Data Processing Addendum

1. Definitions

"Personal Data", "Process", "Controller", "Processor", "Data Subject" and "Personal Data Breach" have the meanings in applicable privacy law, including the GDPR where it applies and the California Consumer Privacy Act as amended ("CCPA") and other US state privacy laws ("Privacy Laws"). "Customer Personal Data" is Personal Data in Customer Data that we process for you. "Subprocessor" is a third party we engage to process Customer Personal Data.

2. Roles and scope

You are the Controller (or business) and we are your Processor (or service provider) for Customer Personal Data. The subject matter, duration, nature and purpose, types of data and categories of Data Subjects are: providing the restaurant back-office Service for the term of the Terms; hosting, storing, retrieving, transmitting, displaying and analyzing data; Personal Data of the Customer's employees, job applicants, contractors, vendors, customers and callers, including contact details, employment, schedule, time, pay, tax-form, résumé, photo, signature, call-audio and message data.

3. Our obligations

• We process Customer Personal Data only on your documented instructions, which are the Terms, this DPA and your use and configuration of the Service, unless law requires otherwise (we will tell you first where permitted).
• We will not sell or share Customer Personal Data, retain, use or disclose it outside our direct business relationship with you or for any purpose other than the business purposes in the Terms, or combine it with other personal data, except as Privacy Laws permit for service providers. We certify we understand and will comply with these restrictions.
• We make sure people who access Customer Personal Data are bound by confidentiality.
• We tell you if we believe an instruction breaks Privacy Laws.
• We give you the information reasonably needed to show compliance and allow and contribute to reasonable audits as described in section 9.

4. Your obligations

You will give lawful instructions, have a lawful basis and give all notices and obtain all consents required for the Personal Data you put into the Service (including employee and applicant notices, e-signature, recording, screening and photo consents), and are responsible for the access settings you give your users.

5. Security

We maintain the technical and organizational measures in Annex II, which are described in more detail on our Security page, and we may update them provided they are not materially weakened.

6. Subprocessors

• You authorize the Subprocessors listed on our Subprocessors page.
• We will update that list and give owners at least [30] days' notice (in the Service or by email) before adding or replacing a Subprocessor. You may object on reasonable data-protection grounds within that time; if we cannot resolve it you may terminate the affected Service and receive a refund of prepaid fees for the unused period.
• We have a written agreement with each Subprocessor with data-protection obligations no less protective than this DPA, and we remain responsible for their performance.
• The AI provider, storage and integrations that you choose and connect yourself are your own service providers, not our Subprocessors, and you are responsible for your agreement with them.

7. Data subject requests

Taking into account the nature of the processing, we will help you respond to requests from Data Subjects to exercise their rights, including access, correction, deletion and portability, through the tools in the Service and on reasonable request. If a Data Subject contacts us directly about Customer Personal Data we will tell them to contact you, and notify you, unless law requires otherwise.

8. Personal Data Breach

We will notify you without undue delay, and in any case within [72] hours, after we become aware of a Personal Data Breach affecting Customer Personal Data, and provide the information reasonably available to help you meet your obligations: the nature of the breach, the data and people affected, likely consequences, and the measures taken or proposed. We will take reasonable steps to contain and remediate it.

9. Assessments and audits

On request, no more than once a year (or after a breach), we will give you reasonable documentation of our measures. If that does not satisfy a legal requirement, you may, on [30] days' notice and at your cost, conduct an audit during business hours that does not disrupt our operations, under confidentiality. We will help with data-protection impact assessments and consultations with regulators where required, taking into account the information we have.

10. Return and deletion

You can export Customer Personal Data at any time. When the Terms end we will, at your choice, return or delete Customer Personal Data within [30] days, and delete remaining copies including backups on their normal expiry cycle, except where law requires us to keep it, in which case we will keep it confidential and use it only for that purpose.

11. International transfers

Customer Personal Data is stored and processed in the United States. Where the GDPR, UK GDPR or Swiss law applies and a transfer needs a mechanism, the parties agree to the Standard Contractual Clauses (Module Two, controller to processor), the UK Addendum and the Swiss amendments, which are incorporated by reference, with the details in Annexes I to III, and with [the law and courts of Ireland] for the EU clauses.

12. Liability and order of precedence

Each party's liability under this DPA is subject to the limits in the Terms. If this DPA conflicts with the Terms about the processing of Personal Data, this DPA applies; if it conflicts with the Standard Contractual Clauses, the clauses apply.

Annex I: Details of processing

• Controller and processor: as above. Contact for privacy matters: [email protected].
• Data subjects: the Customer's employees, applicants, contractors, vendors, customers and callers.
• Categories of data: identifiers, contact details, employment and pay data, time and schedule data, tax-form data, résumé data, photos, signatures, call audio and messages. Sensitive data: government identifiers and bank details on payroll and tax forms, if the Customer enters them.
• Frequency: continuous, for the term. Retention: as in sections 10 and the Privacy Policy.
• Subprocessors: the list on the Subprocessors page.

Annex II: Security measures

• Each restaurant's data is stored in its own database; access is limited by role and by area, set by the owner.
• Encryption in transit (HTTPS with HSTS); encryption at rest provided by the hosting, database and storage providers.
• Passwords hashed with a one-way function; minimum length; account lockout after repeated failures; rate limiting on sign-in and public endpoints; signed, expiring session cookies.
• API keys stored only as hashes and individually revocable; an AI agent's requests are limited to what the person it acts for may do, and sensitive changes need that person's confirmation.
• An audit log of sensitive actions; error and security incident logging with owner alerts.
• Files are served with safe content types and checked so that one restaurant can never be given another restaurant's files.
• Dependency vulnerability checks and a code and security review before releases; staff access to production data is limited and logged.