
• Sub-processors: chosen for their security practices and bound by written data-protection terms (section 6).

Annex 3: Sub-processors

The providers below process personal data for GameLedger. All of them except Google and Anthropic may process Venue Personal Data: Google receives only a venue's own business details, Anthropic is never used to read guests' personal data (see Annex 2), and Microsoft receives guest data only when someone emails it to us. We tell you before this list changes (section 6.3).

• Supabase

  Purpose

  Database, sign-in, and file storage

  Data

  Booking, guest, and account data

  Location

  United States (Ohio)

• Vercel

  Purpose

  Application hosting and delivery, and analytics for our public pages

  Data

  Request data, logs, and page-view and form-submission analytics

  Location

  United States (Washington, D.C.), with pages delivered through its worldwide network

• Resend

  Purpose

  Transactional email, such as booking confirmations and reminders

  Data

  Email address and message content

  Location

  United States

• Stripe

  Purpose

  Payment processing for venue deposits and payments, on the venue's own Stripe account

  Data

  Payment details, amount, and limited contact data

  Location

  United States

• Square

  Purpose

  Payment for food and drink orders placed at the table, on the venue's own Square account (in testing; not yet offered to venues)

  Data

  Order contents, payment details, and amount

  Location

  United States

• Google

  Purpose

  Finding a venue's own listing on Google to fill in its profile and opening hours

  Data

  The venue name or address searched for, and the listing details returned

  Location

  United States

• TypeSafe

  Purpose

  Matching questions a venue types into its Settings search to the right settings page

  Data

  The question text, with emails and phone numbers removed (anything else typed, such as a guest's name, is sent as typed), the settings page it was asked from, and the venue's offering names

  Location

  United States (company headquarters; hosting location not published)

• Microsoft

  Purpose

  Our email inbox, including support@gameledger.io

  Data

  Emails sent to us and our replies

  Location

  United States

• Anthropic

  Purpose

  AI assistant GameLedger's founder uses to build, test, and support GameLedger

  Data

  Code, database structure, counts, venues' business details, venue team members' names and login emails, and test bookings; never used to read guests' personal data

  Location

  United States

Contact

Questions about this DPA, a guest request, or a security concern? Email support@gameledger.io.