Data Processing Addendum

This Data Processing Addendum (the "DPA") forms part of the Tablerr Terms of Service (the "Agreement") between Tablerr (the "Processor") and the Tablerr customer (the "Controller"). It governs the processing of personal data by the Processor on behalf of the Controller in connection with the Tablerr service (the "Service").

1. Definitions

Terms not defined here have the meaning given in the Agreement or in applicable data protection law (in particular Regulation (EU) 2016/679 ("GDPR") and the UAE Personal Data Protection Law ("PDPL")).

• Controller — the Tablerr customer who determines the purposes and means of processing personal data.
• Processor — Tablerr, who processes personal data on behalf of the Controller.
• Personal Data — any information relating to an identified or identifiable natural person processed by the Processor on behalf of the Controller under the Agreement.
• Sub-processor — a third party engaged by the Processor to process Personal Data on behalf of the Controller.
• Data Subject — the individual to whom Personal Data relates (typically a restaurant guest or a Tablerr account holder).

2. Subject Matter and Duration

The Processor processes Personal Data on behalf of the Controller for the duration of the Controller's Tablerr subscription and for any post-termination period required by law or expressly agreed in writing.

3. Nature and Purpose of Processing

Processing is carried out for the purpose of operating the Tablerr reservation and guest-management service, including accepting bookings, storing guest contact details and preferences, sending transactional communications, processing payments, and providing analytics and error monitoring.

4. Types of Personal Data

The Processor processes the following categories of Personal Data on behalf of the Controller:

• Guest identifiers: name, phone number, email address.
• Guest preferences and notes: dietary requirements, allergies, tags, internal notes.
• Reservation data: date, time, party size, table assignment, attribution.
• Marketing consent records: opt-in status, source, timestamp.
• Tablerr account data of the Controller's employees: email address, name, role.

5. Categories of Data Subjects

• Restaurant guests (diners) whose data is entered into the Service by the Controller or its staff, or who self-submit data through a public booking page.
• Tablerr account holders associated with the Controller (owners, managers, hosts).

6. Obligations of the Processor

The Processor will:

• Process Personal Data only on documented instructions from the Controller, including with regard to international transfers, unless required to do so by applicable law.
• Ensure that personnel authorised to process Personal Data are bound by appropriate confidentiality obligations.
• Implement appropriate technical and organisational measures to ensure a level of security appropriate to the risk, including encryption of data in transit (TLS) and at rest, access controls, and regular review of security practices.
• Assist the Controller in fulfilling its obligations to respond to Data Subject requests by providing self-service tools for export and erasure within the Service.
• Make available to the Controller information necessary to demonstrate compliance with the obligations laid down in this DPA.

7. Sub-processors

The Processor uses the following Sub-processors to deliver the Service. The Controller authorises these Sub-processors by accepting this DPA.

The Processor will give the Controller prior notice of any intended changes concerning the addition or replacement of Sub-processors. The Controller may object to such changes by terminating the Agreement.

8. International Transfers

Primary storage of Personal Data takes place in Germany (Hetzner). Where Personal Data is transferred to a Sub-processor located outside the European Economic Area or the United Arab Emirates, the transfer is carried out under appropriate safeguards such as the European Commission's Standard Contractual Clauses or an adequacy decision.

9. Data Subject Rights

Taking into account the nature of the processing, the Processor will assist the Controller by appropriate technical and organisational measures, insofar as this is possible, for the fulfilment of the Controller's obligation to respond to requests for exercising the Data Subject's rights. The Service provides self-service tools for guest data export and erasure.

10. Personal Data Breach Notification

The Processor will notify the Controller without undue delay, and in any event within 72 hours of becoming aware of a Personal Data breach affecting the Controller's data. The notification will include all information reasonably available to the Processor at the time, and further information will be provided as it becomes available.

11. Audits and Inspections

The Processor will make available to the Controller all information necessary to demonstrate compliance with this DPA. On-site audits by the Controller or a mandated auditor are by mutual agreement, must be requested with reasonable notice, must not unreasonably interfere with the Processor's operations, and are at the Controller's expense.

12. Return or Deletion of Personal Data

On termination of the Agreement, the Processor will, at the choice of the Controller, return or delete all Personal Data processed on behalf of the Controller, unless retention is required by applicable law. Deletion will take place within 30 days of termination.

13. Governing Law and Jurisdiction

This DPA is governed by the laws of the jurisdiction stated on the cover page of the downloadable PDF version of this DPA. Disputes arising under this DPA are subject to the same jurisdiction and dispute-resolution mechanism as the Agreement.

14. Order of Precedence

In the event of any conflict between this DPA and the Agreement, this DPA prevails with respect to the processing of Personal Data. The Processor may update this DPA from time to time; superseding versions apply prospectively from their effective date.