Data Processing Agreement

1. Parties, incorporation and purpose

This Data Processing Agreement (DPA) governs the processing of personal data by World Travel Club s.r.o., company identification number (IČO) 07214073, with its registered office at Ostrčilovo náměstí 462/4, Nusle, 128 00 Praha 2, Czech Republic (the Company or MenuAI), on behalf of the business customer identified in the applicable subscription order or service agreement (the Customer). The Company’s data protection contact is team@menuai.pro.

The DPA forms part of the agreement for the MenuAI services when validly incorporated and accepted by an authorised representative of each party, including through an agreed electronic contracting process. The customer identity, relevant services and acceptance record must be ascertainable from that agreement. Publication of this page or a guest’s visit alone does not conclude a processing agreement for every venue.

The purpose is to establish the binding conditions required for processing on the Customer’s behalf under Article 28 of Regulation (EU) 2016/679 (GDPR) and applicable data protection law. The annexes below form part of the DPA. Particular service details and the confidential processing record described in Annex 3 supplement it without removing mandatory protections.

The Customer must ensure that the person accepting the DPA has authority for the relevant business and processing. A separate legal entity is not automatically bound merely because it belongs to the same group or uses a shared brand. Additional entities must be covered by a valid contractual arrangement and the necessary instructions.

2. Definitions

Terms defined in applicable data protection law retain their statutory meaning. The following expressions identify the scope of this DPA; a contractual label cannot change the parties’ actual legal roles.

• Agreement means the accepted subscription order, service agreement and properly incorporated terms governing the Customer’s use of MenuAI.
• Customer Personal Data means personal data processed by the Company on the Customer’s behalf within the contracted services and lawful instructions. It does not automatically include every record for which the Company independently acts as controller.
• Controller means the person or organisation determining the purposes and essential means of processing. Processor means a separate person or organisation processing personal data on a controller’s behalf.
• Processing includes the operations defined by law, such as collection, recording, organisation, storage, retrieval, consultation, use, transmission, restriction, return and erasure.
• Data subject means an identified or identifiable individual to whom the personal data relates, including a guest or another individual within the agreed processing scope.
• Documented instructions means lawful directions recorded in the Agreement, this DPA, agreed service settings or another attributable written or electronic communication from an authorised Customer representative.
• Subprocessor means a further processor engaged by the Company to carry out specified processing activities on the Customer’s behalf. An independent controller or a service contracted directly by the Customer is not automatically the Company’s subprocessor.
• Personal data breach means a breach of security leading to accidental or unlawful destruction, loss, alteration, unauthorised disclosure of or access to personal data processed under this DPA.
• Applicable data protection law means the GDPR and other binding Union or Member State data protection provisions relevant to the processing; additional mandatory local requirements apply where their conditions are met.

3. Roles and separation of purposes

For the processing described in Annex 1, the Customer acts as controller and the Company as processor. Where the Customer lawfully acts as processor for another controller, the Company acts as its subprocessor for that processing, and the Customer must obtain the upstream authority and transmit the applicable lawful instructions. This does not authorise either party to disregard obligations owed to that controller.

The Company’s own controller activities, such as administering its subscription and business relationship, meeting its accounting obligations or handling its own enquiries, are governed by applicable law and the Privacy Policy. A security or usage record must be allocated according to its actual purpose; not all information originating in a guest interaction belongs automatically to either role.

The Company must not use Customer Personal Data for unrelated advertising, sale, cross-venue reuse or training general-purpose models. Guest information entrusted for a venue is to be used to serve the relevant venue and guest within lawful instructions. A licence to Customer Content or a statement about improving services does not expand these processing purposes.

The DPA does not by itself establish joint controllership. If the parties actually jointly determine a processing purpose and essential means, they must assess and document the legally required arrangement for that activity. An independent purpose cannot be hidden inside a processor instruction or imposed merely by changing a privacy notice.

4. Documented instructions and unlawful directions

The Company shall process Customer Personal Data only on documented instructions, including instructions concerning transfers to a third country or international organisation, unless required to do otherwise by Union or Member State law applicable to the Company. In that case, it shall inform the Customer of the legal requirement before processing unless that law prohibits such information on important grounds of public interest.

The initial instructions are to provide the contracted functions, handle the Customer’s authorised interactions and carry out the operations in Annex 1, subject to this DPA. Choosing a function authorises only the processing reasonably within its communicated purpose and scope. It is not unlimited authority to collect additional data, appoint undisclosed recipients or introduce a new purpose.

Additional instructions may be sent through the agreed account or support channel by an authorised representative. The parties shall record any change that affects scope, security, transfers, retention or the applicable charges. A lawful mandatory request must not be delayed merely because its format differs from an optional service workflow.

The Company shall immediately inform the Customer if, in its opinion, an instruction infringes the GDPR or other Union or Member State data protection provisions. It may suspend the affected instruction while the issue is clarified, with the least disruption consistent with law and protection of individuals. It shall not knowingly carry out an unlawful instruction or silently substitute its own unrelated purpose.

If an instruction cannot be performed within the agreed service, the Company shall explain the issue and the parties shall consider a lawful alternative or appropriate amendment. This does not remove a duty that already applies under law or this DPA. The record of instructions and changes must remain available to demonstrate the processing authority.

5. The Customer’s responsibilities and rights

The Customer is responsible for the lawfulness of the purposes it determines, the data it provides and its instructions. It shall establish the relevant lawful grounds, give required information to individuals, respect applicable consent and device-access requirements and maintain the records and policies required for its processing.

The Customer shall limit data to what is needed for the contracted functions, keep information reasonably accurate and determine lawful retention instructions. It shall assign access to authorised persons, keep its contact and incident details current and promptly tell the Company of an account compromise or instruction error relevant to Customer Personal Data.

The Customer must assess any additional condition for special-category data, children’s information or a high-risk use. Contractual necessity alone does not satisfy a special-category condition. The Company may request clarification or decline an unagreed use that cannot be provided lawfully and with appropriate safeguards.

The Customer retains the right to issue lawful instructions, receive the information needed to assess the processor, object to proposed subprocessors under this DPA, obtain assistance and conduct lawful audits. Allocating controller duties to the Customer does not waive these rights or remove the Company’s own processor obligations.

6. Subject matter, duration and limits

The subject matter is processing needed to provide the MenuAI functions ordered by the Customer for its venue and guest relationships. Annex 1 specifies the nature, purposes, categories of individuals and data. The actual enabled services and lawful instructions narrow that description; the annex does not require every category to be collected for every guest.

Processing continues for the period of the contracted service and thereafter only to return, delete or lawfully retain data as provided in this DPA. Ending paid access does not by itself prove that every copy has been erased, and an unresolved instruction does not justify indefinite retention.

The Company shall not expand the processing to an incompatible new purpose or materially different data category merely because storage is available. A proposed material change must be documented and assessed for legal grounds, security, transfer safeguards and any additional agreement needed before it begins.

Instructions to anonymise data must define a lawful purpose and appropriate method. Removing a direct identifier or replacing it with a code is not necessarily anonymisation. Until data is genuinely anonymous under applicable law, the protections and limitations of this DPA continue to apply.

7. Confidentiality and authorised personnel

The Company shall ensure that persons authorised to process Customer Personal Data are bound by an appropriate contractual or statutory duty of confidentiality. Access shall be limited to the persons and purposes needed to provide the agreed service, protect the processing or fulfil an applicable lawful obligation.

Personnel shall receive instructions appropriate to their responsibilities, including the handling of personal data, access credentials and suspected incidents. Authorisation must be reviewed when responsibilities change and withdrawn when it is no longer justified. Confidentiality duties survive the end of the person’s access to the extent required by their nature and law.

Customer Personal Data shall not be disclosed merely because a recipient participates in a referral programme, is a prospective customer or requests a demonstration. Support and verification must not request unnecessary sensitive information or use a live guest record for an unrelated purpose.

Confidentiality also protects the parties’ non-public compliance and security information. It does not prevent lawful disclosure to individuals, independent auditors, advisers or competent authorities where required or permitted by applicable law and subject to appropriate safeguards. It cannot be used to conceal a breach or deny a mandatory right.

8. Technical and organisational security obligations

The Company shall implement and maintain appropriate technical and organisational measures for Customer Personal Data in accordance with Article 32 GDPR. Measures shall take account of the state of the art, implementation costs, the nature, scope, context and purposes of processing and the likelihood and severity of risks to individuals. Annex 2 sets the contractual control requirements for the covered services.

The measures must address confidentiality, integrity, availability and resilience; appropriate protection of data in transit and storage; the ability to restore access following an incident; and a process for regularly assessing their effectiveness. Encryption and pseudonymisation shall be used where appropriate to the risk, without representing a blanket guarantee that all data in every context has a particular implementation.

Before entrusting processing, the Customer must receive the information reasonably necessary to evaluate the applicable safeguards and any agreed service-specific requirements. Detailed evidence may be supplied through a protected channel under confidentiality. A general security description is not a certificate, an independent audit opinion or a guarantee that every conceivable incident is impossible.

The Company may update measures to reflect risks and service changes, but shall not materially reduce the agreed level of protection for the covered processing. A material change affecting the Customer’s assessment must be communicated as required by the Agreement and law. The Customer remains responsible for the devices, access assignments and other safeguards within its own control.

9. General written authorisation of subprocessors

Subject to this section and the change procedure below, the Customer gives general written authorisation for the Company to engage subprocessors identified in the current confidential register supplied to the Customer before the relevant processing begins. The register forms part of the processing record in Annex 3. This authorisation becomes effective through valid acceptance of the DPA with that information available; it is not approval of an undisclosed provider.

The register shall identify each relevant legal entity, its processing task, processing locations including relevant remote access, and the applicable transfer arrangement where required. The Company shall provide sufficient information to assess the proposed processing. A generic category such as service provider is not a substitute for the identity of a proposed subprocessor when that information is required for authorisation.

Before giving a subprocessor access, the Company shall assess its sufficient guarantees and bind it by a written agreement imposing the same relevant data protection obligations as this DPA, including appropriate security, confidentiality, assistance, deletion and audit cooperation. The Company remains fully liable to the Customer for the subprocessor’s performance of those obligations as required by Article 28(4) GDPR.

The register may be delivered through an agreed protected business channel rather than published with the public DPA. Commercial confidentiality does not override the Customer’s entitlement to that information, an individual’s statutory information rights or a competent authority’s lawful powers. The Company must ensure that relevant onward subprocessing is covered by the required authorisations and equivalent obligations.

10. Changes, notice and objections to subprocessors

The Company shall actively notify the Customer in writing of an intended addition or replacement of a subprocessor at least 30 calendar days before the proposed new processing begins. The notice shall identify the entity, task, relevant locations, proposed start and safeguards needed for a meaningful assessment. Merely changing an unannounced register does not satisfy this notice obligation.

The Customer may object during the notice period on reasonable grounds relating to the protection of Customer Personal Data, explaining the concern with sufficient detail. The parties shall cooperate in good faith to address it, for example through additional safeguards or a feasible alternative. The Company shall not start the disputed new processing for that Customer before the objection is resolved by agreement or another lawful arrangement.

If no satisfactory lawful solution can be agreed, the parties shall address the affected service, including suspension or termination where necessary, and reconcile prepaid service amounts and other consequences under the Agreement and mandatory law. The Customer shall not be forced to accept an unlawful transfer or undisclosed processor merely to obtain the return or deletion of its data.

Where the Customer has given general written authorisation and does not object within the notified period, the proposed engagement may proceed within that authorisation, subject to all other legal requirements. This is not consent from a data subject or a waiver of a later substantiated legal concern. An earlier start requires specific written authorisation or another binding legal requirement that lawfully permits it; urgency alone does not silently remove the 30-day rule.

The Customer shall maintain a current business contact for these notices. The Company shall keep a record of the notice, authorisation, any objection and its resolution, and make the current applicable register available to the Customer on request.

11. Locations and international transfers

The Company shall process Customer Personal Data in the locations documented for the agreed service and authorised subprocessors. Access from another country must be considered when assessing a transfer; describing a storage location alone is not a complete transfer assessment. This DPA does not promise that all processing or access is confined to the European Economic Area.

A transfer subject to Chapter V GDPR shall occur only on lawful documented instructions and with an applicable transfer basis. Depending on the circumstances, this may be an applicable adequacy decision or appropriate safeguards, including the correct European Commission Standard Contractual Clauses, together with the required assessment and supplementary measures.

Where standard clauses or an additional local transfer instrument are needed, the relevant parties, module, annex information and safeguards must be completed and validly incorporated before the transfer. Publication of this DPA does not by itself execute every possible transfer instrument, constitute a transfer impact assessment or authorise a blanket derogation.

The Company shall provide information reasonably needed for the Customer’s transfer assessment and inform it if a relevant legal change or recipient circumstance prevents compliance with the agreed safeguards. The affected transfer must be suspended or remedied where law requires; a general permission to use subprocessors cannot override those requirements.

Applicable mandatory transfer clauses prevail in the event of a conflict. A request for information may be handled through a protected channel with lawful redactions, but not in a way that prevents the Customer from assessing the actual transfer or exercising a mandatory right.

12. Assistance with individuals’ rights

Taking account of the nature of processing, the Company shall assist the Customer by appropriate technical and organisational measures, insofar as possible, in responding to requests under Chapter III GDPR. This includes reasonable help to locate, access, correct, restrict, return or erase the relevant Customer Personal Data and to provide portability where the legal conditions are met.

If the Company receives a request relating to processing on the Customer’s behalf, it shall forward it to the Customer without undue delay and shall not decide the substantive response on the Customer’s behalf unless authorised by documented instructions or required by applicable law. Where a request also concerns the Company’s independent controller activity, it shall handle that part under its own legal duties.

The Customer is responsible for assessing the request, verifying authority where needed and giving lawful response instructions. The Company shall communicate any limitations affecting its assistance and provide available relevant information in time to support the statutory response. The need for cooperation does not extend a legal deadline automatically.

Verification and response channels must protect the individual and the data of others. The parties shall avoid collecting unnecessary identity evidence, sending full guest records to an unverified requester or treating every erasure request as permission to delete unrelated records. Any lawful refusal, retention exception or restriction must be explained by the responsible party as required by law.

13. Personal data breaches and incident cooperation

The Company shall notify the Customer without undue delay after becoming aware of a personal data breach affecting Customer Personal Data. Initial notice shall be sent to the designated business or incident contact, with an additional agreed urgent channel where available. The Company shall not wait for a complete investigation before providing the information already available.

The notice shall describe, to the extent known, the nature of the breach, relevant categories and approximate numbers of individuals and records, likely consequences, measures taken or proposed to contain and remedy it, and a contact for follow-up. If details cannot be supplied together, they shall be provided in phases without undue further delay, distinguishing established facts from matters still under investigation.

The Company shall take reasonable measures to contain the breach, protect affected data, preserve relevant evidence and cooperate with the Customer’s assessment, required notifications and remedial actions. It shall maintain an appropriate incident record and provide relevant updates. Cooperation must not unnecessarily expose other customers’ data or compromise a lawful investigation.

The Customer remains responsible for its controller decisions on notifying a supervisory authority or affected individuals, unless law assigns a duty directly to the Company. The controller’s applicable notification period, including the GDPR’s 72-hour framework where relevant, is not a permission for the processor to delay its own notice for that period. No unagreed fixed-hour incident service level is implied.

The Company shall not publish a notification on the Customer’s behalf without authority unless required by law. Neither notification nor cooperation is by itself an admission of liability, and that qualification does not remove any statutory duty or affected person’s remedy. Suspected incidents may be reported to team@menuai.pro without sending credentials or unnecessary sensitive material.

14. Security assessments, impact assessments and consultation

Taking account of the nature of processing and the information available to it, the Company shall assist the Customer in ensuring compliance with Articles 32 to 36 GDPR. Assistance includes relevant information about the agreed processing, safeguards, risks, incidents, subprocessors and transfers needed for the Customer’s assessment.

Where the Customer must carry out a data protection impact assessment or consult a supervisory authority, it shall identify the proposed activity and reasonably specify the information needed from the Company. The Company shall supply available relevant information and cooperate appropriately; it does not assume the Customer’s decision-making role or certify the lawfulness of every proposed business use.

An assessment identifying an unaddressed high risk must be resolved through appropriate measures and any legally required consultation before the affected activity begins. A service setting or a signed DPA does not substitute for that assessment. The Company shall communicate material limitations in its ability to support a proposed use rather than provide an unsupported assurance.

Assistance shall be arranged through the agreed business contact with appropriate confidentiality and sufficient urgency for the legal obligation concerned. Any separately agreed charge must follow the fees section and must not be used to defeat mandatory cooperation.

15. Information, audits and inspections

The Company shall make available all information necessary to demonstrate compliance with its Article 28 obligations and allow for and contribute to audits, including inspections, by the Customer or an auditor mandated by it. Evidence may include relevant policies, processing records, control descriptions, answers and existing independent reports where such reports actually exist.

The parties shall first consider whether appropriate documentary evidence can answer the request. That is a practical starting point, not a replacement for an inspection that is reasonably necessary or required by law. The DPA does not claim a particular certification, require the Customer to accept a nonexistent report or impose a universal once-per-year limit on all lawful audits.

For a planned inspection, the parties shall agree reasonable notice, scope, timing, confidentiality and protective arrangements to reduce avoidable disruption. Urgent incidents, a competent authority’s requirement or evidence of material noncompliance may justify a shorter notice or additional review. The Company shall not use scheduling to obstruct a time-sensitive legal obligation.

An auditor must act independently, respect confidentiality and access only what is relevant to the covered processing. Protection of other customers, credentials and unrelated proprietary materials may require controlled access or redaction, but shall not prevent an effective examination of the Company’s obligations. No clause grants a right to perform intrusive testing without an agreed safe method.

The Company shall address substantiated findings relating to its obligations and cooperate in documenting proportionate corrective measures. The audit process and any charges must not remove a regulator’s powers, an individual’s rights or the Company’s duty to supply necessary compliance information.

16. Authorities and legally required disclosure

The Company shall cooperate with competent supervisory authorities as required by applicable law. If it receives a binding demand affecting Customer Personal Data, it shall assess the legal basis and scope, disclose no more than lawfully required and inform the Customer where and when permitted.

Where a demand appears unlawful or disproportionate, the Company shall consider available lawful challenges and protective measures appropriate to the circumstances. This is not a promise to disobey a binding order or to guarantee that no authority will ever seek access.

A legal prohibition on notice shall be respected only to its applicable extent. The Company shall retain an appropriate record and provide information later where permitted and required. Government access and a transfer subject to Chapter V must also be handled consistently with any binding transfer clauses.

Neither party may use this DPA’s confidentiality provisions to obstruct a lawful complaint, mandatory transparency or an authority’s investigation. Any disclosure by the Customer of the Company’s non-public evidence should likewise be limited to the lawful purpose and protected where appropriate.

17. Return, deletion and lawful retention

At the Customer’s choice, the Company shall return or delete Customer Personal Data after the end of the relevant processing services and delete existing copies, unless Union or Member State law requires storage. The Customer should communicate its choice before access ends where practicable. The Company shall contact the Customer for clarification if an instruction is missing or inconsistent, rather than assume unlimited permission to retain the data.

The parties shall record the return scope, an appropriate commonly used format where reasonably available, a protected delivery method and a completion timetable suited to the actual service and lawful instructions. Performance shall occur without undue delay; a claimed operational difficulty must be explained and must not become an indefinite retention exception. The DPA does not promise an unverified self-service export tool or universal recovery window.

A request to close an account or removal of information from an active interface is not itself proof of complete erasure. The Company shall address active data and retained copies within the agreed lawful deletion process and provide confirmation of completion on request, identifying any remaining lawful exception.

Where a protected recovery copy cannot be individually altered immediately, the Company shall explain the applicable retention and deletion cycle, restrict its use to necessary recovery or legal purposes and ensure that an erasure or restriction is reapplied if data is restored. This arrangement must not override the required deletion of copies or justify retaining them longer than necessary.

Data that must be retained under applicable law shall remain protected and be processed only for the lawful retention purpose. The Company shall identify the relevant requirement and period or criteria to the extent permitted. Own-controller accounting records must be distinguished from Customer Personal Data retained merely on the Customer’s behalf.

18. Suspension and termination of affected processing

If a party cannot comply with this DPA, it shall inform the other without undue delay to the extent permitted by law. Affected processing must be suspended where necessary to prevent unlawful processing or protect individuals while a compliant solution is considered.

A material unresolved breach, unlawful instruction or inability to maintain a necessary safeguard may justify termination of the affected processing or service under the Agreement and law. The parties shall address the relevant facts, required notice and opportunity to remedy where applicable. A dispute about optional commercial scope must not be used to bypass a mandatory data protection duty.

Ending or restricting the service does not automatically cancel the Company’s confidentiality, incident, assistance or return and deletion obligations. The Company shall continue the protection needed for data it still lawfully holds and shall not withhold a mandatory response or return solely to force acceptance of a new processor or unrelated term.

The financial consequences follow the Agreement and applicable law, without removing a refund or other remedy already due. Termination does not authorise use of Customer Personal Data for a new independent purpose.

19. Assistance costs and responsibility

Each party remains responsible for the obligations assigned to it by law and this DPA. The commercial allocation of liability in the Agreement applies only to the extent lawful and compatible with binding data protection requirements and any applicable transfer clauses. This DPA does not create an automatic indemnity for the Company’s own fault.

No contractual limit restricts an individual’s non-excludable rights, the powers of a supervisory authority or a liability that law prohibits limiting. Any statutory allocation of compensation or recourse between responsible parties remains subject to the applicable legal conditions. The Customer’s acceptance of a subprocessor does not remove the Company’s responsibility for it under Article 28(4).

Ordinary assistance and compliance information required by the agreed processing must not be made illusory through undisclosed fees. If the Customer requests additional work outside an already included contractual or statutory duty, any proposed charge and scope must be explained and accepted in advance. A cost discussion must not delay an urgent mandatory notification or prevent the exercise of a statutory right.

Each party shall provide reasonable cooperation and take lawful measures to reduce harm. No clause requires double recovery for the same damage, guarantees that all claims will succeed or removes a defence preserved by mandatory law.

20. Document priority and applicable law

For its specific subject matter of processing on the Customer’s behalf, this DPA prevails over a conflicting general provision of the Agreement. Binding standard transfer clauses and mandatory data protection law prevail to the extent required by their terms and law. A marketing description or unilateral account label cannot override these obligations.

The DPA is governed by the law of the Czech Republic, subject to applicable conflict-of-law rules and mandatory provisions. The competent courts in Prague have jurisdiction for contractual disputes to the extent the Agreement’s jurisdiction arrangement is valid and permitted by law.

That arrangement does not restrict an individual’s statutory complaint or judicial route, a supervisory authority’s competence or a binding forum provision in an applicable transfer instrument. The parties may seek to resolve a contractual issue by written discussion without making such discussion a barrier to urgent protection or a statutory deadline.

If a provision is invalid or unenforceable, the effect on the rest of the DPA is determined by law. A broad confidentiality or limitation clause must not be interpreted to remove an otherwise mandatory processing obligation.

21. Changes and ongoing compliance

Changes must be documented through a valid contractual process and made available to the Customer. A new version on a public webpage does not retrospectively authorise earlier processing, remove a recorded instruction or change an existing accepted DPA merely because the Customer continues to use a service.

An update to keep safeguards effective or meet a binding legal requirement must respect the agreed protection and any applicable notice or acceptance requirement. Changes to subprocessors follow the specific 30-calendar-day procedure; publication of a revised DPA is not a substitute for that notice.

The parties shall keep the processing description, contacts, instructions, locations and confidential register reasonably current. A proposed extension to a new high-risk activity must be assessed and documented before it begins rather than treated as already covered by a broad description of platform services.

Obligations concerning retained data, confidentiality, assistance, audit evidence and lawful return or deletion survive for as long as they remain applicable. Neither party’s failure to enforce a right immediately is by itself a waiver of a mandatory obligation.

22. Contacts and language versions

Send DPA questions, documented instructions, incident reports and requests for the applicable confidential processing record to team@menuai.pro. The Company is World Travel Club s.r.o., IČO 07214073, Ostrčilovo náměstí 462/4, Nusle, 128 00 Praha 2, Czech Republic. No separate Data Protection Officer has been appointed; this contact handles the relevant correspondence.

The Customer’s authorised contact and any incident channel are those recorded in the Agreement or a subsequent valid instruction. Each party shall keep its details current and use a channel appropriate to the urgency and sensitivity of the information. Instructions and delivery of confidential evidence may require proportionate verification of authority.

The English and Ukrainian versions are intended to express equivalent rights and obligations. No overriding language priority is introduced by this DPA. A discrepancy shall be addressed under the applicable interpretation rules without restricting mandatory rights.

Public availability of the DPA does not require publication of proprietary implementation details. Necessary compliance evidence and recipient information shall nevertheless be supplied to entitled parties through an appropriate lawful process. Commercial confidentiality is not a blanket exception to the transparency, authorisation or audit obligations above.

Annex 1. Description of the entrusted processing

Subject matter and purpose: provision of the MenuAI functions ordered for the Customer’s venue, including handling guest interactions, orders, reservations, events, delivery and loyalty where included. Processing serves the corresponding venue and guest on the Customer’s lawful instructions; it does not include an independent cross-venue training or advertising purpose.

Nature and operations: collection of information supplied through the relevant function; recording, organisation, storage, retrieval and display to authorised users; handling of an instruction or guest request; necessary communication to an authorised recipient; correction, restriction, return and deletion. The operations and disclosures must remain within the particular enabled service.

Duration and frequency: during the contracted processing service as information is supplied and functions are used, followed only by the return, deletion or legally required restricted retention described in section 17. The Customer’s lawful retention instructions and any service-specific completion timetable are recorded in the applicable processing record.

The following categories apply only insofar as the Customer actually provides or instructs their processing for an ordered function. Their inclusion is not an instruction to collect all such information or to require every guest to create an account.

• Individuals: guests and customers of the relevant venue; people making or attending a reservation, event or delivery; individuals represented in an authorised booking; and staff or other business contacts whose information the Customer enters into its operational records. The Company’s independent account administration is distinguished from this entrusted processing.
• Identification and contact: names, contact details, venue-associated guest or customer references and information needed to communicate about a requested service. A postal or delivery address is included only where needed for that service.
• Orders and transactions: selected items, quantities, amounts, order status, booking or event details, delivery instructions and payment status or transaction references supplied through authorised arrangements. This description is not an instruction to store full card numbers or card security codes in ordinary platform fields.
• Relationships and preferences: venue-specific visit or loyalty information, points or rewards, selected language, feedback, stated preferences and date-of-birth or birthday information where lawfully supplied for an enabled purpose. Optional information must remain subject to data minimisation and the Customer’s lawful grounds.
• Service-related technical information: identifiers, access or activity records and communications needed to provide, protect or support the entrusted function, only insofar as the Company processes them on the Customer’s behalf. Records used for an independent Company purpose require a separate role assessment.
• Potential special categories: allergy or dietary information and free-text requests may reveal health, religion or other protected characteristics. Such information may be processed only where the Customer has established both an Article 6 ground and the applicable Article 9 condition, has given lawful instructions and appropriate safeguards are in place. No general permission for unrelated sensitive information or criminal-conviction data is granted.

For special-category or children’s information, safeguards shall include minimising fields and free text, limiting access to those serving the relevant need, avoiding unnecessary disclosure, applying suitable retention and supporting correction or deletion. The Customer must identify an additional protection requirement before use; the Company must not accept an unsupported high-risk activity merely because a text field can receive it.

Annex 2. Required security controls

The following are contractual requirements for the covered processing, applied in a manner appropriate to the documented risk. They describe protection outcomes and responsibilities without exposing proprietary implementation. They do not constitute an attestation that a particular certification, independent audit, recovery time or implementation is in place. The Customer is entitled to the information needed to evaluate the measures before entrusting data.

• Governance and confidentiality: assign responsibility for data protection and security, issue appropriate handling instructions, bind authorised personnel to confidentiality and review their access and relevant awareness needs.
• Access control: identify authorised users, protect authentication and credential recovery, apply access appropriate to the person’s role and task, and withdraw access when it is no longer justified. Privileged access requires protection proportionate to its impact.
• Separation of customer information: restrict access to the authorised customer and venue context and prevent ordinary access to another customer’s records. Support or administrative access must have an authorised purpose and suitable oversight.
• Transmission and storage: protect personal data against unauthorised access or alteration during communication and storage using risk-appropriate safeguards, including encryption where appropriate, and protect credentials or other security-sensitive material from disclosure.
• Data minimisation and handling: limit collection, copies, disclosures and retention to the instructed purpose; avoid unnecessary personal data in diagnostic material; and protect information supplied for support or verification.
• Operational integrity: manage relevant configuration and changes, address identified vulnerabilities with urgency proportionate to risk, and assess changes that could materially affect the agreed protection. Do not use customer records for unrelated testing or demonstrations.
• Activity evidence and detection: retain proportionate evidence of security-relevant access and significant actions where needed to detect, investigate and demonstrate compliance, while limiting access to those records and avoiding unnecessary sensitive content.
• Availability and recovery: maintain arrangements appropriate to the service and risks for resilience, protected recovery copies where necessary, and restoration of availability and access following an incident. Recovery arrangements must be assessed and tested at suitable intervals; no unagreed numerical recovery target is created.
• Incident response: provide a means to receive concerns, assess suspected incidents, contain breaches, preserve relevant evidence and notify and assist the Customer under section 13. A final investigation report is not a prerequisite for initial breach notification.
• Retention and disposal: apply lawful instructions for restriction, return and deletion, control residual recovery copies and prevent restored information from bypassing a valid erasure or restriction. Disposal must address the relevant copies rather than only a visible account label.
• Supplier oversight: evaluate relevant subprocessors, impose equivalent obligations, maintain the authorisation and location record and assess changes or transfer risks before the new processing begins.
• Review and evidence: regularly assess the effectiveness of relevant controls, record material findings and corrective measures, and supply the compliance information and audit cooperation required by this DPA. Any certification claim must be supported by a current applicable certificate, rather than inferred from these requirements.

Specific measures, risk findings or additional safeguards needed for a particular Customer shall be documented through the protected processing record before the affected activity is entrusted. If an agreed requirement cannot be met, the parties must resolve it or refrain from the affected processing; a public security summary cannot cure that gap.

Annex 3. Customer-specific processing record and confidential register

The applicable order and an attributable written or electronic processing record shall identify the Customer, the covered service, acceptance date, authorised contacts and instructions needed to apply this DPA. The current record must be available to both parties; it is not completed merely by viewing this public document.

Before a relevant subprocessor is authorised to process Customer Personal Data, the Company shall supply the current register through the agreed protected channel. It must identify the legal entity, service or task, relevant processing and access locations, applicable transfer safeguards and the version or date of the register. The record shall link the Customer’s authorisation and any service-specific limitation to the relevant version.

The record shall also contain any necessary agreed specification of data categories, special protections, return or deletion arrangements and additional control evidence. Only the functions actually ordered and the instructions lawfully given are included. The parties must resolve material missing information before entrusting the affected processing.

For a change, the Company shall retain the written notice and proposed start, any objection and its resolution, and the resulting updated record. Notification must follow section 10 rather than rely on the Customer periodically discovering a changed list.

The detailed register and security evidence need not be published on the website. They must be supplied to the Customer and other entitled recipients as required by law with appropriate protection. A confidentiality arrangement may safeguard that information, but may not prevent disclosure of what an individual or authority is legally entitled to receive.