Data Processing Agreement
Last updated 1 November 2026
This Data Processing Agreement ("DPA") forms part of the Terms of Service between you (the restaurant) and TableTango Ltd, a company registered in England & Wales (company no. 17287615) whose registered office is 71–75 Shelton Street, Covent Garden, London WC2H 9JQ ("TableTango"). It sets out how we handle your guests' personal data, and your staff's where you use staff PINs or staff devices, on your behalf, as required by UK data protection law (UK GDPR Article 28). You accept it when you connect your restaurant. Plain English, as ever — questions to hello@tabletango.co.uk.
1. Who's who
Your guests' personal data is yours. You decide what's collected and why, so you are the data controller. We process it only to run the service for you, so we are your data processor. (Separately, for our own data — your account details and email enquiries to us, and our staff — we're the controller; that's covered in our privacy notice.)
Where you use staff PINs or staff devices, the information about your own team described in section 2 is also your data: you are its controller and we are your processor, and everything this DPA says about your guests’ data applies to it in the same way.
2. What we process, and why
| Subject matter | Providing the TableTango booking service to your restaurant. |
|---|---|
| Duration | For as long as you use the service, then deletion/return as in section 7. As a standing retention measure, personal data on individual bookings is automatically anonymised 24 months after the booking, and text/email logs and unused waitlist/feedback records are deleted after 24 months. For card-secured bookings that anonymisation clears the card brand and last four digits and most Stripe references (customer, setup intent, payment intent, checkout session); the fee checkout session and any refund reference currently remain, and can still be linked to a person through Stripe, so treat them as personal data. |
| Nature & purpose | Taking, storing and managing bookings; sending confirmation and reminder messages; recording a guest's own marketing permission where they give one at booking, so you can honour and evidence it; at your documented instruction (the confirmation you give in Settings), copying the email address of each guest who opted in to your email news and offers, with the date they agreed and a TableTango tag, into your own Mailchimp audience, and passing unsubscribes and erasures between the two; and the optional features you switch on or use (waitlist, post-visit reviews, AI booking chat, the owner AI assistant, the No-show Shield — securing a booking against a guest's card and charging, waiving or refunding an agreed no-show fee through your own Stripe account — and Deposits/prepayment and Booking add-ons, collected through your own Stripe account). The service also supports saved guest profiles, restaurant imports of guest names and contact details, and an optional private-functions diary with organiser contact details and notes. Where you use staff PINs or staff devices, the service also records which team member carried out an action and runs the staff devices you approve. |
| Types of personal data | Guest name, phone number, email, booking details (date, time, party, table), booking occasion and per-booking notes, including dietary information the guest chooses to provide. Saved profiles may also include contact details, VIP status and standing requirements. Booking and profile information may be supplied by a guest or recorded by the restaurant. Private-function records may include the organiser's name, phone number and email address, alongside the function details and notes. Where a guest chooses to receive your news and offers, also: that choice per channel, the exact address or number it applies to, when they made it, the wording they were shown, and any later withdrawal — kept as the evidence that the permission is real, and kept for as long as you rely on it plus the minimum needed to stop an accidental re-subscription. Where you switch the No-show Shield on, also: the card's brand and last four digits; Stripe's references for the checkout session, customer, saved payment method and any payment; the time the guest agreed and the fee policy in force then; the status of the hold or fee; amounts charged or refunded; and whether a payment was disputed. Where you use staff PINs or staff devices, also, about your own team: each team member’s name and role (staff or manager), with their PIN kept only in a one-way scrambled (hashed) form that cannot be read back; the staff devices you approve, with who approved each one and when; which team member is signed in on a staff device, and when that session started and ends; the times of wrong PIN entries; and which team member carried out actions such as booking changes, refunds and no-show charges. Full card details are collected by Stripe directly and are never received or stored by TableTango. |
| Categories of data subject | Your guests / diners, people who join your waitlist, private-function organisers, and your own staff who use staff PINs or staff devices. |
3. Our promises as your processor
- Only on your instructions. We process your guests' data only to provide the service and on your documented instructions (these terms + how you configure the service). We'll tell you if we think an instruction breaks the law.
- Confidentiality. Anyone who can access the data is bound to keep it confidential.
- Security. We keep appropriate technical and organisational measures (UK GDPR Article 32): data hosted in the UK (London); access controls and row-level security so each restaurant only sees its own data; encryption in transit and at rest; secret keys held in a secrets vault, never in the website code; daily encrypted backups with restoration; and monitoring for security issues.
- Helping with guest rights. We help you respond to your guests' data requests. The admin console supports searching for candidate records and carrying out scoped exports or erasure after the requester's identity and the relevant records have been checked. A matching phone number or email address is not, by itself, proof that every matching record belongs to that requester. Saved profiles and other remaining records may need separate review.
- Breaches. We'll tell you without undue delay if we become aware of a personal-data breach affecting your data, with the detail you need to meet your own obligations, and help you assess and report it.
- Help with assessments. We'll reasonably assist with data protection impact assessments and any prior consultation with the ICO.
- Deletion / return. When you leave, or ask us to, we delete or return your guests' data — and delete existing copies — within 30 days; this takes priority over the standing 24-month retention above, so we don't wait for the 24-month point. Guest identity and the card details we display are removed straight away. Two exceptions: data the law requires us to keep, and the payment references needed to finish the money — provider and transaction ids so a payment can still be settled, refunded, reconciled or defended in a dispute, and, while a no-show fee remains chargeable, the saved payment-method reference. Deletion of the customer record held at Stripe is queued. We wait until its payment or session no longer needs that record, then ask Stripe to delete it and retry until Stripe positively confirms it, so that step is not bounded by the 30 days.
4. Sub-processors
We use a small set of trusted providers to run the service. This list covers the sub-processors that handle your guests' data; providers we use only for our own data — such as email-deliverability checks for our outreach to restaurants — are listed in our privacy notice instead. By accepting this DPA you give general authorisation to those below. We'll give you at least 30 days' notice before we add or replace one; if you have a reasonable data-protection objection, tell us and we'll try to resolve it, and if we can't you can stop using the affected feature or cancel without penalty. We put data-protection obligations on each sub-processor that are equivalent to those in this DPA, and we remain responsible to you for what they do with your guests' data.
| Provider | What they do |
|---|---|
| Supabase | Database & hosting (London, UK) |
| The SMS Works | Sends booking texts and optional post-visit feedback texts (UK-based; Twilio is a backup sender) |
| Zoho / ZeptoMail | Email — ZeptoMail (Zoho's transactional service) sends booking & account emails; Zoho Mail is our mailbox |
| Anthropic | Powers the AI booking chat and the owner AI assistant. The booking chat processes what a guest types and restaurant information needed to help them. The separate Special requests control saves a note with the booking without adding that field to the booking-chat request. Automatic owner booking reads use selected operational fields and predefined occasion categories; individual answers may include names, while automatic briefings omit them. Those automatic reads exclude booking notes, standing guest requirements and custom occasion text. Feedback reads use ratings and dates, not written comments. Information people type into chat, owner questions, conversation history or restaurant memory may also be processed by the AI provider. |
| Netlify | Hosts the website |
| Stripe | Payment processing — our subscription billing today; holding a guest's card for the card-secured No-show Shield at restaurants that have it switched on; and, where a restaurant has Deposits/prepayment or Booking add-ons switched on, collecting and settling those — with the restaurant as the merchant of record on its own Stripe account |
A provider you choose and contract with yourself — for example your own Mailchimp account, if you connect it to TableTango — is not our sub-processor. It processes your guests’ data for you under your own agreement with it. We transfer data to it only on your documented instruction, and you are responsible for having the agreements and any international-transfer safeguards it needs (Mailchimp stores data in the United States).
5. Where the data lives
Your guests' data is stored in the UK (London). Where a sub-processor necessarily processes some data outside the UK, it's done under the safeguards the law requires (an adequacy decision, or standard contractual clauses / the UK IDTA).
6. Your side
You confirm you have a lawful basis for collecting your guests' data, that you give your guests the privacy information they're entitled to, and that your instructions to us comply with data-protection law.
7. Audits & information
We'll give you the information you reasonably need to show you're meeting your Article 28 obligations, and allow audits or inspections to the extent the law requires (on reasonable notice and at reasonable cost).
8. Liability, term & law
This DPA lasts as long as we process your guests' data. Liability under it is governed by the limits in the Terms of Service, and nothing here limits anything that can't legally be limited. This DPA is governed by the law of England and Wales.
Contact
TableTango Ltd — hello@tabletango.co.uk · tabletango.co.uk · Registered office: 71–75 Shelton Street, Covent Garden, London WC2H 9JQ