Data Processing Addendum

This Data Processing Addendum (“DPA”) is part of the agreement between Data Doodles Tech Private Limited, which operates DataRestro (“we”, the “Provider”), and the business that uses DataRestro (“you”, the “Customer”) under the Terms of Service. It applies whenever we process personal data contained in Customer Data on your behalf, and continues for as long as we do.

For that personal data, such as your guests’ orders, reservations and loyalty records and your staff records, you are the controller (you decide why and how it is used) and we are your processor. For the account, billing and contact data of your owners and staff that we use to run our own relationship with you, we are a controller, and our Privacy Policy applies instead.

“Applicable Data Protection Law” means the privacy and data protection laws that apply to the processing, which may include Nepal’s Individual Privacy Act 2075 (2018) and, where they apply to your business, laws such as the EU or UK GDPR. If this DPA and the Terms conflict on personal data, this DPA wins.

We process personal data only on your documented instructions. By using the Service you instruct us to process it to provide, secure and support the Service, as the Terms, this DPA and your settings describe, including sending invoice data to Nepal’s IRD when you enable CBMS reporting. Further instructions must be consistent with the agreement; instructions that need new work are agreed in writing.

We will tell you if, in our opinion, an instruction breaks Applicable Data Protection Law. We will not sell personal data, use it for our own purposes, or combine it with data from other customers, except as the law allows and as needed to provide the Service. The details of the processing are in section 13.

Only personnel who need access to provide, secure or support the Service may access personal data, and they are bound by confidentiality obligations. Our operators work through a separate platform console whose actions are recorded in an audit log.

We implement and maintain the technical and organisational measures described in section 14, taking into account the state of the art, the cost of implementation, and the nature, scope and purposes of the processing and the risks to individuals. We may update these measures, but not in a way that materially reduces the overall protection of personal data.

If we become aware of a breach of our security that leads to the accidental or unlawful destruction, loss, alteration, unauthorised disclosure of, or access to, personal data we process for you, we will notify the account owner without undue delay. The notice will describe, as far as is then known, what happened, the data and people likely to be affected, what we have done to contain it, and what we recommend you do. We will update you as we learn more and cooperate reasonably with your investigation.

Unsuccessful attempts that do not compromise personal data, such as blocked sign-in attempts or network scans, are not incidents under this section. You are responsible for any notifications the law requires you, as controller, to give to authorities or individuals; we will help with the information we hold. Notifying you is not an admission of fault.

• Have a lawful basis for the personal data you put into the Service, and give guests and staff the notices (and obtain any consents) the law requires, including telling staff that their actions in the Service are recorded.
• Use the Service’s roles and permissions appropriately, keep your sign-ins and devices secure, and keep your own copies of records you are required to keep.
• Do not put restricted data into the Service: national identity numbers, full payment card numbers, financial account credentials, health information beyond an allergy or dietary need for an order, or other especially sensitive data, unless we have agreed it in writing (see the Acceptable Use Policy).

Owners and managers can view and correct guest and staff records in the console. Where the console does not provide what you need to answer a request from an individual to access, correct, delete, restrict or port their data (for example, a copy of one guest’s records), we will help you, taking into account the nature of the processing.

A guest profile without order history can be deleted from the console. Where a guest has order history, the invoice and sales records behind it must be kept for tax purposes; on your instruction we will anonymise the guest’s contact details while keeping those records.

If an individual contacts us directly about data we process for you, we will tell you promptly (unless the law forbids it) and refer them to you. You are responsible for responding to them.

You authorise us to use the sub-processors listed in section 15. We impose data protection obligations on each sub-processor that are no less protective than this DPA, to the extent relevant to its service, and we remain responsible to you for its performance.

Before we add or replace a sub-processor, we will update section 15 and email the account owner. You may object on reasonable data protection grounds within 15 days. We will then work with you in good faith to find a solution; if we cannot, you may end the affected Service by written notice, and we will refund any prepaid fees for the unused period.

Payment providers, the IRD and other services you connect with your own accounts are not our sub-processors. They receive data because you instruct us to send it, under their own terms.

Personal data is stored in our database provider’s Singapore region and passes through Cloudflare’s global network, so it is processed outside Nepal and may be processed outside your country. We protect it as this DPA describes wherever it is processed.

Where the EU GDPR, UK GDPR or Swiss data protection law applies to your personal data and a transfer to us or our sub-processors would otherwise be restricted, the parties agree to the European Commission’s Standard Contractual Clauses (Module Two where you are a controller, Module Three where you are a processor), with the UK Addendum or Swiss amendments as applicable, completed with the details in sections 13 to 15. Contact us for a signed copy.

We will make available the information reasonably necessary to show that we meet this DPA, including answers to reasonable security questionnaires, once a year or when a supervisory authority requires it. DataRestro does not currently hold a third-party certification such as SOC 2 or ISO 27001. Any on-site or third-party audit must be agreed in advance in writing, protect our other customers’ data and confidential information, and is at your cost.

When the Service ends, we stop processing personal data except to store it while it is returned or deleted. If you ask in writing within 30 days, we will return a copy of the personal data in a commonly used, machine-readable format, or delete it, as you choose. After that period we delete or anonymise it within a reasonable time.

We may keep personal data that the law requires us to keep, such as tax invoices and the sales records behind them, for as long as the law requires, protected under this DPA and used only for that purpose. Data in infrastructure backups is deleted as those backups expire.

We do not use personal data to train, fine-tune or improve any artificial-intelligence or machine-learning model, ours or anyone else’s, and we do not allow our sub-processors to. The Service does not make automated decisions that have legal or similarly significant effects on individuals.

People whose data is processed

• The Customer’s guests: people who order, pay, book, join a loyalty programme or leave feedback.
• The Customer’s staff and authorised users, and its suppliers’ contacts.

Categories of personal data

• Guests: name, phone number, email address and delivery address where given; orders, order notes, table and time; reservation details (name, phone, party size, date, notes); loyalty points and visits; ratings and comments; buyer name, PAN and address on an invoice where recorded; payment status, amount, method and the provider’s transaction reference.
• Staff: name, email, phone, role and branch; hashed password or PIN; sign-in sessions with IP address and device information; actions recorded in the audit log; shifts and cash movements; and, where the Customer uses employee records, employee code, joining date, salary, address and emergency contact.
• Suppliers: contact names, phone numbers and email addresses.

Sensitive data

None is intended. An allergy or dietary note a guest adds to an order may reveal health information; it is used only to prepare that order. See section 6 on restricted data.

• Separation of customers: every business’s data is scoped to that business on the server, and access across businesses is refused.
• Access control: role-based permissions checked on the server for every request; staff see only what their role allows. Platform operators use separate accounts and roles, and their actions are audited.
• Authentication: passwords hashed with Argon2id; point-of-sale PINs stored hashed; access tokens valid for 15 minutes; refresh tokens stored only as hashes and revoked when a password is reset; password-reset and invitation links are single-use and expire within an hour; sign-in is temporarily locked after repeated failures.
• Encryption: all connections use TLS, with HSTS on our web domains. Payment-provider and IRD credentials that businesses store in the Service are additionally encrypted with AES-256-GCM.
• Logging: sensitive actions such as voids, discounts, refunds, manager approvals, invoice exports and role changes are written to an audit log that owners can review.
• Abuse protection: rate limiting on the API and on sign-in.
• Hosting and continuity: the Service runs on Cloudflare and a managed PostgreSQL database that provides its own recovery features. An independent, regularly tested backup of the hosted service is being put in place; this annex will be updated when it is.

More detail, including what we do not claim, is on our security page.

Last updated with version 1.1. Changes are announced as section 8 describes. Questions: support@datadoodlestech.com.