Data processing agreement

1. What this covers

"Customer Personal Data" means personal data in the Customer Data that Item86 processes for the Customer. Annex 1 describes the processing. If this DPA and the terms of service conflict on data protection, this DPA wins.

2. Item86's obligations

Item86 will:

1. Instructions. Process Customer Personal Data only on the Customer's documented instructions, which are this DPA, the terms of service and the Customer's use of the service settings (for example connecting a POS system). Item86 will tell the Customer if it believes an instruction breaks data protection law.
2. Confidentiality. Make sure everyone authorized to process the data is bound by confidentiality.
3. Security. Apply the technical and organizational measures in Annex 2, and keep them appropriate to the risk.
4. Sub-processors. Use only the sub-processors in Annex 3, which the Customer authorizes. Item86 will give at least 30 days' notice by email before adding or replacing one; the Customer may object on reasonable data protection grounds, and if no solution is found may end the affected service and receive a refund of any prepaid fees for it. Item86 will bind each sub-processor to data protection terms at least as protective as these and remains responsible for them.
5. Data subjects' requests. Help the Customer, by appropriate measures, to answer requests from people exercising their rights, and pass on any such request it receives directly.
6. Other assistance. Help the Customer, taking into account the information available to Item86, with security, impact assessments and consultations with authorities.
7. Personal data breaches. Notify the Customer without undue delay, and in any case within 48 hours of becoming aware of a breach affecting Customer Personal Data, with the information the Customer needs to meet its own obligations, and keep the Customer updated.
8. End of service. When the service ends, let the Customer export its data for 30 days, then delete Customer Personal Data, including from backups when they are overwritten [confirm the backup period], unless the law requires keeping it. Item86 will confirm deletion in writing on request.
9. Audits. Make available the information needed to show compliance with this DPA, and allow audits by the Customer or an auditor it appoints, at most once a year (or after a breach), with 30 days' notice, during business hours, under confidentiality, and at the Customer's cost.

3. The Customer's obligations

• The Customer is responsible for having a lawful basis for the personal data it puts into Item86 or tells Item86 to retrieve, and for informing the people concerned.
• The Customer will avoid putting unnecessary personal data in free-text fields (for example guests' names in comp details).
• When connecting a POS system, the Customer confirms it may give Item86 access, and gives an account limited to what Item86 needs.

4. International transfers

Where Customer Personal Data subject to EU, UK, Georgian or similar transfer rules is processed outside the country it comes from (including by sub-processors in Annex 3), the transfer is covered by an adequacy decision, the EU–US Data Privacy Framework where the sub-processor is certified, or the European Commission's Standard Contractual Clauses (with the UK addendum where relevant), which the parties incorporate by reference as needed. [To be confirmed by counsel for each sub-processor.]

5. Liability and term

Liability under this DPA is subject to the limits in the terms of service, except where the law doesn't allow it. This DPA lasts as long as Item86 processes Customer Personal Data.

Annex 1: Details of the processing

• Subject matter and duration: providing the Item86 service to the Customer, for the term of the agreement and the 30-day export period afterwards.
• Nature and purpose: storing, organizing, analysing and displaying the Customer's hospitality data to calculate menu engineering, costs, recommendations and reports; retrieving closed checks from the Customer's POS system when connected; sending account emails.
• People concerned: the Customer's users of Item86; the Customer's employees and others named in the Customer's records (for example the person who approved a comp); guests only where the Customer enters them in free-text notes.
• Types of personal data: users' names, work emails, roles, sign-in records (IP address, browser) and activity log entries; names or free-text entered by the Customer in records such as comps; POS check data (time, table reference, number of guests, items and amounts), which normally contains no guest identity; menu photos.
• Special categories of data: none intended. The Customer shouldn't enter them.

Annex 2: Security measures

• Encryption: all connections use HTTPS (TLS). POS login details are encrypted at rest with AES-256-GCM; passwords are stored as salted hashes; POS keys and invitation links only as hashes. The database provider encrypts stored data.
• Access control: every request is checked against the user's organization, role and outlets; outlets a user may not see are reported as "not found". Automated tests check that one organization can't read or change another's data, for every data function.
• Authentication: passwords of at least 10 characters; sign-in, sign-up and password reset are rate limited; sessions expire after 14 days and are ended on password reset.
• Safe connections to other systems: addresses entered for POS systems must be public HTTPS addresses (internal network addresses are refused) and are checked again before every use; the scheduled job that fetches POS data needs a secret key.
• Logging: an activity log of changes per organization; error logs don't contain passwords or tokens, and email addresses in them are partly hidden.
• Development: changes are reviewed through pull requests and must pass automated checks (code checks, type checks, unit and access tests, browser tests and a dependency vulnerability audit) before release. Test data is fictional.
• Resilience: hosting and database on managed cloud services with automatic backups and point-in-time restore [confirm the period].
• People: access to production systems is limited to the people who need it, using individual accounts with two-step sign-in. [Confirm.]

Annex 3: Authorized sub-processors

Signatures