How Toast can support your General Data Protection Regulation compliance efforts

If you need to learn more about the GDPR (General Data Protection Regulation) - a comprehensive European Union (EU) data protection law - check out our article Overview of the General Data Protection Regulation and how it may impact your business.

Please note that Toast can only support customers with individual rights requests for personal information that is collected by Toast’s products and services (for the purposes of this article, personal information also includes the definition of personal data under the GDPR). If you use other service and technology providers to store customer or employee personal information, you will need to reach out to them separately.

After you have received an individual rights request, before reaching out to Toast, you need to: 

• Confirm receipt and verify the identity of the individual making the request;  
• Confirm whether the request itself is a valid individual rights request (e.g. not subject to an exemption) under the GDPR;  
• Determine the appropriate scope of the request; and  
• Confirm that the request itself is relevant to Toast and that Toast collects, maintains, or uses the information forming part of the request. 

Once those elements are confirmed, please contact us at privacy@toasttab.com. Your message should include:

• The nature of the request (e.g., access, erasure, restriction etc.) in the subject line of the email; and
• The name, email, phone number, or other relevant details of the requestor (as applicable) to enable us to search our records and support the fulfillment of the request. 

Once we receive your message Toast will provide the following support in addition to verification support or to confirm what data is being processed by Toast:

• For access requests, Toast will scan our systems to determine if we hold information about the individual. Please provide the name, email, phone number, and other relevant details of the request (as applicable) to enable us to perform the search. To the extent any information is found within Toast or within any service provider systems, Toast or the relevant service provider will provide you with the requested information in a reasonable and timely manner.   
• For deletion requests, Toast will support the fulfillment of the deletion request by removing the relevant personal information held by Toast as part of the request. To the extent applicable, Toast may also notify other third-party service providers that support Toast with the processing activities. Once the above activities are completed, Toast will respond to you and verify that the requested information has been deleted and that the appropriate third parties have been notified.   
• If additional rights beyond access and/or deletion are invoked by an individual and submitted to you, Toast will work with you to address the request to the extent applicable to instances where Toast processes personal data related to the request. For these additional requests, please provide the name, email, phone number, and other relevant details of the request (as applicable).

Please note that it is your responsibility to verify the appropriateness of the individual rights request and to determine the applicable scope. Please review the GDPR and the local implementing legislation for additional information on the applicable requirements or consult your independent legal counsel for additional guidance generally or in relation to the fulfillment of any individual rights. 

Toast’s support will only cover instances where Toast processes personal information relevant to the request. If for any reason Toast is unable to provide support or fulfill aspects of the individual rights requests above, we will communicate that to you along with our rationale for why the request cannot be fulfilled from the Toast side. 

Requests for assistance may be sent to privacy@toasttab.com.