Data Processing Agreement (GDPR art. 28)

Version: 14/11/2026

Between the business using IKAROS POS ("Controller") and the Provider ("Processor"):

IKAROS POS
noreply@ikaros.pro
https://ikaros.pro

1. Subject

The Processor processes personal data on behalf of the Controller, only to provide IKAROS POS (orders, customers, points, bookings, newsletters, delivery, receipts).

• Data subjects: customers, visitors of the ordering page, the Controller's staff.
• Data categories: identity and contact details, delivery addresses and location, orders, points, consents, technical data. Not intended for special categories of data.
• Duration: for as long as the subscription runs.

2. Processor obligations

1. Processes data only on the Controller's instructions, as expressed through the use and settings of the system.
2. Ensures that people with access are bound by confidentiality.
3. Takes appropriate technical and organisational measures (art. 32): encryption in transit (HTTPS) and of passwords / secret keys, separation of data per store, least privilege, security log, backups, software updates.
4. Uses sub-processors (e.g. hosting, backups, email / SMS) only under equivalent obligations, and informs the Controller of changes so it can object.
5. Helps the Controller meet data subject requests; the system provides customer data export and erasure.
6. Accountant access. If the Controller appoints an accounting office in the back office ("My accountant"), the Processor shows it, read only, the sales per month and VAT rate and the fiscal documents (with ΜΑΡΚ and, on invoices, the counterparty's VAT number), with a CSV export. The accounting office is a recipient on the Controller's instructions and bound to the Controller, not a sub-processor of the Processor. It does not see customers, staff, menu or settings. The Controller removes the access whenever it likes, with immediate effect; granting and removing it are recorded in the security log.
7. Notifies the Controller without undue delay (normally within 48 hours) of any personal data breach.
8. At the end, returns (export) and deletes the data within 30 days, unless the law requires it to be kept.
9. Makes available the information needed to demonstrate compliance.

3. Transfers

Data is hosted in the European Union. Transfers outside the EEA happen only with appropriate safeguards (art. 44–49).

4. Controller obligations

The Controller has a legal basis for collection, informs its customers (privacy policy on the ordering page) and asks consent where needed (e.g. newsletters).