SafeBiteData protection terms — SafeBite HACCP
SB-RGPD-01 · v1.1 · Draft dated 13/10/2026
These terms apply exclusively to personal data processed for restaurant clients as part of the SafeBite HACCP service. They are separate from the privacy policy.
Parties and scope
This document covers only the SafeBite HACCP service for restaurants. Other services and modules are outside the scope of this document. The Client identified in the contract is the controller; the legal LuxNeva operator identified in the contract is the processor. Processing covers accounts, HACCP records, reports and support for subscribed restaurants and HACCP modules, throughout the service and until return or deletion. Billing and the Provider’s own obligations are covered by a separate notice.
Data and individuals
Scope to confirm: names, business contact details, identifiers, roles and timestamped actions of managers and users; necessary personal data in records and attachments. Operations include entry, import, storage, synchronisation, access, amendment, export and deletion. Health or children’s data require a specifically validated scope; this template does not authorise them by default.
Instructions and confidentiality
The Provider acts only on documented Client instructions, including for transfers. It informs the Client of legally required processing unless prohibited, and immediately flags an apparently unlawful instruction. Authorised personnel are bound by confidentiality. No use for advertising, data sales or AI training without a separate agreement and an appropriate legal basis.
Client obligations
The Client determines legal bases and necessary retention periods, informs individuals, minimises data, manages permissions and ensures lawful instructions.
Security and assistance
The Provider applies risk-appropriate measures under Article 32. It assists with individuals’ rights and Articles 32–36, including impact assessments and prior consultations. Requests received directly are forwarded without undue delay. Actual measures must be documented before signature.
Data breaches
The Provider informs the Client without undue delay after becoming aware, describing the nature, likely consequences, measures and contact, and supplies further information progressively. The Client decides on notifications to authorities and individuals; the Provider assists.
Subprocessors and transfers
Legal entities, services, data and countries of storage, backup and access must be listed and approved. Additions or replacements require the Client’s specific prior written authorisation. Equivalent obligations are imposed on subprocessors; the Provider remains responsible to the Client. Transfers outside the EEA require instructions and a valid Chapter V mechanism, with assessment and supplementary measures where necessary.
Audits
The Provider supplies necessary evidence, allows and contributes to audits and inspections by the Client or its auditor. Proportionate arrangements protect other clients without preventing necessary or urgent scrutiny.
Retention and service termination
Retention periods must be agreed per category. At service end, at the Client’s choice, data are returned and copies deleted, or deleted, except for documented legally required retention. Agree format, secure channel, deadlines and backup erasure. Residual backups are isolated; deletions are reapplied after restoration. The Provider confirms completion in writing.
Technical details to complete
Before signature document: parties’ identities and privacy contacts; modules, categories and purposes; providers and countries; transfer safeguards; access, tenant isolation, encryption, backups, tests, logs, patches and incident procedures; retention, export and deletion. Missing information does not constitute approval.
Acceptance and version
Once validated, the contract identifies the accepted reference, version and date. The Client can review the terms before signing and receives a digital copy. Website updates do not automatically replace the agreed version. These terms prevail for data protection; the contract’s governing law and jurisdiction apply without limiting individuals’ rights.
Questions? info@safebite.lu