AIDA Data Processing Addendum

AIDA is a service of PalmDine AI - FZCO, a free zone company registered with the International Free Zone Authority (IFZA), Dubai, United Arab Emirates, licence number 62637 ("PalmDine"). PalmDine provides AIDA and is the contracting party to this addendum.

Document id dpa, version 1.0. Effective date: the date stated in the Legal Center on publication. This addendum forms part of the AIDA Master Subscription Agreement (https://www.myaidateam.com/legal/subscription-agreement) and is written to meet GDPR Art. 28, UK GDPR Art. 28, the UAE PDPL, the Qatar PDPPL and KVKK. Current and past versions: https://www.myaidateam.com/legal/dpa.

1. Scope and precedence

1.1 This DPA forms part of the AIDA Master Subscription Agreement (https://www.myaidateam.com/legal/subscription-agreement) between PalmDine and the Customer (the "Agreement"). Capitalised terms not defined here have the meaning in the Agreement.

1.2 It applies when PalmDine processes Customer Personal Data to provide the Services.

1.3 If this DPA conflicts with the Agreement on a point about personal data, this DPA prevails. If this DPA conflicts with incorporated transfer clauses (clause 11), the transfer clauses prevail.

1.4 In this DPA, Data Protection Law means every data-protection law that applies to the processing, including: the EU General Data Protection Regulation 2016/679 ("GDPR"); the UK GDPR and Data Protection Act 2018; the Swiss Federal Act on Data Protection ("FADP"); UAE Federal Decree-Law No. 45 of 2021 on the Protection of Personal Data ("PDPL"); Qatar Law No. 13 of 2016 on the Protection of Personal Data Privacy ("PDPPL"); Turkish Law No. 6698 on the Protection of Personal Data ("KVKK"); and US state privacy laws such as the California Consumer Privacy Act as amended ("CCPA"). Terms such as controller, processor, data subject, personal data breach and supervisory authority have the meaning given in the GDPR, or the nearest equivalent in the other laws (for example "data controller" and "data processor" in KVKK).

1.5 The details of the processing are in Annex A. The subprocessors are in Annex B. Country-specific terms are in Annex C.

1.6 This DPA is governed by the law that governs the Agreement, and disputes under it are resolved under clause 21 of the Agreement. The Standard Contractual Clauses, the UK Addendum and the Turkish standard contract are each governed by the law and forum they themselves specify, for the matters they cover, and prevail over this clause to that extent.

2. Roles of the parties

2.1 Customer as controller. The Customer is the controller of the personal data of its Guests, its staff and job candidates, and its business contacts, that it puts into or collects through the Services for its Venues. Where the Customer acts as processor for another controller (for example a franchisor or a group company), it confirms that the other controller has authorised its instructions, and PalmDine acts as its subprocessor.

2.2 PalmDine as processor. PalmDine processes Customer Personal Data as the Customer's processor, only to provide the Services under the Agreement.

2.3 PalmDine as independent controller. PalmDine is an independent controller, not the Customer's processor, for:

(a) platform accounts — the sign-in accounts of Authorised Users and PalmDine's own staff, including authentication and session records;

(b) security and audit logs — logs PalmDine keeps to secure the Services, detect abuse and investigate incidents, including the console audit trail and the permission audit;

(c) billing and account management — invoices, subscription records and the contact details of the Customer's representatives, including PalmDine's own business emails to them, and the invoicing and collection of the Fees through PalmDine's own Stripe account (Stripe acts there as PalmDine's processor, not as a subprocessor of Customer Personal Data);

(d) the guest platform account — the Guest's sign-in, saved preferences and saved payment references. PalmDine is the controller of the account; each Venue is an independent controller of the Guest's bookings, visits and orders at that Venue. A Venue's records are linked to the account only on the Guest's action, and the Guest may revoke the link at any time; revocation stops future synchronisation and leaves each party's own records where they are. Where a Venue requires Guests to sign in before ordering (Agreement clause 6.2(l)), signing in and sending the order is the Guest's action: the Guest's name and a shortened form of the Guest's phone number or email are added to the order for the Venue's staff, and PalmDine keeps, as controller, a private record linking the order to the account. PalmDine uses that record only to investigate misuse the Venue reports, and the Venue cannot read it. The name and shortened contact on the order, and the linking record, are removed when the order is anonymised or deleted and, if earlier, when the Guest deletes the account. Once shared, the Venue's copy is Customer Personal Data under this DPA; and

(e) service data described in Agreement clause 8.4.

PalmDine's processing as controller is described in the AIDA Privacy Policy, not in this DPA. The guest platform account is under PalmDine's independent control: the Guest decides which Venues receive a copy, and each Venue controls its copy.

2.4 Restaurant groups. Where the Customer switches on profile sharing across a restaurant group, the participating Venues decide together to share Guest profiles and are joint controllers of the shared profile. Which fields are shared is fixed by the platform and listed in Annex D. PalmDine processes the shared profile as processor for those Venues. The Venues may adopt the arrangement in Annex D by ticking group profile sharing in the Order Form, or make their own.

2.5 Payment providers. Guest payments run through the Customer's own connected account with Stripe or Square. For those payments the provider acts under its own agreement with the Customer (Annex B Part B); PalmDine's integration, which creates the payment customer record and initiates charges and refunds on the Customer's instructions, is processing on the Customer's behalf, and the provider is PalmDine's subprocessor only to that extent (Annex B Part A).

2.6 Labels in this clause do not override what the parties actually do. If a party starts to decide the purposes of processing described here as the other party's, it must tell the other party and the parties will update this DPA.

3. Customer instructions

3.1 PalmDine will process Customer Personal Data only on the Customer's documented instructions, unless the law requires otherwise. If the law requires otherwise, PalmDine will tell the Customer before processing, unless the law forbids it.

3.2 The Customer's documented instructions are:

(a) the Agreement and this DPA;

(b) the Customer's approved Configuration — the settings it chooses in the console for each Venue, including recording, AI disclosure, staff hand-over, allergy and dietary prompts, marketing consent, group sharing, loyalty and retention settings (Agreement clause 6.2). Setting changes are recorded in the audit trail;

(c) actions the Customer's Authorised Users take in the Services; and

(d) any other reasonable written instruction that the parties agree, which may carry a fee if it needs work beyond the Services.

3.3 PalmDine will tell the Customer promptly if, in its opinion, an instruction breaks Data Protection Law. PalmDine may suspend the affected processing until the Customer confirms or changes the instruction.

3.4 The Customer is responsible for the lawfulness of its instructions, for having a lawful basis for the processing, and for giving the notices and getting the consents that its processing requires.

3.5 PalmDine will not:

(a) sell or share Customer Personal Data, or use it for cross-context behavioural advertising;

(b) use Customer Personal Data for advertising, or use identifiable Customer Personal Data to train AI models, for PalmDine's own purposes;

(c) retain, use or disclose Customer Personal Data outside the direct business relationship with the Customer, or for any purpose other than the business purposes in Annex A; or

(d) combine Customer Personal Data with personal data PalmDine receives from another source, except as needed to provide the Services (for example the Guest-consented account link in clause 2.3(d)) or as the law allows.

4. Confidentiality

4.1 PalmDine will make sure that anyone it authorises to process Customer Personal Data is bound by a duty of confidentiality, by contract or by law.

4.2 PalmDine will give access to Customer Personal Data only to staff who need it for their role. Staff access to tenant data in the console goes through the permission model and is scoped to the venue. Super-admin access requires a second factor.

5. Security

5.1 PalmDine will implement appropriate technical and organisational measures to protect Customer Personal Data, taking into account the state of the art, the cost, the nature, scope, context and purposes of processing, and the risk to people (GDPR Art. 32).

5.2 The measures are summarised in the security schedule below and in Annex A §7.

5.3 PalmDine may change the measures, but will not reduce the overall level of protection during the Subscription Term.

Security schedule

6. Subprocessors

6.1 General authorisation. The Customer gives PalmDine general written authorisation to engage subprocessors. The subprocessors in use on the date of signature are listed in Annex B Part A.

6.2 Notice of changes. PalmDine will publish its current subprocessor list in the Legal Center and will give the Customer at least 30 days' notice, by email to the privacy contact in the Order Form and in the console, before it adds or replaces a subprocessor. The notice will say who the subprocessor is, what it does, what data it processes and where.

6.3 Right to object. If the Customer objects to a new subprocessor on reasonable, documented data-protection grounds within the notice period and PalmDine cannot offer a reasonable alternative within 30 days, the Customer may terminate the affected Module by notice, and PalmDine refunds the prepaid Fees for the remainder of the paid period for that Module. This is the Customer's sole remedy for the objection.

6.4 Emergency replacement. If PalmDine must replace a subprocessor urgently for security or continuity, it may do so with shorter notice, and the Customer's objection right then runs from the notice.

6.5 Flow-down. PalmDine will bind each subprocessor by a written contract with data-protection duties that are at least as protective as this DPA, to the extent they apply to the service it provides. For large cloud and platform providers, PalmDine relies on the provider's standard data-processing terms, which the Customer accepts as sufficient.

6.6 Liability. PalmDine remains liable to the Customer for its subprocessors' performance of their data-protection duties.

6.7 Customer-selected recipients are not subprocessors. Where the Customer connects a third-party system for its own purposes, such as a reservation system, point-of-sale system, delivery platform or its Google Business Profile, the data flows to that recipient on the Customer's instruction and under the Customer's own contract with it. PalmDine does not choose the recipient and does not engage it as its subprocessor. Annex B Part B lists these recipients.

7. Data-subject rights

7.1 Taking into account the nature of the processing, PalmDine will help the Customer, by appropriate technical and organisational measures and as far as possible, to respond to requests from data subjects to exercise their rights (access, correction, erasure, restriction, portability, objection, and withdrawal of consent, and the equivalent rights under PDPL, PDPPL, KVKK Art. 11 and US state laws).

7.2 The Services give the Customer these self-service tools today:

(a) guest record export to CSV;

(b) guest personal-data removal, which clears every field that names or describes the person, deletes stored photos and payment-provider customer references, and stops the next provider sync from re-importing notes;

(c) marketing suppression, honoured by the marketing send path, which no feature uses today because the Services send no marketing; and

(d) correction of guest profile fields in the console.

7.3 Where a request needs PalmDine's help beyond these tools, the Customer may ask dpo@palmdine.ai. PalmDine will follow its request casework process: verify authority, scope to the Customer's tenant, locate the data in every store, execute through reviewed operations, and report back, including any copies that remain for a lawful reason.

7.4 If PalmDine receives a request directly from a data subject about Customer Personal Data, it will pass it to the Customer without undue delay and will not answer it except to say it has passed it on, unless the Customer instructs otherwise or the law requires.

7.5 Erasure through the Services reaches PalmDine's live records, its analytics copies and the provider copies the Services can reach; edge devices and backups follow clause 12.3(d) to (f).

8. Personal-data breaches

8.1 PalmDine will notify the Customer without undue delay, and in any event within 48 hours, after becoming aware of a personal-data breach affecting Customer Personal Data. PalmDine becomes aware when it has a reasonable degree of certainty that a security incident has led to personal data being compromised, not on an unconfirmed alert.

8.2 The notice will go to the privacy and security contact in the Order Form. It will describe, as far as known at the time: the nature of the breach, the categories and approximate number of data subjects and records, the likely consequences, the measures taken or proposed, and a PalmDine contact. PalmDine will send further information as it becomes available.

8.3 PalmDine will take reasonable steps to contain the breach and limit its effects, and will preserve evidence.

8.4 The Customer, as controller, decides whether to notify supervisory authorities and data subjects. PalmDine will help it do so. PalmDine will not notify the Customer's regulators or Guests about the breach on the Customer's behalf without the Customer's agreement, unless the law requires PalmDine to.

8.5 Notice of a breach is not an admission of fault or liability.

9. Impact assessments and prior consultation

9.1 PalmDine will give the Customer reasonable help with data-protection impact assessments and prior consultation with supervisory authorities that the law requires for the Customer's use of the Services, by providing information about the Services that the Customer does not otherwise have.

9.2 PalmDine will keep available the documents most often needed for this: this DPA and its annexes, the security schedule and the subprocessor list.

9.3 Help beyond providing existing documents may carry a reasonable fee agreed in advance.

10. Records

10.1 PalmDine will keep a record of the categories of processing it carries out for the Customer, as GDPR Art. 30(2) and PDPL Art. 8(2) require, and will make it available to a supervisory authority on request.

11. International transfers

11.1 Where data is. Customer Personal Data is stored mainly in the EU (Netherlands and Belgium), with some processing in the United States and on the Google global AI endpoint (clause 5, Annex A §8). PalmDine is established in the UAE and its personnel access the data from the UAE and from other countries where they work.

11.2 Transfer mechanisms. The parties agree to the following mechanisms, which are incorporated by reference and form part of this DPA:

11.3 SCC choices. For the SCCs: the optional docking clause (Clause 7) applies; Clause 9(a) Option 2 (general authorisation) applies with the notice period in clause 6.2; the optional wording in Clause 11(a) does not apply; Clause 13 — the competent supervisory authority is the one determined under Clause 13(a) for the Customer; Clause 17 — Option 1, the law of Ireland; Clause 18 — the courts of Ireland. Annex I is Annex A; Annex II is the security schedule in clause 5 and Annex A §7; Annex III is Annex B.

11.4 Precedence. If this DPA or the Agreement conflicts with the SCCs, the UK Addendum or the KVKK standard contract, those clauses prevail. The Dubai arbitration clause in the Agreement does not apply to claims under them.

11.5 Transfer assessment. PalmDine maintains a transfer impact assessment for the access from the UAE and the United States described in clause 11.1 and provides it on request, together with the location table in Annex A §8 and Annex B.

11.6 Public-authority access requests. If PalmDine, or a subprocessor acting for it, receives a legally binding request from a public authority, court or law-enforcement body for access to Customer Personal Data, PalmDine will: (a) tell the Customer promptly, before disclosing where the law allows, and otherwise as soon as the prohibition lifts; (b) challenge the request where it has reasonable grounds to consider it unlawful, and disclose only the minimum required; (c) keep a record of every such request and its outcome for the Customer's review under clause 13; and (d) bind each subprocessor to the same duties towards PalmDine (clause 6.5). As at the effective date of this version, PalmDine has received no such request.

12. Return and deletion at the end of the Services

12.1 Export window. For 30 days after an Order Form ends (the "export window"), the Customer may export its Customer Data using the export tools in the Services, or ask PalmDine to provide an export in a commonly used machine-readable format.

12.2 Deletion. After the export window, PalmDine will delete Customer Personal Data from the live systems within 60 days, unless the law requires PalmDine to keep it or a legal hold applies. Deletion covers each retention class in Annex A §9 and produces a completion record the Customer may request.

12.3 What deletion covers. PalmDine will:

(a) delete or irreversibly anonymise Customer records in Firestore, Cloud Storage and BigQuery for the Customer's Venues;

(b) delete call recordings and avatar video for the Customer's Venues; recordings are in any case deleted after the period in Annex A §9;

(c) ask each subprocessor that holds a copy to delete it, or rely on its standard deletion schedule where the subprocessor does not keep data after processing;

(d) for edge devices, revoke the device credential and give the Customer instructions to wipe the device, which the Customer must carry out and confirm, or return the device to PalmDine for wiping. A disconnected device is not deleted until it is wiped;

(e) let edge backups expire under their 30-day lifecycle; and

(f) for other backups and platform logs, let them expire under their schedule and make sure deleted data is not restored to live use. The periods are: platform logs 90 days, Cloud Storage soft delete 7 days, edge backups 30 days (Annex A §9).

12.4 What PalmDine may keep. PalmDine may keep: data it holds as independent controller (clause 2.3); records it must keep by law, such as invoices; and a minimal record that the deletion happened. It will keep them only as long as needed and protect them under this DPA.

12.5 Confirmation. On request, PalmDine will confirm deletion in writing, listing anything kept and why.

13. Audits

13.1 PalmDine will make available to the Customer the information reasonably needed to show compliance with this DPA.

13.2 The Customer may audit PalmDine's compliance:

(a) once a year, on at least 30 days' written notice;

(b) after a personal-data breach affecting the Customer; or

(c) when a supervisory authority requires it.

13.3 PalmDine may meet an audit request first by providing written answers, documents, and any third-party reports or certifications it holds. The Customer may carry out an on-site or remote audit only if those do not reasonably answer its concerns.

13.4 Audits must be carried out during business hours, without undue disruption, by the Customer or an independent auditor bound by confidentiality who is not a PalmDine competitor. They may not give access to other customers' data or to PalmDine's security secrets.

13.5 Costs. Each party bears its own costs of an audit answered under clause 13.3 by written answers, documents and reports. For an on-site or remote audit under clause 13.4, the Customer bears PalmDine's reasonable, documented costs of preparing for and hosting it unless the audit finds a material breach of this DPA, in which case PalmDine bears them.

13.6 PalmDine's subprocessors are audited through their own reports and certifications (for example Google Cloud's and Stripe's), which PalmDine will pass on where their terms allow.

13.7 Certification. PalmDine holds no ISO 27001 certificate or SOC 2 report today. PalmDine will start a SOC 2 Type II engagement within twelve (12) months after its first Customer whose Order Form covers ten (10) or more Venues, and will offer the resulting report to Customers under clause 13.3 as the primary means of answering audit requests.

14. Liability

14.1 Each party's liability under or in connection with this DPA is subject to the limits and exclusions in the Agreement (Agreement clause 18), including the aggregate data-protection cap in Agreement clause 18.4 (two times the 12-month contract value). The Customer's indemnity under Agreement clause 19.2 for the matters that clause 18.4 excludes from the cap is not limited by this clause.

14.2 Nothing in this DPA limits either party's liability to data subjects under the SCCs or other transfer clauses, or liability that the law does not allow to be limited.

15. Term

15.1 This DPA lasts as long as PalmDine processes Customer Personal Data, including after the Agreement ends until deletion under clause 12 is complete.

16. Contacts