Skip to content

Check the connection method and validation evidence for every available WiFi integration path. Open the compatibility centre

Product
All features How it works Guest WiFi portal Campaigns & automations Reviews Analytics All integrations
Solutions
Restaurants Cafés Hotels Bars & pubs Retail Gyms Salons
Hardware Pricing
Resources
Resources Guides Launch checklist Glossary Help centre
Log in Start free

Data Processing Agreement

Last updated: 1 July 2026

This Data Processing Agreement ("DPA") applies whenever an Account Holder (the "Controller") uses WeefyBox to process personal data belonging to their venue's guests, under UK GDPR and/or EU GDPR. WeefyBox Ltd acts as "Processor" for that guest data.

Subject matter and duration

WeefyBox processes guest personal data for the duration of the Controller's WeefyBox subscription for the purpose of operating the guest WiFi captive portal, messaging, review capture and analytics features the Controller uses.

Categories of data subjects and data

  • Data subjects: guests who connect to a Controller venue's guest WiFi.
  • Data categories: name, email address, phone number, device identifiers (signed device cookie, MAC address), visit/session timestamps, marketing consent records and review/feedback text.

Processor obligations

  • Process guest personal data only on the Controller's documented instructions (as configured through the WeefyBox platform), except where required by law.
  • Ensure staff with access to guest data are subject to confidentiality obligations.
  • Implement appropriate technical and organisational security measures, including encryption of credentials and payment references at rest, access-controlled multi-tenant data isolation, and audit logging of administrative actions.
  • Assist the Controller in responding to data subject requests (access, erasure, portability) relating to their guests' data.
  • Notify the Controller without undue delay on becoming aware of a personal data breach affecting their guest data.
  • Delete or return all guest personal data at the end of the subscription, per the retention terms in our Terms of Service, unless retention is required by law.

Sub-processors

WeefyBox uses the following categories of sub-processor, each bound by their own data protection terms:

  • Cloud infrastructure and database hosting (UK/EU region).
  • Stripe, Inc. — payment processing for Account Holder subscription billing (Account Holder billing data, not guest data).
  • Transactional email delivery providers, for guest-directed campaign and automation messages the Controller sends.

An up-to-date list of named sub-processors is available on request via our contact page.

International transfers

Where a sub-processor is located outside the UK/EEA, transfers are protected by Standard Contractual Clauses (or the UK International Data Transfer Addendum) or an adequacy decision, as applicable.

Audit rights

The Controller may request reasonable evidence of WeefyBox's compliance with this DPA, including summaries of security measures and sub-processor agreements, via a written request.