Sub-împuterniciți
Ultima actualizare: 13 noiembrie 2026
Deskadora oferă clienților restaurant un preaviz de 30 de zile pentru orice adăugare sau înlocuire a unui sub-împuternicit din această listă, prin e-mail și prin actualizarea acestei pagini. Clienții se pot opune unei modificări în temeiul Acordului de prelucrare a datelor.
| Sub-împuternicit | Serviciu | Categorii de date | Locul prelucrării | Garanție pentru transfer |
|---|---|---|---|---|
| Amazon Web Services EMEA SARL (AWS), compute | Găzduirea platformei: servere de aplicații, bază de date și stocare pentru cozi | All platform data | eu-west-3 (Paris), France | EU, no transfer |
| Amazon Web Services EMEA SARL (AWS), object storage | Stocare de obiecte pentru încărcări și conținut media (imagini ale meniului și ale localului, facturi, exporturi de date) și copii de siguranță ale bazei de date | Menu and venue images, invoices, data exports; database backups contain all platform data and are held in the same bucket region | eu-west-2 (London), United Kingdom | UK adequacy decision (European Commission), no Standard Contractual Clauses needed |
| Amazon Web Services EMEA SARL (AWS), SES | E-mailuri pentru campanii de marketing | Recipient email address and name, campaign content, tracking identifiers | eu-west-3 (Paris), France | EU, no transfer |
| Stripe Payments Europe, Limited; Stripe, Inc. | Plăți: facturarea abonamentelor, depozitele oaspeților, înrolarea Connect și verificările de identitate | Venue and representative identity and billing data; guest card data (entered directly with Stripe) and booking reference | Ireland and United States (region not pinned in our configuration) | Stripe Data Processing Agreement (last updated 28 September 2026), incorporated in the Stripe Services Agreement, and Stripe Data Transfers Addendum (last updated 18 November 2025): EU-US Data Privacy Framework (Stripe, LLC), Standard Contractual Clauses (modules 1 to 3) and the UK International Data Transfer Addendum; covers Connect. The Operator's platform account collects the application fee only and carries no Stripe processing fee on it |
| Twilio Inc.; Twilio Ireland Limited | Telefonie și semnalizare SMS: SMS, verificarea telefonului, numere pentru asistentul vocal, transferul apelurilor | Phone numbers, SMS content, call audio in transit. No call audio is retained: the trunks are set not to record, and five legacy test recordings were deleted on 1 October 2026. Message logs are kept 30 days from 9 October 2026 (before: 400 days), backup storage is off, redaction of the message body has been requested from Twilio (pending); call logs are kept for Twilio's default period | United States (region US1) | Twilio Data Protection Addendum (last updated 9 April 2026), incorporated in the Twilio agreement: EU-US Data Privacy Framework (Twilio Inc., with the UK Extension) and Standard Contractual Clauses (modules 1 to 3); the UK International Data Transfer Agreement for UK transfers |
| LiveKit, Inc. | Conținut media în timp real pentru asistentul vocal (camere audio și telefonie) | Live call audio, caller number. Agent observability is on: traces, transcripts and audio of calls are kept at LiveKit in the European Union (Frankfurt) for 30 days on every plan and deleted automatically; personal data redaction (name, contact details, demographics, credentials, network, financial, location and identifiers) applies to new sessions since 9 October 2026, is best effort and detects personal data in English only | European Union (Frankfurt): the project used for EU venues is pinned to the European Union; a second project (United States, observability off) is legacy and unused for EU venues | LiveKit Data Processing Addendum (last updated 6 October 2026), part of LiveKit's terms: EU-US Data Privacy Framework, then Standard Contractual Clauses (modules 1 to 3) and the UK International Data Transfer Addendum |
| Deepgram, Inc. | Recunoaștere vocală pentru asistentul vocal | Live call audio, venue and menu keywords. Deepgram keeps request metadata logs (request parameters, which include venue and menu keywords, and timestamps) | Deepgram, Inc. (United States). Requests go to the EU endpoint (api.eu.deepgram.com) since 2 October 2026; non-dedicated deployment, so EU residency is not contractually guaranteed (DPA section 9.2 applies only to Deepgram Dedicated) | Data processing agreement signed 6 October 2026 (Deepgram standard DPA, May 2026): Standard Contractual Clauses (Modules 2 and 3, Irish law and courts) and the UK Addendum, incorporated in the DPA (sections 9.3 to 9.5). Opted out of Deepgram's Model Improvement Program on every speech-to-text request from 2 October 2026 (mip_opt_out=true, a per-request setting). Every request to Deepgram carries the no-retention, no-training setting (mip_opt_out); audio and transcripts are processed in memory and not stored by Deepgram, other than request metadata (parameters and timestamps). |
| Cartesia | Sinteză vocală pentru asistentul vocal | Assistant reply text (may include a guest's name and booking details) | United States (Cartesia offers no region setting on the current plan) | Cartesia data processing agreement, part of its Terms of Service: Standard Contractual Clauses (Module 2), the EU-US Data Privacy Framework where applicable, UK Addendum. Default retention applies, zero data retention is not enabled (Enterprise plan only): personal data kept as long as the purpose requires and deleted within 180 days after termination (verified 2 October 2026) |
| Soniox | Recunoaștere și sinteză vocală pentru limba română | Live call audio, assistant reply text | EU region (EU hosts, confirmed from the running configuration) | EU, no transfer. Data Processing Agreement signed on 1 October 2026 |
| Anthropic, PBC | Model lingvistic (traducerea meniurilor, sugestii privind alergenii, analiza cererilor oaspeților, informări despre oaspeți, alocarea meselor, analize, extragerea meniurilor, traducerea campaniilor, asistent de conversație WhatsApp, asistent vocal) | Venue content; guest free-text requests and notes; guest profile attributes; WhatsApp chat text; live call transcript and, for recognised callers, name, email, dietary flags and upcoming bookings | United States. Inputs and outputs retained 30 days (organisation setting, checked 2 October 2026); zero data retention requested from Anthropic on 2 October 2026 and declined, so the 30-day retention applies | Anthropic Data Processing Addendum (effective 24 February 2025), incorporated in the Commercial Terms of Service, including Standard Contractual Clauses (modules 2 and 3) and the UK Addendum |
| Meta Platforms Ireland Limited; Meta Platforms, Inc. (WhatsApp Business Platform) | Mesagerie WhatsApp: rezervări, notificări, Flows, Embedded Signup | Phone number, message content, booking details, name and email | Ireland and United States | WhatsApp Business Data Processing Terms (22 August 2025) and WhatsApp Business Data Transfer Addendum (16 February 2024), incorporated in the WhatsApp Business Terms (WhatsApp Ireland Limited): EU-US Data Privacy Framework for transfers to WhatsApp LLC and Meta Platforms, Inc., Standard Contractual Clauses (processor to processor) for onward transfers; a separate UK addendum applies to UK transfers |
| Meta Platforms Ireland Limited; Meta Platforms, Inc. (Pixel and Conversions API) | Măsurarea publicității, cu consimțământ | Hashed contact details, IP address, user agent, browser identifiers | Ireland and United States | Meta Business Tools Terms (3 November 2025), which incorporate Meta's Data Processing Terms (23 August 2025) and the Meta European Data Transfer Addendum (effective 7 September 2023): EU-US Data Privacy Framework as the primary mechanism (Meta Platforms, Inc. certified, Meta Ireland relies on the adequacy decision), processor-to-processor Standard Contractual Clauses (module 3) as the fallback, for the EU, the EEA and Switzerland; same entity as for WhatsApp (Meta Platforms Ireland Limited) |
| Google Ireland Limited; Google LLC | Gmail SMTP (e-mailuri tranzacționale), Firebase Cloud Messaging (notificări push, împreună cu Apple APNs pentru iOS), Google Analytics 4 (cu consimțământ), Maps Platform (hărți și căutare de adrese) | Email recipients and content; push tokens and notification text (guest name, date, time, party size); analytics identifiers and IP address; address search text | Not pinned in our configuration; Google's processing locations under the terms in the next column | Google Analytics 4: Google Ads Data Processing Terms (version 8.0, 30 May 2024; accepted by Deskadora on 30 October 2024), Standard Contractual Clauses. Firebase Cloud Messaging: Firebase Data Processing and Security Terms (last modified 21 August 2024), incorporated in the Firebase agreement, EU-US Data Privacy Framework and Standard Contractual Clauses. Gmail SMTP and Google Cloud services: Cloud Data Processing Addendum (Customers), last modified 8 June 2026, incorporated in the agreement: Google's Customer Standard Contractual Clauses (controller to processor, processor to processor, processor to controller) or an alternative transfer solution if Google adopts one; UK GDPR and the Swiss FADP are in scope of the terms. Maps Platform: Google Controller-Controller Data Protection Terms (version 11, 7 May 2026), the EU-US Data Privacy Framework and controller-to-controller Standard Contractual Clauses |
| Squareup International Ltd (Ireland); Square, Inc. | Integrare cu casa de marcat (sincronizarea comenzilor și a meniului), numai atunci când localul o activează și la instrucțiunea acestuia | Guest names, contact details, order history, reservation details (Terms Annex I17) | Per Square's terms for the venue's own account | Square General Data Processing Terms for the EEA and the United Kingdom (https://square.com/ie/legal/data-processing-terms), Square acting as processor. Transfers outside the EEA or UK are covered by safeguards that Square names as including standard contractual clauses and other recognised mechanisms, provided on written request ([email protected]) |
| MaxMind, Inc. | Geolocalizare (adresă IP către țară și oraș) | None. A local database is used and no personal data is sent to MaxMind | Local database on the Paris host | Not applicable, no transfer |
| Cloudflare, Inc. | CDN, firewall pentru aplicații web, protecție împotriva roboților Turnstile | Web traffic in transit (IP address, headers); Turnstile token | Global network (no region pinned) | Cloudflare Customer DPA with Standard Contractual Clauses; the EU-US Data Privacy Framework certification is noted |
| Functional Software, Inc. (Sentry) | Monitorizarea erorilor și a performanței; reluarea sesiunii în browser, încărcată numai după ce vizitatorul acceptă cookie-urile de analiză, doar în caz de eroare, cu tot textul și toate câmpurile mascate și cu conținutul media blocat, niciodată o înregistrare continuă, și oprită atunci când consimțământul pentru analiză este retras | Error data and page context; IP addresses are not stored ("prevent storing IP addresses" and the required data scrubbers are on since 9 October 2026); after analytics consent only, a masked replay of the page around an error; events are kept 30 days | EU data region (Frankfurt, ingest.de.sentry.io) for error and performance data; Sentry keeps organization account data (users, tokens, settings, audit logs) in the United States | Sentry Data Processing Addendum 5.1.0 (29 May 2024), accepted by Deskadora on 9 October 2026 by electronic acceptance: EU-US Data Privacy Framework, Standard Contractual Clauses (modules 2 and 3) and the UK Addendum; the error data itself stays in the EU region |
Note
- Găzduite de Deskadora pe propria gazdă din Paris și nu de terți: baza de date, stocarea pentru cozi, platforma de monitorizare și sistemul de gestionare a conținutului folosit pentru paginile de politici și pentru blog.
- Clientul IA propriu al proprietarului unui local, conectat prin conectorul pentru proprietari (de exemplu Claude sau ChatGPT), este serviciul propriu al proprietarului și nu este un sub-împuternicit al Deskadora.
- Stripe, Meta și Google acționează ca operatori independenți pentru anumite scopuri (de exemplu Stripe pentru prevenirea fraudei și obligațiile de reglementare, Meta și Google pentru propriile date de publicitate și de cont). Pentru aceste scopuri nu sunt sub-împuterniciți ai Deskadora.
- Furnizorii de sisteme de punct de vânzare (Zelty, Square) sunt furnizorii proprii ai localului. Deskadora le transmite date numai atunci când localul activează integrarea și la instrucțiunea acestuia. Zelty prelucrează datele în Franța; Square este menționat în tabelul de mai sus.