Data Processing Agreement

This Data Processing Agreement ("DPA") forms part of the Terms of Service between DineTide ("Processor", "we") and the Customer ("Controller", "you") and applies where we process personal data on your behalf in providing DineTide. It is intended to satisfy Article 28 of the GDPR and UK GDPR, and equivalent duties under India's Digital Personal Data Protection Act, 2023.

1. Definitions

"Personal Data", "Processing", "Controller", "Processor", "Data Subject", "Supervisory Authority" and "Personal Data Breach" have the meanings in the GDPR. "Customer Data" means Personal Data in your system that we process for you. "Sub-processor" means a third party we engage to process Customer Data. "Services" means DineTide.

2. Roles and scope

You are the Controller (or a Processor acting for another Controller) of Customer Data. We are your Processor. The subject matter, duration, nature, purpose, data types and data subjects are in Annex 1. You are responsible for having a lawful basis for the Processing and for giving notices to data subjects.

3. Our obligations

We will:

• process Customer Data only on your documented instructions, which are these terms, your use of the Services and any further written instruction, unless the law requires otherwise (and we will tell you first where allowed);
• tell you if we think an instruction breaks data protection law;
• ensure people who access Customer Data are bound by confidentiality;
• apply the security measures in Annex 2;
• respect the sub-processor conditions in section 5;
• help you respond to data subject requests (section 6);
• help you meet your duties on security, breach notification, impact assessments and consulting authorities, taking account of the nature of the Processing and the information we hold;
• delete or return Customer Data at the end of the Services (section 9);
• make available the information needed to show we comply with this DPA and allow audits (section 8).

4. Your obligations

You will use the Services lawfully; give us lawful instructions; keep your users' credentials secure; set roles and permissions inside your system sensibly; and not upload special-category or other sensitive data unless needed and lawful.

5. Sub-processors

You give general authorisation for the Sub-processors on our Sub-processors page, which lists each one's purpose and location. We will give at least 30 days' notice of any addition or replacement. You may object on reasonable data protection grounds in that time; if we cannot resolve it you may end the affected Services and receive a refund of prepaid fees for the unused period. We bind each Sub-processor to written terms no less protective than this DPA and remain responsible for their performance.

6. Data subject requests

If a data subject contacts us about Customer Data we will tell them to contact you and will tell you promptly, unless the law forbids it. The Services include tools for you to access, correct, export and delete data yourself. We will help with anything more, at a reasonable cost if it is substantial.

7. Personal Data Breach

We will notify you without undue delay, and in any case within 48 hours, after becoming aware of a Personal Data Breach affecting Customer Data. The notice will describe what we know: the nature of the breach, the data and approximate number of people affected, likely consequences, and the steps taken or proposed. We will keep you updated and cooperate with your investigation and notifications.

8. Audit

We will give you, on request, the information needed to show compliance, such as our security summary and records of the controls in Annex 2. If that is not enough, you may carry out an audit, no more than once a year (or after a breach), on at least 30 days' notice, during business hours, under confidentiality, without disrupting other customers, at your cost. Independent certifications or reports we hold may satisfy this right.

9. Return and deletion

You can export Customer Data as spreadsheets at any time. When the Services end we keep your system read only for 30 days for export, then delete Customer Data from live systems, and from backups within a further 35 days, unless the law requires us to keep it. On request we will confirm deletion in writing.

10. International transfers

We may process Customer Data in India and in the regions where our Sub-processors operate. Where Customer Data from the European Economic Area, the United Kingdom or Switzerland is transferred to a country without an adequacy decision, the Standard Contractual Clauses (Module Two, controller to processor, and Module Three where relevant) and the UK Addendum are incorporated by reference and form part of this DPA, with the details in Annex 1 and Annex 2 completing their annexes. Where the Indian Act applies we transfer data only to territories the government has not restricted.

11. Liability and term

Liability under this DPA is subject to the limits in the Terms of Service. This DPA lasts as long as we process Customer Data and ends when the Services end and the data is deleted.

12. Order of precedence

If this DPA conflicts with the Terms of Service on Processing of Personal Data, this DPA prevails. If it conflicts with the Standard Contractual Clauses, the Clauses prevail.

Annex 1: Details of Processing

• Subject matter and purpose: providing the DineTide service: hosting and operating your private system, storing and processing the records your team enters, support, security and backups.
• Duration: the term of the Services plus the return and deletion period in section 9.
• Nature of Processing: storage, retrieval, display, transmission, backup, deletion and incidental access for support, on your instruction.
• Categories of data subjects: your staff and contractors who use the system; people at your suppliers and customers whose names and contact details you enter.
• Types of Personal Data: names, work email addresses, phone numbers, job titles, sign-in and activity records (including IP address and device information), roles, schedules and shift or attendance records, photos you upload, supplier contact details, and free text your team writes. We do not intend the Services to hold special categories of data.
• Frequency: continuous, for as long as the Services are used.
• Competent Supervisory Authority: the authority in the country where the Controller is established, or where no establishment, the authority in the country of its representative.

Annex 2: Technical and organisational measures

• Separation of customers: each customer has its own application stack and its own database; one customer cannot reach another's data.
• Encryption: TLS for all data in transit; encryption at rest for databases, backups and secrets; passwords stored only as salted hashes.
• Access control: role-based access inside every system; two-step sign-in available and enforceable; lock-out after repeated failures; session expiry and the ability to end sessions; least-privilege access for our staff, approved and logged, with multi-factor authentication required.
• Audit and monitoring: an audit record of important actions; alerts for suspicious activity; centralised error and security logging.
• Application security: input validation, protection against common web attacks, signed and rate-limited machine-to-machine calls, secrets kept outside code, dependency scanning and prompt patching.
• Availability and resilience: nightly backups kept off the primary server, restore tests, monitoring and capacity limits for each system.
• Incident response: documented procedure, defined owners, and the breach notification commitment in section 7.
• People: confidentiality commitments, security training, and background checks where the law allows.
• Physical security: provided by our hosting providers, which hold recognised security certifications.
• Data minimisation and retention: only what the Services need; deletion as set out in section 9.