Data Processing Addendum

1. Roles

For the personal data of a restaurant's customers (names, contact details, order history, delivery addresses), the restaurant is the controller and Wabiit is the processor acting on the restaurant's instructions. For a restaurant owner's own account data, Wabiit is the controller, as described in the Privacy Policy.

This addendum forms part of the Terms of Service between Wabiit and the restaurant ("you").

2. Instructions and purpose

Wabiit processes customer data only to provide the Services: taking and fulfilling online orders, sending order notifications, running loyalty and rewards you configure, handling disputes, and producing the reports in your dashboard. We do not sell customer data or use it to advertise to your customers on behalf of anyone else.

3. Subprocessors

We use the following providers to deliver the Services. We will give notice before adding one that handles customer personal data.

• Amazon Web Services (United States). Hosting, storage, databases, email delivery and infrastructure for every part of the platform.
• Square (Block, Inc.). Payment processing, catalog, customer profiles, loyalty and gift cards, through your own Square account.
• DoorDash (Drive). Delivery fulfillment for orders you choose to deliver. Receives the customer's name, phone and delivery address.
• Apple and Google. App distribution and push notifications for the restaurant apps.

4. Security

Wabiit uses encryption in transit and at rest, access controls limited to staff who need access to operate the Services, and secrets management for all credentials. Card numbers never touch Wabiit systems: card entry is handled by Square's payment form and stored with Square.

5. Assistance and requests

If a customer asks you to access, correct or delete their data, we will help you respond within the time the law gives you. We will notify you without undue delay if we become aware of a breach affecting your customers' data.

6. Retention and deletion

When you close your account, your storefront is taken down and customer data held by Wabiit is deleted within 30 days, except where we must keep records for tax, dispute or legal reasons. Data held in your own Square account stays with Square under your control.

7. Transfers

Data is stored and processed in the United States. If you serve customers in other jurisdictions, you are responsible for any notices or consents those laws require.