1. Scope & Relationship
This Data Processing Agreement ("DPA") governs the processing of personal data by TODO: Legal Entity Name Pvt Ltd ("Data Processor") on behalf of the Restaurant Subscriber ("Data Fiduciary") under the Indian Digital Personal Data Protection (DPDP) Act, 2023.
2. Roles and Instructions
The Restaurant acts as the Data Fiduciary who determines the purposes for which customer personal data (such as guest phone numbers for WhatsApp e-bills or dining reservations) is collected. CPOS processes such personal data solely upon the documented instructions of the Restaurant and as strictly required to operate the software services.
3. Technical & Organizational Measures
CPOS implements robust technical safeguards:
- Strict tenant-isolated querying to prevent cross-tenant data leakage.
- End-to-end HTTPS/TLS 1.3 transport encryption.
- AES-GCM encrypted local storage on offline terminal devices.
- Role-based access partitioning for cashier, kitchen, and waiter staff.
4. Sub-processors
CPOS engages reputable cloud infrastructure and SMS/WhatsApp gateway providers (e.g. AWS Mumbai, Gupshup/Meta Cloud API) under equivalent data protection obligations.
5. Security Incident Notification
In the event of a verified personal data breach impacting Restaurant data, CPOS will notify the affected Data Fiduciary without unreasonable delay and assist in complying with statutory reporting obligations to the Data Protection Board of India.