Annex A — Details of the Processing
- Version
- 1.0
- Effective
- October 1, 2026
- SHA-256 of this text
41f1df70f8de477e31e93d4a5f4ec7d9adee55692fc34e12a7010c69281d6035
AIDA is a service of PalmDine AI - FZCO, a free zone company registered with the International Free Zone Authority (IFZA), Dubai, United Arab Emirates, licence number 62637 ("PalmDine"). PalmDine provides AIDA and is the contracting party to the AIDA Data Processing Addendum of which this annex forms part.
Document id annex-a-processing, version 1.0. Effective date: the date stated in the Legal Center on publication. Annex A to the AIDA Data Processing Addendum: what PalmDine processes for the Customer, why, about whom, where and for how long. It serves as Annex I of the Standard Contractual Clauses and, with §7, as Annex II. Rows that depend on a Module apply only where the Order Form includes it. Current and past versions: https://www.myaidateam.com/legal/annex-a-processing.
1. Parties
| Role | Party | Contact |
|---|---|---|
| Data exporter / controller | The Customer named in the Order Form | Privacy contact from the Order Form |
| Data importer / processor | PalmDine AI - FZCO (IFZA licence 62637), DSO-IFZA, IFZA Properties, Dubai Silicon Oasis, Dubai, United Arab Emirates | Hepsen Deveci, DPO, dpo@palmdine.ai |
Activities relevant to the transfer: provision of the AIDA restaurant operations platform under the Agreement.
2. Subject matter and duration
2.1 Subject matter. Providing the AIDA Services: AI booking and guest communication, digital menu and ordering, pay-at-table, the till and point-of-sale connections, the staff console, reporting and the optional People module.
2.2 Duration. The Subscription Term, plus the export and deletion period in DPA clause 12.
2.3 Frequency. Continuous.
3. Nature and purposes of the processing
| Purpose (business purpose) | Processing operations | Module |
|---|---|---|
| Take and manage bookings | Answer calls, web voice, web chat and WhatsApp messages with an AI host; create, change and cancel bookings; send confirmations and reminders; manage waitlists | Host |
| Serve guests at the table | Show the menu; answer menu, allergen and dietary questions with an AI waiter; take orders; split and settle bills | Waiter |
| Attribute orders to a signed-in guest (only where the restaurant requires sign-in to order) | Require a guest account before an order is sent from the guest app; show staff the guest's name and a shortened phone number or email on the order. PalmDine keeps, as controller, a private record linking the order to the account, to investigate misuse the restaurant reports (DPA clause 2.3(d)) | Waiter |
| Take payments and deposits for the restaurant | Create payment sessions on the restaurant's connected payment account; record payment status and identifiers | Host, Waiter, POS |
| Run the till | Record checks, orders, payments, refunds, discounts, cash, shifts and staff sessions on the venue's edge device and synchronise them | POS |
| Connect the restaurant's own systems | Send and receive bookings, guests and orders to and from systems the restaurant connects | Host, POS |
| Keep a guest book | Store guest profiles, visit history, spend, stated preferences and allergies, tags and notes; recognise returning guests | Host, Waiter, Console |
| Share profiles within a restaurant group | Share an allow-listed set of guest fields across the group's venues when the restaurant switches it on | Console |
| Marketing (not performed today) | The Services send no marketing. They record marketing consent and keep a suppression list so that any future marketing send is checked against them | Console |
| Record calls | Record call audio, and avatar video on live-avatar web calls, when the restaurant switches recording on | Host |
| Transcribe and summarise conversations | Keep transcripts; derive stated preferences and sentiment; keep per-venue visit, no-show and cancellation counts, from which a no-show risk score is computed for staff on display and not stored | Host, Waiter |
| Report and analyse | Export operational data to BigQuery; answer staff questions with the reporting AI over a masked, venue-scoped dataset | Console |
| Manage staff and candidates | Staff accounts, rotas, training, employment records, recruitment | Console, People |
| Import reviews | Import the restaurant's Google reviews when it connects its Business Profile | Console |
| Support, security and service continuity | Investigate issues the restaurant raises; back up and restore; detect and respond to incidents | All |
The processing does not include advertising, sale of data, or training AI models on identifiable data for PalmDine's own purposes (DPA clause 3.5).
4. Categories of data subjects
| Category | Notes |
|---|---|
| Guests | People who book, call, message, visit, order or pay. Includes minors for ordinary dining: a child may be in a party or the person calling to book. Guest accounts, saved payment methods and marketing opt-ins require the Guest to confirm they are 18 or older at sign-up, so where a restaurant requires sign-in to order a Guest under 18 orders through staff. No marketing or profiling of children; guardian consent captured where a country requires it (Qatar, Annex C §3.8). |
| Guests' companions | People named in a booking or order by the booking guest |
| Restaurant staff | Owners, managers, hosts, waiters, kitchen and bar staff who use the Services or appear in rotas and records |
| Job candidates | Applicants in the People recruitment module |
| Business contacts | Supplier and partner contacts the restaurant stores |
5. Categories of personal data
| Category | Examples | Subjects |
|---|---|---|
| Identity and contact | Name, phone number, email, preferred language | Guests, staff, candidates, contacts |
| Booking and visit | Date, time, party size, table, occasion, status, no-shows, waitlist entries | Guests |
| Orders and spend | Items ordered, modifiers, bills, tips, spend totals, visit count | Guests |
| Payment references | Payment-session and charge identifiers, amounts, status, payment-provider customer identifiers and saved-card references (tokens). No card numbers | Guests |
| Stated preferences | Dietary, drink and seating preferences, stated demographic facts. No inferred gender or demographics | Guests |
| Allergy and dietary health data | Allergies and intolerances the guest states | Guests |
| Conversation content | Chat messages, transcripts of calls and web voice, AI summaries, derived sentiment | Guests, staff |
| Voice recordings | Call audio and avatar video, only when recording is switched on. Chat voice notes are processed in the request and never stored | Guests, staff |
| Photos | Profile photos a guest shares through social sign-in, or staff upload with the guest's agreement | Guests |
| Location given for directions | The starting point a guest gives when asking for directions | Guests |
| Marketing choices | Consent state, source, withdrawal, suppression entries. Consent is captured for future use; no marketing is sent today | Guests |
| Staff records | Role, venue, permissions, rota, shifts, till PIN (hashed), training records, employment and pay records, identity documents where the employer uploads them | Staff |
| Candidate records | Application, CV, interview notes, recruitment messages, consent to talent pool | Candidates |
| Technical data | Device identifiers for tills, session identifiers, IP addresses in logs | All |
6. Special categories and sensitive data
6.1 Data that is sensitive. Allergy and intolerance data is health data (GDPR Art. 9; "sensitive personal data" under PDPL; "special category" under KVKK Art. 6; "personal data of special nature" under PDPPL Art. 16; "sensitive personal information" under CCPA). Staff identity documents and some employment records may be sensitive under local law. Voice recordings are personal data; they are not used to identify a person by voiceprint.
6.2 Safeguards in place.
- Allergy data is used to serve the meal and answer the guest's questions. It is not used for marketing.
- Group sharing uses a fixed field allowlist; local spend, visits, notes, photo and venue consent are excluded.
- The reporting AI sees no raw contact details and no transcripts.
- Access is venue-scoped and permission-gated.
- Stated demographics only; no inference.
6.3 Safeguards the Customer must provide. The Services keep allergy and dietary data on a Guest's profile only with the Guest's explicit consent, recorded per Venue (Annex D §2.3); this is the platform's uniform basis in every country, including KVKK açık rıza in Türkiye. For the meal itself the Customer may rely on another lawful basis its law allows. The Customer also holds any permit the law requires (in Qatar, the PDPPL Art. 16 permit from the National Cyber Security Agency, which the Customer must hold before allergy or children's data reaches PalmDine).
7. Technical and organisational measures (summary)
The full security schedule is in DPA clause 5. Summary:
| Measure | Status |
|---|---|
| Hosting in Google Cloud; main stores in the EU | In place |
| Encryption in transit (TLS) and at rest (Google default) | In place |
| Four-layer tenant isolation | In place |
| Permission model and venue-scoped access | In place |
| Super-admin second factor | In place |
| Audit trail of changes | In place |
| Masked reporting dataset | In place |
| Secrets in Secret Manager | In place |
| Private recordings bucket, signed URLs | In place |
| Incident-response runbook | Written; yearly dry run scheduled |
| Staging separated from production | Separate projects; staging holds no production personal data |
| Approved retention periods and automatic expiry | In place (§9) |
8. Where the data is processed
| Store or service | Location |
|---|---|
| Firestore (operational database) | europe-west4, Netherlands |
| BigQuery (reporting) | europe-west4, Netherlands |
| Backend and guest apps | europe-west1, Belgium; europe-west4, Netherlands |
| Staff AI orchestrator, WhatsApp webhook | us-central1, United States |
| Stripe subscription-billing webhook function | europe-west3, Germany |
| Call recordings, edge backups | europe-west1, Belgium |
| AI model calls (Gemini, Vertex AI) | Text: global endpoint (no fixed location). Live voice: eu by default; us or us-central1 only if a PalmDine super-admin sets it for the platform |
| Edge devices (till) | At the Venue |
| Subprocessor locations | See Annex B |
| PalmDine personnel access | United Arab Emirates and wherever staff work |
9. Retention
9.1 The retention periods below were approved by PalmDine's DPO on 2026-09-29 and are enforced by the platform's retention job, the recordings storage lifecycle and the reporting warehouse's partition expiry. A Venue may shorten the recordings period and set the guest-profile period between 1 and 10 years (Agreement clause 6.2(h)); a legal hold suspends deletion for the records it names. Otherwise data is kept for the Subscription Term at most and deleted under DPA clause 12.
9.2 The retention classes and their approved periods are:
| # | Retention class | Approved period | Then |
|---|---|---|---|
| R1 | Account identity and authentication | Staff session cookie up to 7 days; staff accounts kept while the person holds a role, closed with the role; guest platform accounts kept while active, closed after 36 months without a sign-in following a warning e-mail, and deleted on the guest's or a Venue's erasure | Deleted |
| R2 | Bookings, orders, deposits, payments | Bookings 36 months after the booking date; orders 36 months; chats that led to no order 24 months | Paid bookings and orders anonymised (amounts, items, payments and dates kept 7 years for accounting), unpaid bookings and orderless chats deleted. Where the restaurant requires sign-in to order, the guest's name and shortened contact on the order, and the record linking the order to the guest account, are removed when the order is anonymised or deleted and, if earlier, when the guest deletes the account |
| R3 | Conversation logs and transcripts, escalations and hand-over requests, feedback, derived preferences and reliability counters | Logs and transcripts 24 months; escalations 24 months; feedback 24 months; derived preferences and counters follow the guest profile (R5) | Logs and escalations deleted; feedback stripped of free text and links, anonymous ratings kept |
| R4 | Call audio and avatar video | 90 days after the call (a Venue may set 7 to 90 days) | Deleted from the bucket and cleared off the log |
| R5 | Guest profiles, group profiles, guest-account venue links | 36 months after the guest's last visit (a Venue may set 1 to 10 years); withdrawn marketing consent records 36 months as proof | Profile anonymised; hashed suppression entry kept permanently; revoking a link stops future sync only |
| R6 | Till records and edge backups | On the device until wiped; cloud edge backups 30 days | Business-record periods per country apply to the Customer's own copies |
| R7 | Logs and audit records | Platform logs 90 days; Google-managed admin-activity audit logs 400 days; the application audit trail follows the record it describes | Expire |
| R8 | Reporting warehouse copies | Partition expiry 36 months for guest, booking and order tables, 24 months for conversation and escalation tables; rows of erased or deleted records removed by the erasure ledger at the next export | Expire; BigQuery time travel 7 days |
| R9 | Backups (other than edge) | Firestore has no scheduled backup; Cloud Storage soft delete 7 days; no whole-database copies are made | Erasures recorded in the audit trail are replayed before any restored data returns to live use |
| R10 | Staff and candidate records | Employer-scoped holds and retention logic in the People module | Employer-set |