⚖️ Draft for legal review. This document is NOT a signed contract and cannot be accepted yet. It is the draft of the minimum content a data processing agreement between a business and Burgo should have. A lawyer must review it, complete it and decide how it is accepted before Cabal is offered to third parties.
Parties and roles
- The business using Cabal is the controller of its customers’ data (name, ID or tax number, bank, payment reference, receipts and any other data it records). It decides why and how the data is used.
- Burgo (Burgo, operated by José Burgos (natural person), Maracaibo, Venezuela) is the processor: it handles that data on the business’s behalf, only to provide Cabal and following its instructions.
- For the data of the business’s own account (owner and team), Burgo is the controller; see the Privacy policy.
⚖️ Pending lawyer review. Parties: natural person (Burgo) and business, and what happens if the business is another natural person or a foreign company.
Subject matter and duration
Burgo handles the data while the business uses Cabal, in order to manage customers, projects, payments and receipts, and to show the customer the payment portal. The agreement lasts as long as the business’s account and ends with the return or deletion of the data.
Burgo’s obligations
- Instructions: handle the data only on the business’s documented instructions (its normal use of Cabal is an instruction). Warn if an instruction appears contrary to the law.
- Confidentiality: access to the data is limited to those who need it, bound by secrecy.
- Security: encrypted connections (TLS), each business’s data isolated from others’, two-factor for the owner, an audit log of actions and antivirus scanning of receipts. Each measure must be active before it can be claimed; anything not yet active is stated in the Privacy policy as “in preparation”.
- Sub-processors: use only those on the sub-processor list and tell the business of changes in reasonable time so it can object.
- Individuals’ rights: help the business answer requests from its customers (access, correction, deletion). If a person writes to Burgo, they will be told to contact the business.
- Breaches: tell the business without undue delay once Burgo confirms a breach affecting its data, with what is known.
- Audit: give the business reasonable information to verify compliance with this agreement.
- Return and deletion: at the end, make the business’s data available in a structured format and delete it afterwards, except what the law requires to be kept. Export and deletion of a customer (with their payments kept pseudonymised) are features in preparation; until then they are done on request and manually.
The business’s obligations
- Have a legal basis to record its customers’ data and inform them (the payment portal shows a short notice; the business must have its own policy).
- Record only the data needed and keep it accurate.
- Not upload illegal content or minors’ data without their guardians’ authorisation.
- Serve its customers when they exercise their rights.
Retention
- Payment receipts: kept by the business for the period it defines; configurable retention is in preparation.
- Audit logs: 1 year.
- Server logs: 30 days at most.
- Backups: rotate within 35 days at most.
Liability
⚖️ Pending lawyer review. Liability for receipts and third-party data uploaded by the business; limits of Burgo’s liability; indemnity; governing law and jurisdiction.
Templates for client businesses (alcohol or minors)
Burgo gives its proposal clients (for example nightclubs, bars or liquor stores) templates so that the business itself publishes its own texts. Burgo does not publish them on their behalf. The points to cover are:
- Age: sale and entry only to people over 18; no alcohol is sold to minors; ID checks at the door.
- Capacity and event conditions: headcount limit, hours, dress code if applicable.
- Refunds and no-shows: who refunds what, in how long and in which cases there is no refund.
- Payment methods and receipts: which methods it accepts, how a payment is verified and how receipts are handled (see above).
- Customer data: the business’s privacy and contact.
⚖️ Pending lawyer review. Local rules on alcohol sales and entertainment venues, protection of minors, terms of sale and refunds, and whether a third party (Square) is involved in card payments.
Version
Draft version 1.0, dated November 2, 2026. Contact: dev@burgo.dev. See also Cabal plans.