Data Processing Agreement

This agreement is between the restaurant business that subscribes to QueueWho (“the Restaurant”) and Monika Sharma, trading as QueueWho (“the Processor”). It forms part of the Terms of Service and is accepted with them.

For the personal data of the Restaurant's guests (“Guest Data”), the Restaurant is the Data Fiduciary and the Processor is its Data Processor, as defined in the Digital Personal Data Protection Act, 2023 (“DPDP Act”). The Processor's handling of account data for its own purposes is covered by the Privacy Policy instead.

• Data Principals

  Details: Guests of the Restaurant who order, pay, give feedback or join its loyalty or offers programmes; and, where the Restaurant enters them, its suppliers' contact people

• Personal data

  Details: Name, mobile number, email address (if given), orders, bills and invoices, payment references, consent records, loyalty points, feedback, staff notes about guests, group-order names, browser identifiers, data requests; supplier names and phone numbers

• Purposes

  Details: Taking, preparing, serving and billing orders; payments and refunds; GST invoices; loyalty; offers to guests who consented; feedback; handling guests' data requests; security; support the Restaurant asks for

• Duration

  Details: For the term of the subscription and the return-and-deletion period below

The Processor processes Guest Data only to provide the Service and on the Restaurant's documented instructions, which are these terms and the settings and actions the Restaurant takes in the console. It will not use Guest Data for its own purposes, sell it, or use it for advertising. If an instruction appears to break the law, the Processor will tell the Restaurant.

• Show guests the privacy notice the Service provides (or its own, if at least as complete) and collect only the data it needs.
• Send offers only to guests who opted in, and act promptly on requests to see, correct or erase data that guests send through the Service or to the Restaurant.
• Give staff access only as their role needs, and remove access when someone leaves.
• Publish, or have the Processor publish on its behalf, a contact person for guests' data questions.

The Processor maintains reasonable security safeguards, as the DPDP Rules require, including:

• encryption of data in transit and of secrets at rest; one-way hashing of passwords, PINs and one-time codes;
• separation of each restaurant's data by row-level security enforced in the database;
• role-based access, two-factor sign-in for administrators, and time-limited, logged support access that hides guest details unless the Restaurant allows them;
• logs of access and sensitive actions, kept for at least one year to detect and investigate unauthorised access;
• daily backups and tested restores, so the Service can continue after an incident;
• confidentiality obligations on everyone who can access the data.

The Restaurant authorises the Processor to use the sub-processors below. The Processor binds each by contract to protect the data at least as well as this agreement, and remains responsible for them. It will give at least 30 days' notice by email before adding or replacing one; the Restaurant may object and, if no solution is found, cancel.

• Amazon Web Services (or the hosting provider named in our records)

  Purpose: Hosting the application, its database and uploaded files

  Location: Australia (Sydney)

• Cloudflare, Inc.

  Purpose: Content delivery, DNS, protection from attacks, the bot check on some forms, backup storage (if used)

  Location: Global network (including outside India)

• The payment gateway the restaurant chose: Cashfree, Razorpay, PhonePe, PayU or Paytm

  Purpose: Taking online payments and refunds (the restaurant's own gateway account)

  Location: India

• MSG91 (Walkover Web Solutions Pvt. Ltd.)

  Purpose: SMS: one-time codes, order updates and, with consent, offers

  Location: India

• Meta Platforms (WhatsApp Business Cloud API), if the restaurant uses WhatsApp

  Purpose: WhatsApp messages: one-time codes, order updates and, with consent, offers

  Location: Outside India

• Resend

  Purpose: Email: invitations, sign-in and password emails, receipts a guest asks for, alerts to owners

  Location: United States

• Google (Gemini and Veo) or Anthropic (Claude), whichever the platform uses

  Purpose: AI features: reading menu photos, writing dish descriptions and translations, the menu assistant

  Location: United States

• Sentry (Functional Software, Inc.), if enabled

  Purpose: Finding and fixing software errors

  Location: United States or European Union

The payment gateway is engaged by the Restaurant under its own account and agreement with the gateway, not by the Processor. Transfers outside India are made only as section 16 of the DPDP Act allows.

The Service gives the Restaurant and its guests tools to see, download, correct and erase Guest Data and to withdraw consent. Where a request can't be handled with them, the Processor will help the Restaurant answer it in time for the Restaurant to meet its duties under the DPDP Act and Rules. If a guest contacts the Processor directly, it passes the request to the Restaurant the same working day.

The Processor will inform the Restaurant of any personal data breach affecting Guest Data without delay, and in any case within 24 hours of becoming aware of it, so the Restaurant can inform the affected guests and the Data Protection Board within the time the DPDP Rules set (detailed report within 72 hours). The notice will describe what happened, when and where, the data and people likely affected, the likely consequences, what is being done to contain it, and a contact person.

The Processor will help the Restaurant prepare its notices and, if the Restaurant asks, send them to guests on its behalf. It will also report to CERT-In where its directions require.

• Guest profiles are erased automatically 3 years after the guest's last order, unless the Restaurant has a legal need to keep them.
• Bills, invoices and payment records are kept as long as GST law requires, then deleted.
• When the subscription ends, the Restaurant can export its data for 30 days. The Processor then deletes Guest Data within 90 days, including from backups as they expire, except what the law requires it to keep, and confirms deletion in writing on request.

The Processor will give the Restaurant the information reasonably needed to show it meets this agreement, answer reasonable security questionnaires once a year, and cooperate with the Data Protection Board or other authorities where required.

Liability under this agreement is subject to the limits in the Terms of Service, except where the law does not allow it to be limited. If this agreement and the Terms of Service conflict about Guest Data, this agreement applies.