Data Processing Agreement TipShare

Last updated: March 2026

Note: This Data Processing Agreement is legally binding in Dutch. The Dutch version at /legal/verwerkersovereenkomst is the authoritative version. This English translation is provided for informational purposes only.

1. Parties

This data processing agreement applies between:

• Controller: the User (the Restaurant)
• Processor: H. Heijes Holding BV (hereinafter “TipShare”)

2. Subject

TipShare processes personal data of the Restaurant’s employees for the purpose of tip distribution.

3. Categories of personal data

• Employee names
• Department and role
• Hours worked per period
• Calculated tip amounts

4. Purposes

Processing takes place solely for:

• Calculating tip distribution
• Generating reports for payroll administration
• Archiving historical distributions

5. Security measures

TipShare takes the following technical and organisational measures:

• Encrypted data storage (AES-256 encryption at rest)
• Encrypted data transfer (HTTPS/TLS)
• One-way hashed passwords (bcrypt)
• Role-based access control (RBAC)
• Rate limiting on authentication endpoints
• CSRF protection on all forms
• Regular backups
• Incident response plan

6. Sub-processors

TipShare uses the following sub-processors:

7. Data breach notification

TipShare notifies the Controller of data breaches within 48 hours of discovery.

8. Termination

Upon termination of the agreement, personal data will be deleted within 30 days, unless legal retention obligations apply.