DataProcessing Addendum.

• This DPA covers personal data of your guests (diners who use the TASTEEM chat assistant on your website or in your restaurant pages) that we process on your behalf. For this data you are the controller and we are the processor.
• This DPA does not cover data for which we are the controller: your own account, team, and billing data, and guest profiles that diners create themselves with TASTEEM (Discover). These are described in our Privacy Policy. We do not share guest profiles with you.

• We process guest personal data only on your documented instructions, which are these Terms, this DPA, and your settings and use of the Services, unless the law requires otherwise. In that case we tell you before processing, unless the law forbids it.
• We will tell you if we believe an instruction breaches data protection law.

• You are responsible for having a legal basis for offering the chat to your guests and for your own privacy notice on your website.
• The widget shows guests a notice that they are talking to an AI assistant and should confirm allergens with staff. You must not remove it.
• You must give us lawful instructions and must not use the Services to process data in a way the law does not allow.

We keep guest personal data confidential and allow access only to the people who need it to provide the Services. All such people are bound by confidentiality obligations.

We apply appropriate technical and organizational measures under Article 32 GDPR. The measures in force are listed in Annex 1. We may update them if the protection does not decrease.

• You give us general authorization to use the sub-processors listed in Annex 2.
• We will inform you of any intended addition or replacement at least 30 days in advance by email or in-app notice. You may object on reasonable data protection grounds within that period. If we cannot resolve the objection, you may terminate the affected Services and receive a pro-rata refund of prepaid, unused fees.
• We bind each sub-processor to data protection obligations no less protective than this DPA, and we remain responsible for their performance.

• If a guest contacts us about data we process for you, we will forward the request to you without undue delay and will not respond to it ourselves unless you instruct us or the law requires it.
• We do not store chat text or guest identifiers in our database, so most requests cannot be matched to an individual. We will help you with what we can.
• We will reasonably help you with your obligations under Articles 32 to 36 GDPR (security, breach notification, impact assessments, and prior consultation), taking into account the nature of the processing and the information we have.

• We will notify you without undue delay, and where feasible within 48 hours, after becoming aware of a personal data breach affecting guest data we process for you.
• The notice will describe, as far as known, the nature of the breach, the likely consequences, and the measures taken or proposed.

• Chat text is not stored. Anonymous statistics are deleted automatically after the retention period of your plan (30, 60, or 120 days).
• When the Services end, we delete the remaining data within 30 days (encrypted backups are overwritten within that period), unless the law requires us to keep it. You can export your data before that.

• We will give you the information needed to show our compliance with this DPA.
• You may audit our compliance once per year, or after a confirmed breach, with at least 30 days' written notice, during business hours, without disrupting the Services, and at your cost. Because TASTEEM is operated by one person and its providers publish their own audit reports, audits are normally carried out by questionnaire and document review first.

• We operate from Romania (EU). Some sub-processors process data in the United States.
• Transfers outside the EEA rely on the EU-US Data Privacy Framework where the sub-processor is certified, or on the Standard Contractual Clauses (processor-to-processor module) in the sub-processor's data processing terms.

To the extent the CCPA or another US state privacy law applies, we act as your service provider or processor. We process guest personal data only to provide the Services to you. We do not sell it, share it for cross-context behavioral advertising, retain, use, or disclose it outside our direct business relationship with you or for purposes other than the Services, or combine it with data from other sources, except as the law permits. We will tell you if we can no longer meet these obligations.

• Liability under this DPA is subject to the limitations in the Terms of Service, to the extent the law allows. Nothing limits liability that cannot be limited by law, including towards data subjects.
• If this DPA conflicts with the Terms of Service on the processing of personal data, this DPA prevails.

• This DPA lasts as long as we process guest personal data on your behalf.
• It is governed by Romanian law, and disputes are handled as stated in the Terms of Service.