Data Processing Agreement

Data Processing Agreement under Art. 28(3) GDPR between

the hospitality venue that registers at keksu.de/registrieren or confirms this agreement in the admin (hereinafter the "Customer" or "Controller")

and

The Bike Café GmbH
Wilhelmstr. 91, 10117 Berlin
represented by its Managing Director Ziyu Zhang
Düsseldorf Local Court (Amtsgericht), HRB 104649
(hereinafter "Keksu" or the "Processor")

This agreement specifies the parties' data protection obligations arising from the contract for the use of the Keksu software (hereinafter the "Main Contract", governed by the General Terms and Conditions). It is concluded electronically in accordance with Art. 28(9) GDPR when the Customer confirms it on registration or in the admin. Keksu stores the version, time, IP address and confirming user and sends the Customer a copy as a PDF.

1. Subject matter and duration

1.1 The subject matter is the provision of the Keksu software with the features used by the Customer: POS with receipts and closings, technical security system (TSE), menu, QR ordering, staff management with shift plan, time tracking and staff app, vouchers and loyalty cards, venue website, TV display, self-service kiosk, AI assistant, integrations with third-party systems and management of multiple locations. In doing so, Keksu processes personal data on behalf of the Customer.

1.2 The term corresponds to the term of the Main Contract. This agreement ends with the Main Contract and, where data is still stored, with its deletion under clause 11.

2. Nature, purpose and scope of processing

2.1 Nature of processing: collection via the software's interfaces, storage, display, analysis, transfer to the sub-processors named in Annex 2, backup, export and deletion.

2.2 Purpose: running the Customer's hospitality venue, in particular cash register management under section 146a of the German Fiscal Code (AO) and issuing receipts, order processing, staff planning and time tracking, payroll preparation, customer loyalty (vouchers, loyalty cards), public presentation (website, TV display) and supporting the Customer through AI features.

2.3 The scope follows from the modules activated by the Customer and the data it enters. By activating or deactivating modules, integrations and permissions in the admin, the Customer determines which processing takes place.

3. Types of data and categories of data subjects

3.1 Types of data: login data (name, email address, role, password as a hash, sign-in times); employee data (master data, contact details, personnel number, personnel file documents, working hours, shifts, clock-in times, leave, absences, tip shares, data for payroll preparation including bank details, where recorded by the Customer); special categories under Art. 9 GDPR: sick notes and certificates of incapacity for work; order and receipt data (table, items, amounts, payment method, tip, receipt number, time, initials of the serving staff member); voucher and loyalty card data (code, balance, stamp count and, for online purchases, the buyer's name and email address); contact enquiries via the venue website; device identifiers for push notifications; content the Customer uploads for the website and TV display.

3.2 Data subjects: the Customer's employees and applicants, guests and voucher buyers, contact persons who submit enquiries via the venue website, and suppliers and other contact persons whose data the Customer records.

4. Instructions

4.1 Keksu processes the data only on the Customer's documented instructions. The Customer issues instructions by using the software, in particular through settings, permissions, exports and deletions in the admin, and additionally in text form to info@keksu.de. Keksu confirms verbal instructions in text form.

4.2 If Keksu considers an instruction to be unlawful, Keksu informs the Customer without delay and may suspend its execution until the Customer confirms or changes the instruction.

4.3 The persons set up in the admin as owner or manager are authorised to issue instructions. The recipient of instructions at Keksu is support at info@keksu.de.

4.4 Keksu does not process the data for its own purposes. Excepted is use in anonymised form that cannot be traced back to a venue or a person to improve the software (e.g. forecasts), as agreed in the Main Contract.

5. Confidentiality

5.1 Keksu uses only persons who are bound to confidentiality and have been familiarised with the data protection rules. The obligation continues after their work ends.

5.2 Keksu accesses the Customer's admin only to fix problems, for security checks or at the Customer's request. Every access is logged with time, person and reason and is available to the Customer in the admin under "Log".

6. Technical and organisational measures

6.1 Keksu implements the technical and organisational measures described in Annex 1 in accordance with Art. 32 GDPR and maintains them for the term of the agreement.

6.2 The measures are subject to technical progress. Keksu may adapt them provided the level of protection is not reduced. Keksu documents material changes in the current version of this agreement at keksu.de/avv.html.

6.3 The Customer is responsible for the security of its own devices, networks and login credentials and for granting and revoking access for its employees.

7. Sub-processors

7.1 The Customer approves the sub-processors listed in Annex 2. Which of them are used in a given case depends on the modules and permissions activated; Annex 2 states the condition for each sub-processor.

7.2 Keksu contractually binds each sub-processor to the obligations of this agreement (Art. 28(4) GDPR) and checks compliance with data protection rules before use. Transfers to third countries are covered by the mechanisms under Chapter V GDPR stated in Annex 2.

7.3 If Keksu intends to add or replace a sub-processor, Keksu informs the Customer at least four weeks in advance by email to the owner's registered address and in the admin. The Customer may object to the change within this period in text form for good cause relating to data protection. If the parties cannot reach agreement, the Customer may terminate the Main Contract for the affected modules with effect from the date the change takes effect. If no objection is raised, the change is deemed approved.

7.4 If the Customer connects its own accounts with AI providers (e.g. Claude, ChatGPT) via the MCP connector or activates integrations with third-party systems, that provider acts as the Customer's processor or controller, not as a sub-processor of Keksu. Keksu merely provides the interface and logs the accesses. The Customer concludes the necessary contracts with that provider itself.

7.5 The AI assistant's tools that read or change employee data are switched off by default. If the Customer switches them on in the admin, it thereby instructs Keksu to transmit this data, including the reasons for absences, to Anthropic. The Customer informs its employees beforehand; Keksu provides a template for this and displays the notice in the staff app for acknowledgement.

8. Assistance with data subject rights

8.1 Keksu assists the Customer through the software's features in fulfilling requests for access, rectification, erasure, restriction and portability (Art. 12 to 22 GDPR), in particular through export, editing and deletion functions in the admin.

8.2 If a data subject contacts Keksu directly, Keksu forwards the request to the Customer within three working days and does not answer it itself unless instructed to do so by the Customer.

9. Assistance with security, notification obligations and impact assessments

9.1 Keksu assists the Customer in complying with the obligations under Art. 32 to 36 GDPR, taking into account the nature of the processing and the information available to Keksu.

9.2 If Keksu becomes aware of a personal data breach affecting the Customer's data, Keksu informs the Customer without delay, and no later than 48 hours after becoming aware, at the owner's email address. The notification includes, where known, the nature of the breach, the categories of data and data subjects affected, the likely consequences and the measures taken. Keksu documents breaches and assists the Customer with notifications to supervisory authorities and data subjects.

9.3 For a data protection impact assessment or a consultation with the supervisory authority, Keksu provides the necessary information about the processing and the measures under Annex 1.

10. Evidence and audits

10.1 On request, Keksu provides the Customer with the information necessary to demonstrate compliance with this agreement, in particular the current version of Annex 1, data centre certificates and an annual self-assessment.

10.2 Following prior coordination, the Customer may carry out audits, including inspections, at reasonable intervals, generally no more than once a year, or have them carried out by an auditor bound to confidentiality. Keksu may provide evidence by presenting current audit reports or certificates. The Customer gives at least two weeks' notice of on-site audits; they take place during normal business hours and without disrupting operations. The Customer bears Keksu's costs for audits beyond the annual self-assessment unless the audit reveals deficiencies.

10.3 Keksu informs the Customer without delay of audit actions and measures by a supervisory authority to the extent they concern the processing for the Customer.

11. Deletion and return

11.1 During the term, Keksu deletes data when the Customer deletes it via the admin functions or instructs deletion in text form, unless statutory provisions or the immutability of cash register records (section 146(4) AO, section 146a AO) prevent this.

11.2 After the end of the Main Contract, Keksu keeps the data available for export for 30 days. During this period the Customer can download its receipts, the DSFinV-K export, the TSE exports, staff data and menu free of charge in the formats offered (CSV, DSFinV-K, TAR); Keksu notifies the Customer by email at the start of the period and offers the export.

11.3 After the period expires, Keksu deletes all of the Customer's data except for the POS records referred to in clause 11.4; copies contained in backups are deleted within a further 30 days by overwriting the backups. On request, Keksu confirms deletion in text form.

11.4 Retaining cash register records and payroll records under section 147 AO, section 257 of the German Commercial Code (HGB) and section 28f of the German Social Code Book IV (SGB IV) is the Customer's obligation. With this agreement, the Customer instructs Keksu to retain the POS records (receipts, cash book, closings, TSE archive and the source data of the DSFinV-K export) after the end of the contract free of charge in locked form for ten years, solely for the purpose of releasing them to the Customer or, on its instruction, to the tax authorities. The Customer may revoke this instruction at any time in text form and request earlier deletion; fulfilling its retention obligations then rests solely with the Customer. Staff data, guest and buyer data are not covered by this retention; the Customer exports payroll records within the period under clause 11.2. In addition, Keksu retains data it must keep under its own statutory obligations (in particular invoicing records concerning the Customer's fees); this data is deleted after the period expires and until then processed only for this purpose.

12. Liability

12.1 Liability is governed by Art. 82 GDPR and the liability provisions of the Main Contract. Internally, the parties indemnify each other against claims to the extent the other party is responsible for the breach.

12.2 If the Customer breaches its obligations as controller, in particular informing its employees and guests, the lawfulness of the processing it initiates or the security of its accounts, it is solely liable for this.

13. Final provisions

13.1 In the event of conflicts between this agreement and the Main Contract, this agreement prevails in data protection matters.

13.2 Keksu may amend this agreement if the law, case law, requirements of supervisory authorities, sub-processors or features of the software change. Keksu announces amendments at least four weeks in advance by email and in the admin; clause 7.3 applies to changes to Annex 2. The Customer confirms the new version in the admin; until confirmation, the previous version continues to apply unless it conflicts with mandatory law.

13.3 The law of the Federal Republic of Germany applies. The place of jurisdiction is Berlin, provided the Customer is a merchant (Kaufmann). Should any provision be invalid, the remainder of the agreement remains valid.

13.4 The Customer can download this agreement with its details and the evidence of acceptance as a PDF at any time in the admin under "Settings › Venue › Contract documents".

Annex 1: Technical and organisational measures (Art. 32 GDPR)

Physical and system access control for the data centre: Operation exclusively in data centres of Hetzner Online GmbH in Germany (ISO/IEC 27001 certified). Physical access only for authorised Hetzner personnel. Server access by the Processor only via SSH with key-based authentication, no password login, access restricted to named administrators.

Access control for the software: Personal accounts per user, passwords stored only as hashes (bcrypt), roles owner, manager and staff with graduated permissions, limits on sign-in attempts, automatic expiry of sessions after 30 days without use, two-factor authentication (TOTP) for the Processor's administrator accounts, POS and staff interfaces with their own PIN or own login.

Authorisation control and tenant separation: Every database query is bound to the Customer's identifier (tenant_id); data of different customers is logically separated. Protection against cross-site request forgery, Content Security Policy, protection against replay attacks on interfaces, server-side permission checks on every request, automatic blocking of suspicious IP addresses (fail2ban).

Transfer control: All connections exclusively via TLS with HSTS. Emails sent via an authenticated delivery service. Fonts, scripts and images are served from our own server; no content from third-party servers is loaded into the interfaces. Transfers to sub-processors only encrypted and only to the extent described in Annex 2.

Input control: Logging of changes in the admin (log per customer), log of tool calls by the AI assistant and the MCP connector, log of every support access by the Processor with time, person and reason, available to the Customer under "Log".

Processing control: Processing only within the scope of this agreement and the software's features. Sub-processors are contractually bound in accordance with Art. 28(4) GDPR; contracts are in place. The Processor's employees are bound to confidentiality.

Availability control: Daily database backups retained for 30 days, backups encrypted with AES-256 and readable only with a separately stored key, additional snapshots by the hosting provider, service monitoring with alerting, offline buffer in the POS app in the event of connection loss, uninterruptible power supply and redundant connectivity provided by the data centre.

Encryption of particularly sensitive data: Personnel file documents (employment contracts, ID copies, certificates of incapacity for work and other employee records) are stored outside the web directory and encrypted at rest with authenticated encryption (libsodium XSalsa20-Poly1305, 256-bit key, random nonce per file). The key is kept separately from the files and from the database backups. Retrieval takes place exclusively after sign-in and a permission check (owner or manager of the venue, or the data subject for their own documents) through the application, never via a direct address. Passwords are stored only as hashes; credentials for third-party services are stored encrypted.

Separation control: Production venues and demo venues are separated; trial accounts work only with fictitious data. Development and production environments are separated.

Deletion concept: Automated daily deletion runs according to the periods stated in clause 11 and in the privacy policy; deletion run for customer data 30 days after the end of the contract (POS records locked under clause 11.4); documented deletion on request.

Organisation: Named contact for data protection (management), procedure for notifying the Customer of data breaches within 48 hours, regular security reviews of the software, updates of the operating system and components.

Annex 2: Sub-processors

As of 18 October 2026. Only those sub-processors are used whose condition (module, permission, connection) the Customer meets.

Providers with which the Customer concludes its own contracts (the Customer's payment provider, third-party systems via integrations, own AI accounts via the MCP connector, Google for the Customer's Business Profile) are not sub-processors.

Version 2026-10-18 · The Bike Café GmbH, Wilhelmstr. 91, 10117 Berlin · Managing Director Ziyu Zhang · Düsseldorf Local Court (Amtsgericht), HRB 104649 · VAT ID DE450369536 · info@keksu.de