Data Processing Agreement

1. Parties and nature of the agreement

The Controller is the business, restaurant, employer or other organization on whose behalf an authorized User uses a Shixar Workspace and accepts the Terms of Use. The Organization is identified on the basis of its relationship with the relevant Workspace, the Account of the authorized person and information provided to Shixar while using the service or contacting Shixar.

This DPA constitutes a data processing agreement within the meaning of Article 28 GDPR and forms an integral part of the Terms of Use to the extent the Controller uses Shixar to process personal data in its Workspace.

2. Subject matter, duration, nature and purpose

• Subject matter: technical provision of Shixar, including the account, Workspace, team membership, recipes, production lists, schedule, menu, reports, invitations and related files/photos to the extent used by the Controller.
• Duration: from effective conclusion of the DPA until use of the service ends or the relevant Workspace/Account is deleted earlier, taking into account necessary technical and legal retention periods.
• Nature: hosting, storage, access, modification, transmission, organization and deletion of data in accordance with application functions and the Controller’s documented instructions.
• Purpose: enabling the Controller to organize day-to-day team work and manage access and Content in the Shixar Workspace.

3. Categories of data subjects and data

The Controller is responsible for the lawfulness, adequacy and legal basis of data entrusted to Shixar. Shixar does not require special categories of personal data, and such data should not be entered into the service unless this is necessary and legally justified.

4. Controller obligations

• determines the purposes and legal bases for processing data in its Workspace and issues documented instructions through use of the service, this DPA and agreed channels;
• ensures that entrusted data are processed in accordance with law;
• manages Users, roles and permissions and promptly removes access from persons who should no longer have it;
• does not issue instructions that are contrary to law.

5. Shixar obligations as Processor

• processes data only on documented instructions from the Controller, unless processing is required by law;
• ensures confidentiality of persons authorized to process data;
• implements appropriate technical and organizational measures in accordance with Article 32 GDPR;
• assists the Controller, to the extent appropriate to the nature of processing and available information, with data subject rights, security, breaches and DPIA obligations;
• upon termination of services, deletes or returns data in accordance with service functionality, the Controller’s instruction, legal obligations and technical retention periods;
• makes available information necessary to demonstrate compliance with Article 28 GDPR and permits reasonable audits under Section 11.

6. Security

• access control based on Accounts, roles, Workspace membership and Row Level Security (RLS);
• HTTPS/TLS for production communications; insecure HTTP addresses for supported resources are rejected;
• Supabase Auth for authentication; Shixar does not store plain-text User passwords in its own tables;
• secrets and the service role remain outside the Flutter application and public repository;
• MFA/2FA for administrative accounts where provided by the relevant supplier;
• image sanitization during upload to remove EXIF metadata;
• data deletion procedures and regression testing for RLS, Auth, Storage and privileged functions.

7. Subprocessors

The Controller grants Shixar general authorization to use subprocessors necessary to provide the service. Key suppliers include Supabase, Postmark, Namecheap Private Email and Netlify to the extent corresponding to their role. Shixar maintains supplier documentation and, in the event of a material change, provides information allowing the Controller to raise a justified objection.

8. International transfers

If use of a subprocessor results in a transfer of personal data outside the EEA, Shixar requires an appropriate GDPR-compliant transfer mechanism, in particular an adequacy decision or Standard Contractual Clauses (SCCs), depending on the circumstances. Shixar’s primary Supabase project operates in the West EU (Ireland) region.

9. Personal data breaches

Shixar notifies the Controller without undue delay after becoming aware of a personal data breach concerning entrusted data and provides available information needed for assessment and compliance with Articles 33–34 GDPR. Contact: security@shixar.com.

10. Data subject rights and DSRs

If a person submits a request to Shixar concerning data processed solely on behalf of the Controller, Shixar will, as appropriate, refer the request to the Controller or assist with its fulfillment.

11. Audits

Upon justified request, Shixar makes available information necessary to demonstrate compliance with this DPA and Article 28 GDPR. An audit should have a proportionate scope, reasonable advance notice and should in the first instance rely on documentation and available evidence. A direct inspection may be agreed where legally required or where earlier measures are insufficient.

12. Deletion and termination of processing

After use of the service ends or upon a valid request from the Controller, active data are deleted in accordance with Shixar functionality and the deletion procedure. Under the current Supabase Free plan, the Shixar project does not have managed project backups or Point-in-Time Recovery (PITR); a change to this configuration requires an update to retention rules.

13. Priority

In the event of a conflict between this DPA and the Terms of Use concerning obligations under Article 28 GDPR, this DPA prevails.

14. Electronic conclusion

This DPA may be concluded electronically through acceptance of Terms of Use version 1.1 (or a later version identifying the applicable DPA version) by a person authorized to act on behalf of the Organization. A separate DPA checkbox is not required where the Terms clearly incorporate the DPA into the agreement and the document is available before acceptance.

Shixar may retain evidence including at least the Account identifier of the accepting person, the Terms version, the DPA version, the date and time of acceptance and, where available, the Workspace identifier. Historical evidence should not be overwritten.

15. Contact

Privacy: privacy@shixar.com · Legal: legal@shixar.com · Security: security@shixar.com