Data processing agreement

Draft. This text is being reviewed by a lawyer and may change before launch.

Last updated: 20 October 2026

Roles

For the data of your guests and staff, you are the controller and XOYO is the processor.

What we do with it

We process it only to run your system and on your instructions. Every client has a separate database with its own credentials.

Security

Encryption in transit, encrypted credentials, separate databases per client, two-factor sign-in for administrators and access logs.

Sub-processors

Hosting provider in the EU, Stripe for payments, e-mail and SMS providers. We announce changes to this list in advance.

Support access

Our support staff can enter your system only after you grant access in your account, for a limited time, and every entry is logged.

End of contract

You can export all data. We delete it 90 days after the contract ends unless the law requires longer storage.