1. Predmet i trajanje

1. Subject Matter & Duration

QRForge u ime Restorana obrađuje samo lične podatke navedene u Odjeljku 2.1 (nalozi osoblja Restorana), radi pružanja panela restorana i kuhinjskih alata opisanih u Uvjetima korištenja QRForgea. Ovaj Ugovor sastavni je dio Uvjeta korištenja i stupa na snagu registracijom Restorana na platformi.

QRForge processes on the Restaurant's behalf only the personal data listed in Section 2.1 (the Restaurant's staff accounts), to provide the restaurant panel and kitchen tools described in the QRForge Terms of Service. This DPA is incorporated by reference into the Terms of Service and takes effect upon the Restaurant's registration on the platform.

Podatke o narudžbama kupaca Restoran prima kao samostalni voditelj obrade (Odjeljak 2.2). QRForge te podatke obrađuje kao voditelj obrade za rad platforme, kako je opisano u Politici privatnosti, a ne u ime Restorana.

The Restaurant receives customer order data as an independent controller (Section 2.2). QRForge processes that data as a controller for running the platform, as described in the Privacy Policy, not on the Restaurant's behalf.

Ovaj Ugovor ostaje na snazi za period korištenja platforme od strane Restorana i ističe brisanjem računa ili prestankom poslovnog odnosa.

This DPA remains in force for the duration of the Restaurant's use of the platform and expires upon account deletion or termination of the service relationship.

2. Lični podaci

2. Personal Data

2.1 Podaci koje QRForge obrađuje u ime Restorana

2.1 Data QRForge processes on the Restaurant's behalf

2.2 Podaci o narudžbama koje Restoran prima kao samostalni voditelj obrade

2.2 Order data the Restaurant receives as an independent controller

Napomene narudžbe mogu sadržavati informacije o alergijama ili prehrani koje kupac sam unese. To je dio podataka o narudžbi koje Restoran prima kao samostalni voditelj obrade; Restoran ih koristi samo za pripremu te narudžbe. Osim takvih napomena, posebne kategorije ličnih podataka se ne obrađuju.

Order notes may contain allergy or dietary information that the customer chooses to provide. This is part of the order data the Restaurant receives as an independent controller; the Restaurant uses it only to prepare that order. Apart from such notes, no special categories of personal data are processed.

3. Obaveze QRForgea kao obrađivača

3. QRForge's Obligations as Processor

Za podatke iz Odjeljka 2.1 QRForge će:

For the data in Section 2.1, QRForge shall:

• Obrađivati lične podatke samo prema dokumentovanim uputstvima Restorana (izraženim kroz korištenje funkcija platforme).
• Osigurati da su sve osobe s pristupom podacima vezane obavezama povjerljivosti.
• Implementirati i održavati odgovarajuće tehničke i organizacijske sigurnosne mjere (vidi Odjeljak 5).
• Ne angažirati pod-obrađivače bez informiranja Restorana (vidi Odjeljak 6).
• Pomoći Restoranu u odgovaranju na zahtjeve prava ispitanika u zakonski propisanom roku.
• Brisati ili vraćati te podatke po prestanku usluge, po izboru Restorana, osim ako zakon ne zahtijeva čuvanje.
• Pružiti sve informacije potrebne za dokazivanje usklađenosti s obavezama iz Člana 28 GDPR-a, na pisani zahtjev.

• Process personal data only on documented instructions from the Restaurant (as expressed through use of the platform features).
• Ensure all persons with access to the data are bound by confidentiality obligations.
• Implement and maintain appropriate technical and organisational security measures (see Section 5).
• Not engage sub-processors without informing the Restaurant (see Section 6).
• Assist the Restaurant in responding to data subject rights requests within the legally required timeframe.
• Delete or return that data upon termination of the service, at the Restaurant's choice, unless retention is required by law.
• Provide all information necessary to demonstrate compliance with GDPR Article 28 obligations upon written request.

4. Obaveze Restorana

4. Restaurant's Obligations

Restoran će:

The Restaurant shall:

• Osigurati da ima valjani pravni osnov za podatke svog osoblja koje unosi na platformu.
• Podatke o narudžbama kupaca koristiti samo za pripremu i predaju te narudžbe, i ne čuvati ih duže nego što je potrebno.
• Ne uputiti QRForge da obrađuje lične podatke kršeći primjenjivi zakon.
• Odmah obavijestiti QRForge ako primi zahtjev ispitanika koji zahtijeva uključivanje QRForgea.

• Ensure it has a valid legal basis for the staff data it enters on the platform.
• Use customer order data only to prepare and hand over that order, and not keep it longer than needed.
• Not instruct QRForge to process personal data in violation of applicable law.
• Promptly notify QRForge if it receives a data subject request that requires QRForge's involvement.

5. Tehničke i organizacijske mjere

5. Technical & Organisational Measures

QRForge implementira sljedeće sigurnosne mjere primjerene riziku:

QRForge implements the following security measures appropriate to the risk:

• Enkripcija u mirovanju i prijenosu — svi podaci pohranjeni u Google Cloud Firestore (AES-256 enkripcija); sva komunikacija putem TLS 1.2+.
• Kontrola pristupa — pristup zasnovan na ulogama; princip najmanje privilegija; admin pristup kontrolisan Firebase prilagođenim tvrdnjama (custom claims), koje se provjeravaju pri svakom privilegovanom zahtjevu, tako da se opoziv admin statusa primjenjuje odmah.
• Revizijsko logiranje — sve privilegovane admin radnje bilježe se s vremenskom oznakom, identitetom aktera i IP adresom.
• Upravljanje sesijama — tokeni istječu nakon 1 sata; refresh tokeni opozivaju se odmah po suspenziji računa.
• Infrastruktura — Google Cloud, glavna baza u EU (Google Cloud EU multi-region), pod Googleovim ISO 27001 i SOC 2 Type II certifikacijama.
• Odgovor na incidente — povrede koje utječu na lične podatke bit će prijavljene pogođenim voditeljima obrade u roku od 72 sata od otkrivanja.

• Encryption at rest and in transit — all data stored in Google Cloud Firestore (AES-256 encryption); all communications over TLS 1.2+.
• Access control — role-based access; least-privilege principle; admin access gated by Firebase custom claims, re-verified against the live user record on every privileged request so a revoked admin claim is enforced immediately.
• Audit logging — all privileged admin actions are logged with timestamp, actor identity, and IP address.
• Session management — tokens expire after 1 hour; refresh tokens revoked immediately upon account suspension.
• Infrastructure — Google Cloud, main database in the EU (Google Cloud EU multi-region), under Google's own ISO 27001 and SOC 2 Type II certifications.
• Incident response — breaches affecting personal data will be reported to affected Controllers within 72 hours of discovery.

6. Pod-obrađivači

6. Sub-processors

QRForge trenutno koristi sljedeće pod-obrađivače:

QRForge currently uses the following sub-processors:

QRForge će obavijestiti Restoran o svim planiranim promjenama pod-obrađivača najmanje 14 dana unaprijed, omogućavajući Restoranu da se usprotivi. Svi pod-obrađivači vezani su ugovorima ili pravilima o obradi podataka.

QRForge will notify the Restaurant of any intended changes to sub-processors at least 14 days in advance, allowing the Restaurant to object. All sub-processors are bound by data processing agreements or terms.

7. Međunarodni prijenosi

7. International Transfers

Glavna baza podataka je u EU (Google Cloud EU multi-region). Gdje pod-obrađivač obrađuje podatke izvan Bosne i Hercegovine i EU, oslanjamo se na zaštitne mjere propisane zakonom.

The main database is in the EU (Google Cloud EU multi-region). Where a sub-processor processes data outside Bosnia and Herzegovina and the EU, we rely on the safeguards required by law.

8. Obavještavanje o povredi podataka

8. Data Breach Notification

U slučaju povrede ličnih podataka, QRForge će obavijestiti Restoran bez nepotrebnog odgađanja i, gdje je izvedivo, u roku od 72 sata od saznanja, navodeći: opis prirode povrede; kategorije i aproksimativni broj pogođenih ispitanika; vjerovatne posljedice; i poduzete ili predložene mjere.

In the event of a personal data breach, QRForge will notify the Restaurant without undue delay and, where feasible, within 72 hours of becoming aware, providing: a description of the nature of the breach; categories and approximate number of data subjects affected; likely consequences; and measures taken or proposed.

9. Pomoć u ostvarivanju prava ispitanika

9. Data Subject Rights Assistance

QRForge će pomoći Restoranu u ispunjenju zahtjeva ispitanika (pristup, ispravak, brisanje, prenosivost, ograničenje, prigovor). Zahtjevi se podnose na support@qrforge.link i obradit će se u roku od 30 dana.

QRForge will assist the Restaurant in fulfilling data subject requests (access, rectification, erasure, portability, restriction, objection). Requests must be submitted to support@qrforge.link and will be processed within 30 days.

10. Mjerodavno pravo

10. Governing Law

Na ovaj Ugovor primjenjuje se pravo Bosne i Hercegovine, uključujući Zakon o zaštiti ličnih podataka BiH. Sporove rješava sud nadležan prema sjedištu operatera.

This DPA is governed by the laws of Bosnia and Herzegovina, including the BiH Law on Personal Data Protection. Disputes are resolved by the competent court at the operator's seat.