Data processing agreement
Version 1-11-2026 · This agreement applies as soon as a club starts using BarMaat (including a trial period). The Dutch version prevails.
Parties:
- the club using BarMaat (controller), and
- BarMaat, [adres] (processor).
1. Subject and duration
The processor processes personal data on behalf of the club to provide the BarMaat service: a till and tab system with stock, purchasing, revenue and access management. The agreement runs as long as the club uses BarMaat and ends as described in article 9.
2. Types of data and data subjects
| Data subjects | Data |
|---|---|
| Club managers and bar staff | Name, email address, hashed password, roles and periods, logins, actions in the activity log (with IP address) |
| Bar guests | Name or description on a tab, items ordered, amounts and payment method |
| Regular guests, suppliers and contacts | Name and, for suppliers, contact details |
No special categories of personal data are processed, and the club does not enter them.
3. Processing on instructions only
The processor only processes the data to provide the service and according to the club's instructions, as set out in this agreement and the settings the club makes in BarMaat. The processor does not use the data for its own purposes.
The processor does not look at the club's data, except:
- with the club's permission: a manager can give temporary access in BarMaat (Settings → Support by BarMaat), with a role and duration of their choice. This is recorded in the club's log, visible to all managers while it lasts, and can be revoked at any time;
- insofar as necessary for the technical operation of the service, such as backups, recovery after an outage and fixing errors, and then no more than necessary;
- if required by a legal obligation. The processor informs the club in advance, unless the law prohibits this.
Platform management only sees usage figures of the club in BarMaat (counts, such as the number of orders and people with access), not revenue, names or other administration.
4. Confidentiality
Everyone with access to the data on behalf of the processor is bound by confidentiality.
5. Security (GDPR art. 32)
- Encrypted connection (HTTPS); passwords hashed only, secret keys stored encrypted.
- Strict separation between clubs; role-based access with periods and an activity log.
- Protection against break-in attempts (login attempt limits) and form abuse.
- Backups to storage chosen by the club and/or as a zip by email to its managers, optionally encrypted (AES-256), with a configurable retention. Before every restore a copy of the current data, deleted after 90 days.
- Automatic retention: guests' names on settled tabs are anonymised after the period chosen by the club; IP addresses in the activity log erased after 90 days and entries deleted after 24 months.
6. Sub-processors
The club authorises the use of the following sub-processors:
- Hosting: [hostingpartij en land].
The processor imposes at least the same obligations on sub-processors and announces a new sub-processor in advance; the club may object. Backup storage and mail servers configured by the club itself are the club's responsibility.
7. Data subject rights
BarMaat gives the club and its users the means to access, export, correct and delete data themselves. If the processor receives a request, it forwards it to the club and assists where needed.
8. Data breaches
The processor reports a personal data breach to the club's contact person without undue delay and at the latest within 48 hours of discovery, with what is known about its nature, consequences and measures taken, so that the club can notify the supervisory authority within 72 hours if required.
9. End of the agreement
Afterwards the club can export all data (Backup → Download export). Within 30 days of the end, the processor deletes the data, except where retention is required by law. Copies in backups disappear according to the retention of those backups.
10. Information and audits
On request, the processor provides the club with the information needed to demonstrate compliance with this agreement.
11. Miscellaneous
Liability follows the general terms and conditions of BarMaat. In case of conflict, this agreement prevails as far as the processing of personal data is concerned. This agreement is governed by Dutch law.
Would you like a signed copy of this agreement? Email [e-mail].