Data Processing Agreement
Last updated: 27 June 2026
This Data Processing Agreement is intended to form part of the agreement between Guestwork Limited and a venue customer where Guestwork processes personal data on the customer's behalf.
1. Parties and roles
The venue customer is the controller of personal data it enters into Guestwork, including booking, guest, staff, table, and venue information. Guestwork Limited acts as processor when it processes that data to provide the Guestwork service.
2. Subject matter and duration
Processing relates to the provision, support, maintenance, improvement, and security of Guestwork. Processing continues for the duration of the customer relationship and any agreed retention or deletion period.
3. Categories of data
- Venue staff data, such as names, work email addresses, roles, and access details.
- Guest and booking data, such as guest names, contact details, booking times, covers, table assignments, notes, preferences, and visit history.
- Venue operational data, such as room areas, floorplans, tables, audit logs, and status changes.
- Support and technical data, such as logs, device details, IP addresses, and support messages.
4. Customer instructions
Guestwork Limited will process customer personal data only on documented instructions from the customer, unless required by law. The customer is responsible for ensuring its instructions are lawful.
5. Confidentiality
Guestwork Limited will ensure that people authorised to process customer personal data are subject to appropriate confidentiality obligations.
6. Security measures
Guestwork Limited will use appropriate technical and organisational measures designed to protect customer personal data. More information is available on the Security page.
7. Sub-processors
Guestwork Limited may use sub-processors to provide hosting, infrastructure, email, support, monitoring, security, backup, and related services. Guestwork will remain responsible for sub-processor performance and will use appropriate contractual protections where required.
8. Assistance
Taking into account the nature of processing, Guestwork Limited will provide reasonable assistance to help the customer respond to data subject requests, security incidents, data protection impact assessments, and supervisory authority enquiries.
9. Personal data breach
Guestwork Limited will notify the customer without undue delay after becoming aware of a personal data breach affecting customer personal data, and will provide reasonable information to help the customer meet its legal obligations.
10. Return or deletion
At the end of services, Guestwork Limited will delete or return customer personal data where reasonably possible, unless retention is required by law or necessary for legitimate business records.
11. International transfers
Where customer personal data is transferred outside the UK or EEA, Guestwork Limited will use appropriate safeguards where required by applicable data protection law.
12. Audit information
Guestwork Limited will make available reasonable information necessary to demonstrate compliance with this DPA, subject to confidentiality, security, and reasonable operational limits.
13. Contact
Data processing questions can be sent to hello@guestwork.co.uk.