DennyTips

# DennyTips

## PRIVACY POLICY

Version 2.0. Effective from: 2021.10.01. Last updated: 2026.08.06.

## 1. Data controller

1.1. The controller of your personal data is DennyPay, UAB, legal entity code 304887823, registered office at [address], e-mail info@dennypay.com, tel. +370 633 99840 (DennyPay, we).

1.2. This policy applies to personal data processed in providing the DennyTips tip collection, administration and payout service in Lithuania and Latvia — on the website, in the DennyTips system, through QR / NFC solutions and dedicated tip POS terminals.

## 2. Whose data and what data we process

2.1. Employees of catering establishments (DennyTips account users): name, surname, personal identification number (for PIT purposes), e-mail address, telephone number, bank account number, establishment and position / group, photograph (if you provide one), allocated tip amounts, payout history, chosen PIT administration method, data on PIT transferred to the State Tax Inspectorate in your name, login and terms-confirmation logs, and the account confirmation data received from your bank during the EUR 0.01 verification payment.

2.2. Representatives and responsible persons of establishments: name, surname, position, contact details, actions in the DennyTips system (e.g. common pool distributions).

2.3. Customers leaving tips: payment transaction data (amount, date, time, the establishment / employee for whom the tip was left, payment method and technical payment identifier). We do not collect or store payment card data — it is processed by licensed payment service providers (Adyen N.V., NEO Finance, AB). We do not identify the customer, unless the customer contacts us with a complaint.

## 3. Purposes and legal bases of processing

3.1. Provision of the service: creation and administration of the account, tip accounting, allocation and payout to your bank account. Basis — performance of a contract with you (Art. 6(1)(b) GDPR).

3.2. Deduction and transfer of PIT to the State Tax Inspectorate in your name, where you have chosen this method. Basis — performance of a contract (Art. 6(1)(b) GDPR) and legal obligations (Art. 6(1)(c) GDPR).

3.3. Identity and bank account verification (the EUR 0.01 payment), fraud prevention, transaction monitoring, blocking of accounts in case of abuse. Basis — our legitimate interest in ensuring the security of the service (Art. 6(1)(f) GDPR) and, where applicable, legal obligations (Art. 6(1)(c) GDPR).

3.4. Accounting, tax and other legal obligations. Basis — legal obligation (Art. 6(1)(c) GDPR).

3.5. Handling of complaints, provision of support, establishment or defence of legal claims. Basis — legitimate interest (Art. 6(1)(f) GDPR).

3.6. Sending notifications about the account and changes to the terms (by e-mail, SMS, in the system). Basis — performance of a contract (Art. 6(1)(b) GDPR).

## 4. To whom we transfer data

4.1. To licensed payment service providers through which payments and payouts are executed: NEO Finance, AB (Lithuania) and Adyen N.V. (the Netherlands, also operating in Lithuania). They also process your data as independent controllers under their own privacy policies.

4.2. To the State Tax Inspectorate — when we transfer PIT in your name upon your instruction.

4.3. To your establishment — information on the tips collected and distributed at the establishment (for administration of the common pool).

4.4. To service providers acting as data processors: IT infrastructure / hosting, accounting and communication (e-mail, SMS) service providers. Data processing agreements are concluded with all processors. [Insert list of main processors / hosting location.]

4.5. When the updated model with POS integration is deployed — to the payment processing partner Worldline and the relevant acquiring bank, to the extent necessary for allocating tips based on the employee identifier. We will inform you of this change by updating this policy.

4.6. To competent authorities — where required by legal acts. Data is processed in the European Economic Area; if data were to be transferred outside the EEA, we would apply the safeguards of Chapter V of the GDPR.

## 5. How long we keep data

5.1. Account and tip accounting data — for the entire period of using DennyTips and for 10 years after the last transaction (requirements of accounting and tax legislation and limitation periods).

5.2. Login and confirmation logs — [2] years from the creation of the record.

5.3. Complaint files — [3] years after the complaint is resolved, or until the final resolution of the dispute.

5.4. Upon expiry of the retention period, data is deleted or anonymised.

## 6. Your rights

6.1. You have the right to: access your data and receive a copy of it; request rectification of inaccurate data; request erasure of data (the "right to be forgotten"), insofar as this is compatible with our legal obligations; restrict processing; receive data in a portable format; object to processing based on legitimate interest.

6.2. Submit requests by e-mail to help@dennypay.com. We will respond no later than within 1 month. We may ask for additional information to confirm your identity.

6.3. If you believe your data is being processed improperly, you have the right to lodge a complaint with the State Data Protection Inspectorate of Lithuania (vdai.lrv.lt, L. Sapiegos g. 17, Vilnius) or, in Latvia — Datu valsts inspekcija (dvi.gov.lv).

## 7. Data security

7.1. We apply technical and organisational security measures: encrypted data transmission, access control on a need-to-know basis, transaction monitoring, and blocking of accounts upon suspected abuse. Payment card data is not stored in DennyPay systems.

## 8. Cookies

8.1. The DennyTips website uses only essential cookies necessary for the session and security. [If analytics or other cookies are used — supplement with a cookie table and a consent mechanism.]

## 9. Changes to this policy

9.1. When we update this policy, we will publish the new version in the DennyTips system and on the website, and will inform account users of material changes by e-mail or in the account. The version history is kept in the system.

---

DennyPay, UAB

Ulonų g. 5, Vilnius, Lithuania

info@dennypay.com

+370 633 99840