Data Protection and Confidentiality
Addendum to the Online Ordering Platform Services Agreement
This Data Protection and Confidentiality Addendum (the “Addendum”) is entered into as of [EFFECTIVE DATE] between A&A Terra Inc (“Provider”) and [RESTAURANT LEGAL NAME], doing business as Kebabs To-Go (“Restaurant”). It forms part of the services agreement under which Provider operates the online ordering platform (the “Platform”). If this Addendum conflicts with the services agreement, this Addendum controls on matters of data.
1. Definitions
“Restaurant Data” means all data created, collected or processed through the Platform for Restaurant, including orders, sales and revenue figures, menus and pricing, meal plans, catering and event requests, website traffic statistics, and Customer Data.
“Customer Data” means information about Restaurant’s customers, including names, phone numbers, email addresses, delivery addresses, order history, and marketing consent records.
“Restaurant Accounts” means Restaurant’s own accounts with third parties, including Clover, DoorDash, its bank, and its domain registrar.
2. Ownership
Restaurant owns all Restaurant Data. Provider receives only a limited, non-exclusive, revocable right to process Restaurant Data for the sole purpose of operating, maintaining, securing and supporting the Platform for Restaurant during the term of the agreement. Nothing in the agreement transfers ownership of Restaurant Data to Provider.
3. Confidentiality and Limited Access
3.1 Provider will treat all Restaurant Data as confidential information of Restaurant.
3.2 Provider will access Restaurant Data only when necessary to (a) keep the Platform running and secure, (b) respond to a support request made by Restaurant, or (c) comply with a law, subpoena or court order, in which case Provider will notify Restaurant first unless the law prohibits it.
3.3 Provider will not view Restaurant’s sales reports, revenue totals or customer lists for any other purpose, including curiosity, benchmarking, or marketing.
3.4 Provider will limit access to Restaurant Data to personnel who need it to perform the services and who are bound by confidentiality obligations at least as protective as this Addendum.
4. No Sale or Secondary Use
Provider will not sell, rent, license, share or disclose Restaurant Data to any third party, and will not use Restaurant Data to market to Restaurant’s customers, to serve or advise any other business, or to compete with Restaurant. Provider may use only system performance information (for example, uptime and error rates) that does not identify Restaurant, its sales, or any of its customers.
5. Payments and Funds
5.1 Card payments are processed by Restaurant’s own payment processor (Clover) and settle directly to Restaurant’s merchant account. Provider never receives, holds or controls Restaurant’s funds.
5.2 Provider does not store full card numbers or card security codes. Card details are entered into the processor’s secure payment fields.
5.3 Provider will not request, and Restaurant will not be required to give, the login passwords to any Restaurant Account. Integrations use API keys that Restaurant creates in its own accounts and may delete at any time, which immediately ends Provider’s connection to that account.
6. Owner-Only Access and Security
6.1 Restaurant will have a private owner login with a password chosen by Restaurant and unknown to Provider. Passwords are stored only in hashed (non-readable) form. Sales, Customer Data and integration settings are visible only through the owner login. Two-step verification will be available.
6.2 Staff logins (for example, the kitchen screen) will not display sales totals or customer lists.
6.3 Provider will maintain reasonable security safeguards appropriate to the data, including encryption in transit (HTTPS), access controls, regular backups, and prompt security updates.
6.4 The Platform will keep an access log of logins to the owner area, showing the account, date, time and approximate location. Restaurant may review this log at any time.
7. Service Providers (Subprocessors)
Provider may use the following categories of service providers solely to operate the Platform: cloud hosting and database providers; Clover (orders and payments); DoorDash Drive (deliveries); Anthropic (the Smart Meal Planner, which receives meal preferences but not customer names, phone numbers or addresses); and email or text-message delivery services if Restaurant enables them. Provider will keep a current list available to Restaurant on request, will notify Restaurant before adding a new category, and remains responsible for its service providers’ handling of Restaurant Data.
8. Customer Privacy and Marketing
8.1 The Platform records each customer’s marketing consent (email and text) with the date and time. Restaurant is responsible for sending marketing only to customers who opted in and for complying with applicable law, including the CAN-SPAM Act and the Telephone Consumer Protection Act.
8.2 Provider will not contact Restaurant’s customers except to send order-related messages (for example, confirmations and “ready” notices) on Restaurant’s behalf.
9. Security Incidents
If Provider becomes aware of unauthorized access to Restaurant Data, Provider will notify Restaurant without undue delay and in any event within seventy-two (72) hours, describe what is known, take reasonable steps to contain the incident, and cooperate with Restaurant, including any notices Restaurant must give under Texas law.
10. Export, Return and Deletion
10.1 Restaurant may export its orders and Customer Data at any time from the owner area in a standard format (CSV).
10.2 On termination of the agreement, Provider will, at Restaurant’s request made within thirty (30) days, provide a complete export of Restaurant Data. Provider will then delete Restaurant Data from active systems within thirty (30) days, and from backups within a further sixty (60) days, except where retention is required by law. Provider will confirm deletion in writing on request.
11. Survival and Governing Law
Sections 2 through 5, 9 and 10 survive termination of the agreement. This Addendum is governed by the laws of the State of Texas.
A&A Terra Inc
By: _______________________________
Name / Title: ______________________
Date: _____________________________
[RESTAURANT LEGAL NAME], d/b/a Kebabs To-Go
By: _______________________________
Name / Title: ______________________
Date: _____________________________
Draft for discussion. Not legal advice. Have a Texas attorney review before signing.