Data processing addendum.

What this addendum covers

This addendum forms part of the Terms between Hephon L.L.C-FZ ("tamr", the processor), a limited liability company licensed in the Meydan Free Zone, Dubai, United Arab Emirates under licence 2653412.01, and the restaurant that holds a tamr account ("you", the controller). It applies to personal data tamr processes on your behalf. It does not cover data tamr handles as a controller in its own right, such as your team's account and billing data or data used to keep the platform secure. Those are covered by our privacy policy.

Details of processing

Instructions and confidentiality

• tamr processes guest data only on your documented instructions. Your use of the product and your settings are those instructions.
• If we believe an instruction breaks data protection law, we will tell you.
• Everyone at tamr who can access the data is bound by confidentiality.
• We do not sell guest data or use it for our own advertising.

Security measures

tamr keeps technical and organisational measures in place to protect the data, including encryption in transit, encrypted backups, isolation of each restaurant's data, role-based access and audit logging. The current measures are described on our security page.

Subprocessors

You authorise tamr to use the subprocessors on our subprocessors page. We bind each one to data protection terms that are at least as protective as this addendum, and remain responsible for them. We give you at least 30 days' notice, by email to your account owners and on the subprocessors page, before a new or replacement subprocessor starts handling guest data. If you object on reasonable data protection grounds within those 30 days, we will work with you to find a change that avoids the new subprocessor for your restaurant. Where we cannot, you may terminate the affected part of the service without penalty and receive a pro rata refund of any fees paid in advance.

Helping with guest requests

We help you respond to guests who exercise their rights under data protection law.

• Guests can delete their own taste profile, conversations and sessions at your restaurant with Forget me in the chat.
• You can set retention windows and turn on redaction of phone numbers and emails in Settings, Privacy.
• For access, export or other requests, email [email protected] and we will help you find and export or delete the data.
• If a guest contacts us directly, we will pass the request to you.

We also give reasonable help with data protection impact assessments and consultations with authorities.

Personal data breaches

If we become aware of a personal data breach affecting your guest data, we will notify you without undue delay and in any event within 24 hours of becoming aware, at the security contact you give us. That first notice carries what we know at the time: what happened, when, the categories and approximate volume of data involved, the likely consequences and the steps we are taking. We follow it with a fuller written report within 72 hours, and keep you updated until the incident is closed. We will not delay telling you because an investigation is still open. Report anything you suspect to [email protected].

Deletion at the end

When you delete your restaurant or your account, we delete the guest data we process for you, including uploaded files. You can export data before you leave, at any time and without asking us, from Settings, Privacy. If you ask us in writing within 30 days of termination, we will return a complete copy of your guest data in a machine-readable format (JSON, with menus and reports also available as CSV or XLSX) at no charge, and we will not delete it until we have. Otherwise live data is deleted within 30 days of termination. Copies in our encrypted backups expire within about 4 weeks after that, on the ordinary backup rotation. We keep data longer only where the law requires it, and it stays encrypted and out of use until it expires. We confirm deletion in writing on request.

Audits

We make available the information you reasonably need to show that this addendum is being followed, and allow audits by you or an independent auditor you appoint and we do not reasonably object to.

• How often: once in any 12 month period, and additionally after a personal data breach affecting your data or where a regulator requires it.
• Notice: at least 30 days in writing, with the scope set out. Audits happen during business hours and must not unreasonably disrupt the service.
• How: we answer a security questionnaire and share our current documentation first. Where that does not reasonably answer your question, we agree a remote session covering the environment your data sits in, and an on-site audit where remote review is genuinely insufficient.
• Limits: tamr is multi-tenant, so an audit cannot extend to other customers' data, and your auditor signs a confidentiality undertaking before it begins. We will not give live access to shared production infrastructure; we will evidence controls against it.
• Cost: each party bears its own costs for the annual audit. You bear our reasonable costs for any additional audit you request in the same period, unless it follows a breach we caused or it finds a material breach of this addendum, in which case we bear them.

International transfers

Guest data is stored and processed on our servers in Amsterdam, Netherlands. It is not moved to another region for storage. tamr is operated by Hephon L.L.C-FZ in the United Arab Emirates, and our support and engineering personnel, who are located in the United Arab Emirates and Lebanon, may access it remotely to run and support the service. That remote access is itself a transfer, so we are explicit about it: it is limited to named staff, role-based, logged in an audit trail you can request, and covered by confidentiality undertakings.

Neither the United Arab Emirates nor Lebanon benefits from a European Commission adequacy decision, so where the GDPR applies we rely on the Standard Contractual Clauses (Commission Implementing Decision 2021/914, controller to processor), which form part of the signed addendum, together with the technical measures described above: encryption in transit and at rest, tenant isolation, least-privilege access and audit logging. For restaurants in the GCC, the same terms are offered under the applicable local data protection law, including Qatar's Law 13 of 2016 and the UAE Federal Decree-Law 45 of 2021. We will sign your own transfer addendum where you need one.

Getting the signed DPA

This page is a summary. A full data processing addendum, ready to sign, is available on request.