Annex C — Country Riders

AIDA is a service of PalmDine AI - FZCO, a free zone company registered with the International Free Zone Authority (IFZA), Dubai, United Arab Emirates, licence number 62637 ("PalmDine"). PalmDine provides AIDA and is the contracting party to the AIDA Master Subscription Agreement and the AIDA Data Processing Addendum that these riders add to.

Document id annex-c-country-riders, version 1.1. Effective date: the date stated in the Legal Center on publication. Country-specific terms that add to the AIDA Master Subscription Agreement (clause 25) and the Data Processing Addendum (clause 11). Each rider applies only to Venues in that country, and only where the Order Form selects it. Current and past versions: https://www.myaidateam.com/legal/annex-c-country-riders.

The AIDA Terms & Conditions allocate the seller role and consumer duties to the restaurant for the UAE, Qatar and Türkiye (Terms clause 31). The riders below carry the same allocation into this contract and add the data-protection and telecoms points.

1. Türkiye

1.1 Data-protection law. KVKK (Law No. 6698) and its secondary legislation apply to the Customer as data controller (veri sorumlusu) and to PalmDine as data processor (veri işleyen).

1.2 Cross-border transfer. Because PalmDine and its subprocessors are outside Türkiye, the Customer's transfer to PalmDine is a cross-border transfer under KVKK Art. 9 as amended by Law No. 7499 (in force 1 June 2024). The parties sign the Personal Data Protection Board's controller-to-processor standard contract, in the Board's published form and without additions, deletions or structural changes, as a separate document for each Turkish Customer; every commercial, operational or technical term stays in the Agreement and the DPA. The Customer, as controller, files the signed standard contract with the Personal Data Protection Authority within five (5) business days of signature (KVKK Art. 9(5); Cross-Border Transfer Regulation §14), through the Authority's portal or by KEP, and sends PalmDine the filing receipt; PalmDine supplies the signed Turkish copy and the filing pack within one business day of signature.

1.3 Turkish language. Law No. 805 binds Turkish enterprises, so the Customer needs Turkish versions for domestic validity and filings. The Agreement, the Order Form, the DPA and this rider are signed in Turkish and English; the Turkish version prevails for performance inside Türkiye. The Board's standard contract is executed in Turkish, or bilingually with the Turkish text prevailing. Signature: the Board's standard contract is executed in wet ink or with a Turkish secure electronic signature from a BTK-accredited provider (Law 5070 Art. 14); a DocuSign standard signature or console click-acceptance does not suffice for it. The Agreement, Order Form and DPA for a Turkish Customer are likewise executed in wet ink (scanned copies retained) or with a Turkish secure electronic signature, in Turkish or dual-language with Turkish prevailing. The Customer supplies its signature circular (imza sirküleri) as evidence of the signer's authority.

1.4 VERBİS and representative. The Customer is responsible for its own registration in the Data Controllers' Registry (VERBİS) where it meets the thresholds, and for listing PalmDine as a recipient of transferred data. PalmDine acts only as processor for Customer Personal Data: it is exempt from VERBİS registration and is not required to appoint a data-controller representative in Türkiye (KVKK Art. 16).

1.5 Explicit consent for health data. Allergy data is special-category personal data (KVKK Art. 6). The Services record the Guest's explicit consent (açık rıza) per Venue before keeping allergy data on the profile (Annex A §6.3). For the meal itself the Customer is responsible for having a lawful condition, which may be that same explicit consent.

1.6 Information notice. The Customer is responsible for the privacy information notice (aydınlatma metni) to its guests and staff under KVKK Art. 10. The AIDA Privacy Policy covers PalmDine's own controller processing only. Where a Venue requires Guests to sign in before ordering (Agreement clause 6.2(l)), the Customer's information notice names that processing and its purpose.

1.7 Commercial electronic messages. AIDA sends no commercial electronic messages today: every message the Services send is transactional (booking confirmations, reminders, table-ready and waitlist updates, receipts, sign-in codes, staff notices), so AIDA's messages do not trigger İYS registration. If the Customer later sends marketing through the Services, then under Law No. 6563 on the Regulation of Electronic Commerce and its regulation the Customer, as the service provider, must obtain prior approval for commercial electronic messages and register with the Message Management System (İleti Yönetim Sistemi, İYS). The Services record marketing consent and suppression entries.

1.8 Consumer law. The Customer is the seller to guests under the Consumer Protection Law No. 6502 and the Distance Contracts Regulation. Prepared food and perishable goods are exempt from the 14-day right of withdrawal; where a right of withdrawal applies (for example some prepaid deposits), the Customer must honour it (Terms clause 31).

1.9 Stamp tax. Under Law No. 488 the Order Form, which states a monetary value, attracts stamp tax at 0.948% of the stated contract value, subject to the annual statutory cap; the Agreement (no value stated), the DPA and the Board's standard contract do not. The signatories are jointly and severally liable to the tax office. The Customer bears the Turkish stamp tax in full; this allocation is not open to negotiation in the Order Form. Where PalmDine is made to pay it, the Customer reimburses PalmDine within 14 days of invoice.

1.10 Onward transfers to PalmDine's subprocessors. PalmDine's transfers from its hosting to its subprocessors (Annex B Part A) are onward transfers under KVKK Art. 9. The Board's processor-to-processor standard contract, or a Board-approved binding corporate rule, would cover them; PalmDine's cloud, telephony, messaging and payment providers do not sign the Board's form and rely instead on their own data-processing terms, which incorporate the EU Standard Contractual Clauses and equivalent technical safeguards. PalmDine therefore: (a) binds every subprocessor by those terms (DPA clause 6.5); (b) asks each subprocessor for the Board's processor-to-processor form and signs it wherever offered, notifying the Authority within five business days and updating Annex B; (c) keeps Turkish Customers' guest data on EU processing endpoints wherever the Services allow; and (d) discloses in Annex B which subprocessors have accepted the Board's form; none had at the effective date of this version. The Customer acknowledges that, until a subprocessor accepts the Board's form or the Board grants permission on a written undertaking, the formal KVKK Art. 9 safeguard for those onward transfers is the subprocessor's own instrument, and that the Customer, as controller, assesses that position. Nothing in this clause reduces PalmDine's obligations under the DPA.

2. United Arab Emirates

2.1 Data-protection law. The PDPL (Federal Decree-Law No. 45 of 2021) applies to the Customer's processing in the UAE and to PalmDine as its processor. Article 2(2) excludes only free zones with their own data-protection law, the DIFC and ADGM; IFZA has none, so PalmDine falls under the federal PDPL. The Executive Regulations remain outstanding; under Article 29 the six-month compliance period runs from their publication, and the parties will update this rider within that period.

2.2 Transfers. Until the UAE adequacy list under PDPL Art. 22 is published by executive decree, every transfer of Customer Personal Data out of the UAE — to PalmDine's hosting in the EU and to subprocessors in the US — relies on Art. 23(1): a legally binding contract obliging the recipient to protect the data to the standard the PDPL requires. The DPA is that contract: subprocessor flow-down (DPA clause 6.5), the technical safeguards in the security schedule (DPA clause 5: encryption in transit and at rest, access restriction, purpose limitation), and the notification duties for security incidents and public-authority access requests (DPA clauses 8 and 11.6).

2.3 Marketing messages. AIDA sends no marketing messages today; its outbound messages are transactional and go by WhatsApp and e-mail. If the Customer later sends marketing through the Services, marketing messages by WhatsApp to UAE numbers must follow the Telecommunications and Digital Government Regulatory Authority (TDRA) rules on unsolicited electronic communications: prior consent, sender identification and an opt-out in each message. The Customer is responsible for consent and for any sender registration. The Services honour opt-outs through one suppression list.

2.4 Recording notice. Recording a call without the other person's consent can be an offence under the Cybercrime Law (Federal Decree-Law No. 34 of 2021). If a UAE Venue switches recording on, the recording notice plays at the start of every recorded call and the Customer must not switch it off.

2.5 Seller identity and consumer law. The Customer is the seller under Federal Decree-Law No. 14 of 2023 on Trading by Modern Technological Means and Federal Law No. 15 of 2020 on Consumer Protection. It must show its identity, VAT-inclusive prices and its refund and cancellation terms to guests (Terms clause 31).

2.6 VAT. Fees are subject to UAE VAT where applicable (Agreement clause 10.4).

2.7 Electronic signature. Electronic signature and acceptance are valid under Federal Decree-Law No. 46 of 2021 on Electronic Transactions and Trust Services (Agreement clause 24.4).

2.8 Allergen duties. Food-safety and allergen-labelling duties (for example Dubai Municipality requirements) remain the Customer's.

2.9 PalmDine's own PDPL duties as processor. PalmDine keeps a record of the processing it carries out for UAE Customers as PDPL Art. 8(2) requires (DPA clause 10.1); has appointed a data protection officer (Hepsen Deveci, dpo@palmdine.ai), which Art. 10 makes mandatory only for high-risk or large-scale processing but PalmDine adopts as practice; and will register with the UAE Data Office once the Executive Regulations open a processor registration. Until then the record of processing and the DPA stand as PalmDine's compliance evidence.

3. Qatar

3.1 Data-protection law. The PDPPL (Law No. 13 of 2016) applies. The Customer is the controller; PalmDine is the processor. Where a Venue requires Guests to sign in before ordering (Agreement clause 6.2(l)), the Customer gives the Guest clear notice of that processing before sign-in.

3.2 Special-nature data. Health data (including allergies and dietary intolerances) and children's data are "personal data of special nature" (PDPPL Art. 16). Processing them requires a permit from the competent department (National Cyber Security Agency); internal safeguards or an impact assessment alone do not suffice. The Customer, as controller, applies for and holds the permit. The Customer warrants that it holds the Art. 16 permit before any allergy, health or children's data reaches PalmDine, and PalmDine may keep dietary capture switched off for a Qatari Venue until the Customer confirms the permit in the console.

3.3 Transfers. PDPPL Art. 15 permits cross-border flows that do not breach the law or risk serious harm to privacy; no separate transfer permit is needed for standard SaaS operation once the Art. 16 processing permit is held. The DPA (clauses 5, 6.5, 11 and 11.6) is the safeguard that meets the Art. 15 threshold.

3.4 Electronic marketing. Direct electronic marketing needs the recipient's prior express consent, sender identification and an accessible opt-out (PDPPL Art. 22). AIDA places no outbound calls and sends no SMS; its outbound channels are WhatsApp and e-mail, and today every message on them is transactional. Marketing messages on those channels, if the Customer later sends any, need the opt-in; transactional messages (booking confirmations, reminders, dietary checks) are not direct marketing. Inbound calls that a Guest places to the Venue and the AI host answers are not electronic marketing.

3.5 Consumer law. The Customer is the seller under Law No. 8 of 2008 on Consumer Protection and Law No. 16 of 2010 on Electronic Commerce and Transactions, including pre-contract information and cancellation rights (Terms clause 31).

3.6 Breach notification. The competent authority's guideline is 72 hours for breaches that may cause serious damage. PalmDine's notice to the Customer under DPA clause 8 is designed to leave the Customer time to meet it.

3.7 Withholding tax. Fees paid by a Qatari resident Customer to PalmDine, a non-resident without a permanent establishment in Qatar, attract Qatar withholding tax at 5% of the gross amount. Fees are net of Qatari taxes: the Customer grosses up each payment so that PalmDine receives the full invoiced Fee (Agreement clause 10.4); gross-up clauses are enforceable under Qatari law.

3.8 Children. Where a booking is made by, or includes, a person under 18, the child's data is special-nature data requiring the express consent of a parent or legal guardian. The Customer maintains age verification or guardian-consent mechanisms at the point of booking for its Qatari Venues and warrants that valid guardian consent exists before a minor's data reaches PalmDine. The Services offer a guardian-consent capture in the booking flow for Qatari Venues; the Customer remains responsible for bookings its staff enter or that arrive from a connected system.

4. EU, EEA and UK

4.1 Transfer clauses. The EU SCCs (Module 2, or Module 3 where the Customer is a processor), the UK Addendum and the Swiss FADP adjustments in DPA clause 11 apply.

4.2 Art. 27 representatives. PalmDine has not yet appointed a representative in the EU (GDPR Art. 27) or the UK (UK GDPR Art. 27). PalmDine will not onboard an EU, EEA or UK Customer until it has appointed them, and will add their details to DPA clause 16.

4.3 AI disclosure (EU AI Act Art. 50). From 2 August 2026, people must be told they are interacting with an AI system unless it is obvious. For Venues in the EU, EEA and UK, the AI disclosure is on and cannot be switched off. The Venue may choose how Guests are told on each channel (spoken or written by the AI, or shown on screen), but every channel always keeps at least one of those forms on, so a Guest is told on every channel. A location change into one of those countries clears any stored "off" setting, for the disclosure as a whole and for each form, and how the disclosure was delivered is recorded per conversation. The Customer must not work around it.

4.4 AI Act roles. Under Regulation (EU) 2024/1689 PalmDine is the provider of the AI system in the Services (Art. 3(2)): it develops AIDA and places it on the market under its own brand, whatever the foundation model it builds on. The Customer is the deployer (Art. 3(4)). PalmDine owes the transparency duties of Art. 50, human-oversight controls designed into the software, and technical documentation; Google's general-purpose-model duties are Google's. The Customer, as deployer: uses the Services in line with PalmDine's instructions and documentation; keeps human oversight over decisions the AI Output informs (Agreement clause 9.3); informs its staff before deploying AI in the workplace where national labour law requires; and monitors performance and reports serious incidents to PalmDine and, where required, to the supervisory authority.

4.4a Transparency (Art. 50, applies from 2 August 2026 — active). Guests are told they are talking to an AI: the AI-disclosure line is on by default and locked for EU, EEA and UK Venues (Agreement clause 6.2(b)), which satisfies Art. 50(1). Summaries, preference notes and reliability scores produced for staff need no AI label. Transactional messages to Guests (confirmations, reminders) are not synthetic media and need no label.

4.4b High-risk uses (Annex III, applies from 2 December 2027 under the 2026 Digital Omnibus). Recruitment screening or ranking, and AI assessment of candidates' or staff performance or training, are Annex III category 4 high-risk uses. The People Module contains such features, so it is not offered for EU, EEA or UK Venues (Order Form §5) until PalmDine has completed for it a conformity assessment, EU database registration, a risk-management system, data governance and event logging, and human-oversight and accuracy controls. The no-show reliability score is an informational tool for staff that never refuses a booking (Agreement clause 9.3; Art. 6(3) preparatory-task exception) and is not high-risk; the Customer's privacy notice describes the profiling.

4.4c Prohibited practices (Art. 5, active since 2 February 2025). The Services perform no social scoring, no emotion recognition of staff or guests, and no manipulative profiling; PalmDine will not add such features.

4.5 Storage on guest devices. Optional storage on guests' devices needs prior consent under the ePrivacy Directive as implemented locally. The guest app stores optional preferences only after consent.

4.6 Consumer law. Mandatory EU and national consumer law applies to the Customer's sales to guests.

4.7 Accessibility. PalmDine designs the guest apps to the WCAG 2.1 AA guidelines. The Customer remains responsible for the accessibility of the content it supplies through the Services (menu texts, images and their descriptions, its own notices), and for any accessibility duty its law places on it as the operator of the Venue.

5. United States

5.1 Service-provider terms. This rider applies to Venues in, and Guests resident in, any US state with a comprehensive privacy law, and names: California (CCPA/CPRA), Colorado (CPA), Virginia (VCDPA), Texas (TDPSA), Connecticut (CTDPA), Utah (UCPA) and Oregon (OCPA), together with any other US state comprehensive privacy law as enacted or amended. PalmDine is a "service provider" (CCPA) or "processor" under those laws. In addition to DPA clause 3.5 (no selling or sharing, no use outside the business purpose, no combining, certification), PalmDine:

(a) processes personal information only for the business purposes in Annex A §3;

(b) will comply with the applicable law and give the same level of privacy protection the law requires of the Customer;

(c) will tell the Customer if it can no longer meet its obligations;

(d) allows the Customer to take reasonable and appropriate steps to stop and remediate unauthorised use, and to audit its compliance (DPA clause 13);

(e) certifies that it understands and will comply with these restrictions;

(f) will delete or return personal information at the end of the Services (DPA clause 12), help the Customer with consumer requests (DPA clause 7) and with data protection assessments (DPA clause 9); and

(g) flows these obligations down to every subcontractor by written contract (DPA clause 6.5).

5.2 TCPA. AIDA places no outbound calls: the AI host only answers calls that Guests make to the Venue, so the TCPA rules on artificial or prerecorded voice calls (including the FCC's February 2024 ruling on AI voice) do not reach AIDA's voice channel. AIDA sends no SMS and no marketing texts; its outbound messages are transactional (booking confirmations, reminders, table-ready and waitlist updates) and go by WhatsApp and e-mail. A WhatsApp message is not an SMS, but the TCPA can reach automated text messages to a mobile number, so the transactional WhatsApp messages rely on the Guest's prior express consent, which providing the phone number in the booking flow gives for that visit. Only if a Venue later sends marketing texts (promotions, re-engagement, loyalty offers) through the Services does it need prior express written consent captured by an un-ticked opt-in box before any marketing message is sent, with STOP handling for US numbers. The Customer is responsible for that consent, and the opt-in box must then use the following wording, which the Customer may not weaken: "By checking this box, I agree to receive automated reservation updates and promotional text messages from [Restaurant Name] powered by PalmDine at the phone number provided. Consent is not a condition of purchase. Message and data rates may apply. Reply STOP to opt out."

5.3 Call recording. California, Connecticut, Florida, Illinois, Maryland, Massachusetts, Michigan, Montana, New Hampshire, Pennsylvania and Washington require the consent of all parties to record a call. A recorded notice at the very start of the call (for example "This call may be recorded or monitored by an AI assistant for quality and booking purposes") satisfies every US jurisdiction; continuing the call is consent. For Venues in those states, and for US Venues that have not recorded their state, the Services keep the notice on while recording is on; elsewhere in the US the Customer must keep it on. PalmDine's default US recording notice uses that wording.

5.4 Loyalty. An in-house points or rewards program is a "financial incentive" under the CCPA because personal information is collected in exchange for perks. Before a Guest enrols, the Customer must give a notice of financial incentive stating: a summary of the incentive; the material terms (how points are earned and redeemed); how to opt in; the right to withdraw at any time and how; and a good-faith estimate of the value of the Guest's data to the business with the method of calculation (Agreement clause 6.2(g)). The Customer enters the value estimate in the console; the Services show the notice and record each Guest's opt-in and withdrawal.

5.5 Biometric laws. AIDA processes voice audio only for real-time natural-language processing and transcription. It does not extract, process, store or use voiceprints, facial geometry or any other unique biological identifier for identification or authentication, so the Services fall outside the Illinois Biometric Information Privacy Act, the Texas Capture or Use of Biometric Identifier Act and Washington RCW 19.375. PalmDine will keep that boundary and states it in the AIDA Terms and Privacy Policy.

5.6 Automated decisions. The no-show reliability score is an informational tool for staff; staff make every seating and booking decision, and the score never denies a booking automatically (Agreement clause 9.3). It is therefore outside the high-risk automated-decision categories of the Colorado AI Act and the state privacy regulations. Deriving the score is profiling, so the Customer's privacy notice and PalmDine's Privacy Policy describe it in general terms; no high-risk notice is required while no booking is refused without human intervention.

5.7 Accessibility. PalmDine designs the guest apps to the WCAG 2.1 AA guidelines. The Customer remains responsible for the accessibility of the content it supplies through the Services (menu texts, images and their descriptions, its own notices), and for any accessibility duty its law places on it as the operator of the Venue.

5.8 Children under 13. The Services do not knowingly collect personal data online from children under 13. The Customer must not direct the guest apps or any sign-up to such children, and tells PalmDine at once if it learns that a child under 13 has created an account, so the account can be removed.