Dohos Data Processing Addendum

TARGET-STATE DRAFT — NOT APPROVED OR EFFECTIVE

This is proposed contract text for future U.S. processing between an identified Dohos legal entity and an identified Restaurant. It is not approved, executed, incorporated, or effective, and it does not establish that Dohos or a Restaurant is subject to a particular privacy law or occupies a stated role for every purpose. No legal entity, customer, production data, Provider, subprocessor, region, retention period, security control, transfer mechanism, state schedule, or processing detail has been verified for activation. This draft must not be signed or used to process production Personal Data until every required annex entry and activation condition is complete.

Proposed addendum

This Data Processing Addendum (the DPA) forms part of the Restaurant Services Agreement between the Dohos legal entity identified in an executed Order Form (Dohos) and the Restaurant legal entity identified in that Order Form (Restaurant). Dohos and Restaurant are each a Party and together the Parties.

The DPA becomes effective only when the executed Order Form identifies this DPA by stable title, ID, version, and date, and all applicable processing details and schedules are complete.

1. Purpose and scope

1.1 Covered Processing

This DPA governs Dohos's Processing of Covered Personal Data on behalf of Restaurant to provide the activated Dohos Service described in the Order Form and Annex 1 (Covered Processing).

It does not govern:

• Restaurant's independent Processing outside Dohos's documented service role;
• Dohos's Independent Processing identified in Section 5 and the activated Privacy Notice;
• a Provider's independent or regulated Processing identified in the applicable schedule;
• Processing outside the Restaurants, locations, Capabilities, Programs, jurisdictions, data, purposes, and term listed in Annex 1; or
• a Disabled, demonstration, preview, experimental, future, suspended, or retired Capability.

1.2 Purpose-specific roles

For Covered Processing, Restaurant intends to act as Controller or Business, and Dohos intends to act as Processor, Service Provider, or Contractor, using the terms of Applicable Data Protection Law.

Roles are purpose-specific. If either Party determines purposes or means outside the role stated for a Processing activity, that Party assumes the role and duties the facts and Applicable Data Protection Law assign for that activity. A contractual label does not override actual conduct.

1.3 No coverage conclusion

This DPA supplies protective terms whether or not a particular comprehensive state privacy statute ultimately applies, but it does not concede statutory coverage, waive an exemption, or establish a threshold fact.

The activated State Schedule must identify the laws, definitions, thresholds, exemptions, and modifications counsel approves for the exact Restaurant, data subjects, jurisdictions, and Processing.

2. Definitions

2.1 Privacy terms

Applicable Data Protection Law means a law identified in the activated State Schedule that governs the relevant Processing of Covered Personal Data, including its implementing regulations and binding regulator requirements.

Business, Collect, Consumer, Contractor, Controller, Personal Data, Personal Information, Process or Processing, Processor, Sale or Sell, Service Provider, Share or Sharing, Subprocessor, and Targeted Advertising have the meanings assigned by Applicable Data Protection Law for the relevant activity. Where more than one law applies, the State Schedule resolves terminology or the more protective applicable requirement controls to the extent the duties can coexist.

Covered Personal Data means Personal Data or Personal Information Dohos Processes for Restaurant within the Covered Processing described in Annex 1.

Data Subject means the identified or identifiable person to whom Covered Personal Data relates, using the applicable statutory term where required.

Privacy Request means a request to exercise a right concerning Covered Personal Data under Applicable Data Protection Law.

Sensitive Data means data treated as sensitive, sensitive personal information, biometric data, consumer health data, precise geolocation, children's data, or an equivalent protected category under Applicable Data Protection Law.

2.2 Security and incident terms

Security Incident means an event compromising or reasonably suspected of compromising the confidentiality, integrity, or availability of Covered Personal Data or the systems used for Covered Processing. A Personal Data Breach, Breach of the Security of a System, or similar statutory event is a conclusion made under the Incident Procedure based on applicable facts and law, not a synonym for every Security Incident.

Security Addendum means the activated contract schedule stating the safeguards and shared security responsibilities for the Covered Processing.

2.3 Other terms

Instructions means Restaurant's documented directions for Covered Processing in this DPA, the Order Form, Annex 1, activated schedules, and authorized written changes.

Independent Processing means Dohos's Processing for a purpose and role it determines independently, outside Covered Processing, as specifically identified in Section 5 and the activated notices.

Legal Hold means a documented, scoped suspension of ordinary deletion required for litigation, investigation, audit, dispute, regulatory inquiry, or legal duty, with an owner, basis, start, review, access restriction, and release record.

Provider means a third party supplying an approved service. A Provider is a Subprocessor only for the Processing purpose and facts meeting that definition.

Other capitalized terms have the meanings in the Restaurant Services Agreement.

3. Processing details and instructions

3.1 Complete Annex required

Annex 1 must state with specificity:

• subject matter and duration;
• nature and purpose of each Processing operation;
• Data Subject categories;
• Covered Personal Data categories and fields at a meaningful level;
• Sensitive Data, if any;
• source and collection channel;
• Restaurant, location, Program, Capability, and jurisdiction scope;
• frequency and volume range;
• access roles;
• approved Providers and destinations;
• locations and cross-border access;
• retention trigger/period and deletion method;
• Privacy Request behavior;
• security classification and safeguards;
• required evidence; and
• termination/return/deletion instructions.

Generic descriptions such as “all customer data,” “improve services,” or “as necessary under the Agreement” are insufficient.

3.2 Restaurant Instructions

Restaurant instructs Dohos to Process Covered Personal Data only to:

1. configure and provide the activated Restaurant Account and authorized Capabilities;
2. receive, understand, structure, confirm, route, and evidence Order Requests for Restaurant;
3. communicate verified Restaurant Transaction or service status through an activated Program;
4. route payment activity through the approved Payment Provider without exposing Payment Credentials to prohibited paths;
5. provide Restaurant-authorized support and correct service errors;
6. secure the Covered Processing, prevent fraud/abuse, and investigate Security Incidents within the allocated roles;
7. fulfill Privacy Requests and Restaurant instructions concerning access, correction, deletion, restriction, portability, consent, and opt-out;
8. retain specific records for the approved period and apply a valid Legal Hold;
9. return, export, restrict, or delete Covered Personal Data at termination; and
10. perform another specific operation expressly added to Annex 1 through the approved amendment process.

An Instruction does not authorize recording, raw transcript retention, Voiceprints, sensitive-trait inference, general model training, advertising, Sale, Sharing, Targeted Advertising, cross-Restaurant profiling, or a new Provider or purpose unless a separate approved schedule and lawful basis expressly do so.

3.3 Changes to Instructions

Restaurant may change Instructions only through an authorized written change that identifies the Processing activity, purpose, data, scope, law, configuration, cost, timing, and affected documents.

Dohos may decline or suspend an Instruction that is technically infeasible, outside the service, materially unsafe, prohibited by a Provider, or reasonably believed to violate law. Dohos will explain the basis and, where practical, propose a lawful alternative.

No Instruction is effective until required legal, security, Provider, product, support, and Activation Record updates are complete.

3.4 Legally required Processing

If law requires Dohos to Process Covered Personal Data outside Restaurant's Instructions, Dohos will inform Restaurant before the Processing unless law prohibits notice, identify the legal requirement and scope to the extent permitted, and limit the Processing to what is required.

4. Dohos's Covered Processing obligations

4.1 Instruction limitation

Dohos will Process Covered Personal Data only on documented Instructions and as permitted by Applicable Data Protection Law.

Dohos will not determine a new purpose or materially incompatible means for Covered Processing without suspending the affected Processor/Service Provider role and completing the required independent-role, contract, notice, consent, assessment, and activation process.

4.2 Purpose limitation

Dohos will retain, use, and disclose Covered Personal Data only for the specific purposes in Annex 1 or as Applicable Data Protection Law expressly permits.

Dohos will not use a broad service-improvement, research, analytics, AI, security, or legal-compliance label to conceal unrelated Processing.

4.3 Prohibited Sale, Sharing, and advertising

For Covered Processing, Dohos will not:

• Sell Covered Personal Data;
• Share Covered Personal Data for cross-context behavioral advertising;
• Process Covered Personal Data for Targeted Advertising;
• rent, broker, trade, or disclose Covered Personal Data for unrelated consideration;
• allow a Provider to use Covered Personal Data for its own advertising; or
• build or enrich a cross-Restaurant or third-party advertising profile.

These restrictions apply regardless of whether money changes hands, subject to the definitions and permitted transfers in Applicable Data Protection Law.

4.4 No outside-relationship use

Dohos will not retain, use, or disclose Covered Personal Data outside the direct business relationship with Restaurant except as Applicable Data Protection Law expressly permits and Annex 1 identifies.

4.5 Combination restriction

Dohos will not combine Covered Personal Data with Personal Data received from another Restaurant, third party, or Dohos's own interaction with a Data Subject, except where Applicable Data Protection Law permits the specific combination and Annex 1 expressly describes the purpose, data, safeguards, and evidence.

Tenant separation and cross-Restaurant prohibitions apply at application, database, storage, cache, queue, search, analytics, Provider, export, model/retrieval, support, and log layers.

4.6 Confidentiality

Dohos will ensure each person authorized to Process Covered Personal Data is bound by an appropriate confidentiality duty, receives role-appropriate training, and accesses only what is necessary for assigned work.

Dohos will maintain onboarding, role-change, review, support/break-glass, and termination controls and will record privileged or sensitive access.

4.7 Compliance assurance

Dohos will notify Restaurant if it can no longer meet a material obligation under Applicable Data Protection Law or this DPA. Restaurant may take reasonable and appropriate steps to stop and remediate unauthorized use after notice and verification.

Dohos will cooperate with proportionate steps and will not conceal a loss of role qualification, Provider change, or material control failure.

5. Dohos Independent Processing

5.1 Limited purposes

Subject to the activated Privacy Notice and Applicable Data Protection Law, Dohos may Process limited data as an independent Controller or Business for purposes it determines, such as:

• Dohos Account and customer-relationship administration;
• authentication, access, fraud prevention, platform security, and service integrity;
• billing Restaurant for Dohos Fees and maintaining Dohos's accounting/tax records;
• responding to Dohos-directed support, legal, privacy, security, and accessibility requests;
• Provider procurement, contract, risk, and business administration;
• protecting legal rights and complying with a binding legal duty; and
• maintaining minimized evidence of Dohos's own contract performance and disputes.

5.2 Separation and notice

Dohos must identify the data, purpose, legal basis, source, recipients, retention, rights, and role for Independent Processing in the approved data map and Privacy Notice.

Independent Processing is not Covered Processing merely because the same system is used, and it is not authorized merely by the general service relationship.

5.3 No broad improvement right

Independent Processing does not include unrestricted product improvement, advertising, model training, cross-customer profiling, or secondary use of Restaurant/Diner content.

Any materially new independent purpose requires prior legal review, contract/notice changes, required consent or choice, Provider and product controls, and a nonretroactive Activation Record.

5.4 Role change

If Dohos begins determining purposes and means for data previously treated as Covered Personal Data beyond what Applicable Data Protection Law permits for a Processor, Service Provider, or Contractor, Dohos will be treated according to its actual role for that Processing and will not rely on the DPA's processor protections to avoid direct duties.

6. Restaurant obligations

6.1 Lawful authority and Instructions

Restaurant represents and warrants that it has the authority and lawful basis necessary to:

• provide or direct collection of Covered Personal Data;
• issue the Instructions;
• use the activated service for the stated Restaurant purposes;
• provide required notices and obtain required consents assigned to Restaurant;
• authorize Restaurant Users, locations, numbers, domains, integrations, and Providers within Restaurant's control; and
• instruct return, correction, deletion, restriction, or disclosure.

Restaurant will not instruct Dohos to violate law, Provider/network rules, another person's rights, or the Agreement.

6.2 Data minimization and accuracy

Restaurant will limit Customer Data and Instructions to what is reasonably necessary for the activated purpose and will maintain accurate Restaurant Content, contact, authority, and privacy-routing information.

Restaurant will not place Payment Credentials, secrets, unnecessary Sensitive Data, employee surveillance data, or unrelated customer lists into free-form service fields.

6.3 Restaurant notices and requests

Restaurant is responsible for notices, consent, rights responses, and independent data uses allocated to it. Dohos will provide the assistance stated in this DPA.

Restaurant will not represent that Dohos has approved, certified, or guarantees Restaurant's privacy compliance.

6.4 No transfer of Dohos duties

Restaurant's obligations do not transfer Dohos's direct statutory or contractual duties, excuse an Dohos-controlled design/configuration failure, or require Restaurant to indemnify Dohos for Dohos's unauthorized Processing.

7. Data inventory and purpose records

7.1 Processing register

Dohos will maintain a controlled record for each Covered Processing activity containing the fields required by Annex 1 plus:

• system/table/object/event and data lineage;
• source and destination;
• controller/processor/recipient roles;
• Provider account/product/configuration;
• access roles and actual access evidence;
• client/server/model/log/backup copies;
• consent, preference, and suppression dependencies;
• retention/deletion/legal-hold rules;
• rights and incident behavior;
• applicable law/state schedule;
• owner, approver, release, evidence, and expiry; and
• historical change/retirement status.

7.2 Reconciliation

Dohos will reconcile the processing register to code, schema, runtime, network, storage, logs, Provider dashboards, contracts, public notices, and product configuration at the approved interval and after material change.

A documentation entry alone is not proof of live behavior.

7.3 Restaurant access

Dohos will provide Restaurant a current summary reasonably necessary to understand Covered Processing, subject to security, confidentiality, privilege, Provider redistribution, and other-customer restrictions.

8. Sensitive Data, children, and special categories

8.1 Default restriction

Sensitive Data is prohibited from Covered Processing unless Annex 1 identifies the exact category, necessity, jurisdiction, lawful basis/consent, use, access, Provider, retention, rights, assessment, security, and deletion controls.

8.2 Allergy and dietary instructions

An allergy or dietary instruction may imply health information. The activated service will collect only the minimum transaction instruction, preserve its meaning and Restaurant provenance, restrict secondary use, and delete it under the approved schedule.

Dohos will not build a health profile, infer diagnosis, or represent the service as a healthcare or HIPAA service.

8.3 Children

The target service is not directed to children. Dohos will not knowingly build a child profile, seek parental consent, or activate child-directed Processing under this DPA.

Any proposed child/teen Processing requires a separate age/guardian, notice/consent, minimization, Provider, advertising, rights, deletion, assessment, and state-law schedule.

8.4 Biometric and Voiceprint data

Voiceprint and biometric identity Processing are Disabled Capabilities. Transient speech processing does not authorize creation of a biometric template.

Any future proposal requires a separate explicit amendment, jurisdiction-specific legal decision, notice/consent, retention/destruction policy, Provider evidence, access/security, rights, incident, and product gate.

8.5 Consumer health and regulated data

Consumer health, HIPAA-regulated, financial high-impact, government identifier, precise geolocation, employment, education, credit, insurance, and similar special-category Processing are outside scope unless separately listed and approved.

A Business Associate Addendum cannot activate a healthcare Capability without the complete entity/provider/operational gate.

9. AI, voice, recording, and transcripts

9.1 Transient processing

For an activated AI-assisted voice service, Covered Processing may include transient audio and transient text needed to understand and respond during the interaction, plus minimized structured order and event data listed in Annex 1.

The Parties will verify the actual Provider/account/product/model/region behavior, including logs, abuse monitoring, caching, session resumption, support access, model improvement, and subprocessors.

9.2 Disabled storage

Unless the Parties execute a separate Recording and Transcript Schedule and all jurisdictional gates pass:

• raw audio will not be stored after transient processing;
• raw transcripts will not be retained after transient processing;
• routine human listening is not authorized;
• interaction content will not train or fine-tune a general model;
• Voiceprints and sensitive-trait/emotion inference are prohibited; and
• Providers may not retain or reuse content beyond the approved transient and security purposes.

9.3 Structured evidence

Dohos may retain only the approved structured data necessary for Restaurant Transactions, security, support, rights, disputes, and legal records, such as order items/instructions, versions, amounts, statuses, confirmation/acceptance events, Provider identifiers, errors, corrections, and timestamps.

Structured evidence must exclude Payment Credentials and unnecessary conversation content.

9.4 Provider claims

Dohos will not claim “zero retention,” “no training,” “U.S.-only,” or equivalent behavior based only on generic Provider documentation. The actual account, model, region, options, logs, storage, support, and downstream paths must support the claim.

10. Payment data

Payment Credentials must remain within the approved Payment Provider path and are excluded from Covered Personal Data that Dohos may store in ordinary systems.

Dohos may Process permitted payment evidence listed in Annex 1, such as Provider object IDs, brand/last four digits where lawfully returned, amount, currency, status, timestamps, refund/dispute data, and ledger references.

Payment Provider, bank, and card-network roles may be independent or regulated rather than Subprocessor roles. The activated Payment Schedule and Privacy Notice must identify material roles and disclosures.

No DPA term changes merchant, funds-flow, PCI, tax-reporting, or payment-law status.

11. Data Subject and Privacy Requests

11.1 Restaurant responsibility

Restaurant is the response owner for Privacy Requests concerning Restaurant-controlled Covered Personal Data, subject to Applicable Data Protection Law.

Dohos is the response owner for its Independent Processing and will not route that responsibility to Restaurant.

11.2 Dohos assistance

Taking account of the nature of Processing and information available, Dohos will provide reasonable assistance for:

• confirmation/know/access;
• secure access and portability;
• correction;
• deletion;
• opt-out and consent withdrawal;
• Sensitive Data limitation;
• profiling/automated-decision information where applicable;
• authorized agents/guardians;
• appeals; and
• regulator inquiries.

11.3 Direct requests

If Dohos receives a request concerning Restaurant-controlled Covered Personal Data, Dohos will:

• preserve the original receipt date and scope;
• authenticate only as appropriate for routing and risk;
• notify and route to Restaurant without undue delay unless prohibited;
• not independently deny or fulfill beyond authorized Instructions; and
• provide required assistance and status.

Dohos may respond directly to explain role/routing, confirm an opt-out it controls, address security, or meet a direct legal duty.

11.4 Verification and security

The Parties will use risk-proportionate verification, minimize new identity data, provide no-Account and accessible routes where required, prevent cross-person/Restaurant disclosure, and use verification data only for the request.

11.5 Deadlines and evidence

The activated State Schedule and customer workflow must state acknowledgment, response, extension, appeal, agent, and regulator deadlines. Dohos will provide assistance early enough for Restaurant to meet its duties.

Each Party will preserve request, verification, search, action, exception, response, delivery, appeal, and deletion evidence under the approved schedule.

12. Sale, Sharing, Targeted Advertising, and preference signals

12.1 Target baseline

Covered Processing will not involve Sale, Sharing, or Targeted Advertising.

Dohos will not deploy advertising pixels, audience upload, retargeting, cross-context identifiers, or Provider independent advertising use against Covered Personal Data.

12.2 Signals and opt-outs

Where Applicable Data Protection Law requires recognition of Global Privacy Control or another universal opt-out mechanism, Dohos will detect, apply, propagate, persist, and evidence the signal for the covered Processing and Restaurant scope.

Restaurant will honor signals and opt-outs for its independent Processing and provide Dohos the instructions/integration needed for shared workflows.

12.3 Change prohibition

Neither Party may introduce Sale, Sharing, Targeted Advertising, or a conflicting Provider use through a service update or mutable policy. A future proposal requires a separate lawful basis, assessment, notice/choice, DPA amendment, Provider and technical controls, and nonretroactive activation.

13. Security

13.1 Safeguards

Dohos will implement and maintain the safeguards in the activated Security Addendum, appropriate to the nature of Covered Personal Data, Processing, systems, risks, and Applicable Data Protection Law.

The safeguards must address, as applicable:

• governance, risk assessment, and accountable ownership;
• asset/data/Provider inventory and classification;
• identity, authentication, least privilege, review, and termination;
• tenant/Restaurant separation;
• secure architecture, development, deployment, and change control;
• encryption and key/secrets management where appropriate;
• minimization, redaction, tokenization, retention, and deletion;
• logging, detection, vulnerability, and patch management;
• endpoint, network, infrastructure, application, API, AI/voice, communications, and payment security;
• Provider diligence and configuration;
• backups, recovery, continuity, and exit;
• workforce training and confidentiality;
• incident response and notification; and
• testing, evidence, exceptions, and remediation.

13.2 Restaurant safeguards

Restaurant will implement the Restaurant-controlled safeguards identified in the Security Addendum, including users/authority, devices/networks, credentials, integrations, Restaurant Content, payment account, and incident contacts.

13.3 No certification by contract

This DPA does not state that either Party is certified, compliant, fully secure, continuously monitored, or free of incidents. Public and customer claims require current scoped evidence.

14. Security Incidents

14.1 Notice to Restaurant

Dohos will notify Restaurant without undue delay after confirming a Security Incident affecting Covered Personal Data to the extent required by the activated DPA/State Schedule and law.

The execution copy must state any specific contractual clock, start event, method, and exceptions. No universal number of hours is approved in this draft.

14.2 Notice content

As information becomes reasonably available, Dohos's notice will include:

• nature and status of the event;
• discovered/confirmed dates and relevant period;
• affected systems, Restaurants, Capabilities, Providers, Data Subjects, and data categories;
• likely consequences and ongoing risk;
• containment, investigation, recovery, and remediation;
• contact and update cadence;
• evidence and assistance available; and
• whether a legal breach/notification determination has been made and by whom.

Dohos will not delay an initial useful notice solely because all facts are unknown and will correct material inaccuracies.

14.3 Investigation and control

Dohos controls investigation and remediation of Dohos systems; Restaurant controls Restaurant systems. The Parties will coordinate shared facts, Providers, privilege, forensics, law enforcement, insurers, payment networks, regulators, and communications.

Neither Party will make a public statement naming the other without required approval, except where law requires.

14.4 Regulatory and individual notice

The Parties will determine notice responsibility according to actual roles and law. Restaurant ordinarily controls notices for Restaurant-controlled Covered Personal Data; Dohos will provide timely assistance and will issue a notice directly when law assigns Dohos the duty.

No Party will issue a misleading, incomplete, or inconsistent notice or prevent the other from meeting a direct duty.

14.5 Costs

Investigation, remediation, notice, support, credit monitoring, regulator, Provider, and other incident costs are allocated under the final DPA, Security Addendum, indemnity, liability, and insurance provisions. This draft selects no special cost allocation.

15. Subprocessors

15.1 Authorization model

The activated DPA must select specific prior authorization or general written authorization for Subprocessors as permitted by Applicable Data Protection Law.

No Subprocessor is authorized in this draft. Annex 2 is intentionally empty pending actual Provider/account/contract/configuration/traffic evidence.

15.2 Subprocessor conditions

Before a Subprocessor Processes Covered Personal Data, Dohos will:

• verify exact legal entity, product, account, feature, model, region, purpose, data, access, retention, and subprocessors;
• complete proportionate privacy/security/legal/continuity diligence;
• execute a binding written agreement imposing obligations no less protective for the applicable Processing;
• restrict Processing to documented Instructions;
• prohibit unapproved Sale, Sharing, advertising, cross-customer profiling, and model training;
• require confidentiality, safeguards, incident/rights/audit assistance, deletion/return, change, transfer, and exit duties;
• configure and test the service;
• update the Subprocessor List and data map; and
• complete required notice/objection and Activation Record steps.

Dohos remains responsible for Subprocessor performance to the extent required by Applicable Data Protection Law and the Agreement.

15.3 Change notice

For general authorization, Dohos will provide the advance notice period and method stated in the activated DPA before adding or replacing a Subprocessor, except for a narrowly defined emergency process.

The notice will identify the Provider, service/purpose, data, location/transfer, expected date, available diligence, and objection method.

No notice period or contact route is approved in this draft; omission is an activation block.

15.4 Objection

Restaurant may object during the approved period on reasonable data-protection grounds. Dohos will assess the specific risk, provide proportionate information, and consider configuration, minimization, region, feature restriction, alternative Provider, or other mitigation.

If unresolved, the activated agreement must provide the applicable suspension, alternative, or termination right. Objection does not require disclosure of privileged, security-sensitive, Provider-restricted, or other-customer information.

15.5 Provider independent roles

A Provider may act independently for billing, network security, abuse prevention, legal process, regulated payment/carrier functions, or another purpose. Dohos will identify material independent roles in the Privacy Notice and schedules rather than mislabel them as Covered Processing.

16. Audits, assessments, and information

16.1 Compliance information

Dohos will make available information reasonably necessary to demonstrate compliance with this DPA and Applicable Data Protection Law, subject to confidentiality, security, privilege, Provider restrictions, and other-customer protections.

The evidence package may include current policies, control descriptions, architecture/data maps, Provider records, test summaries, certifications/attestations within scope, vulnerability/remediation summaries, rights/deletion evidence, and incident/continuity exercises.

16.2 Audit sequence

The Parties will ordinarily use this sequence:

1. current self-service or standard evidence package;
2. written questions and clarification;
3. current independent report or targeted evidence;
4. remote targeted review; and
5. onsite or technical audit only when prior steps are insufficient for a material risk or legal duty.

16.3 Audit conditions

An audit will be proportionate, scoped to Restaurant's Covered Processing, during reasonable times, conducted by qualified independent personnel, minimize disruption, avoid production exploitation, and protect other customers and security.

Restaurant bears ordinary audit costs unless the audit identifies a material Dohos breach or law requires another allocation. Exact frequency, notice, cost, and remediation terms must be completed in the execution copy.

16.4 Regulator audits

Nothing limits a competent Government Authority's lawful audit or inquiry. Dohos will reasonably assist Restaurant with a regulator request concerning Covered Processing and will meet direct duties assigned to Dohos.

16.5 Data protection assessments

Dohos will provide information reasonably needed for Restaurant's required data-protection assessment and will conduct an assessment for Dohos's own covered Processing where law requires.

Assessment assistance will address benefits, necessity/proportionality, data, purposes, parties, risks, safeguards, alternatives, sensitive data, children, profiling/AI, sale/advertising, Providers, rights, and residual risk.

17. Retention, deletion, return, and Legal Holds

17.1 Retention schedule

Annex 1 must state an executable retention rule for every Covered Personal Data object, including trigger, period, active copies, logs, caches, indexes, exports, Providers, backups, suppression records, and deletion evidence.

“As long as necessary” without criteria is insufficient.

17.2 Deletion during term

Dohos will delete, correct, restrict, or return Covered Personal Data on authenticated Restaurant Instruction and as required for Privacy Requests, subject to documented legal/contract exceptions.

Deletion will propagate to relevant active systems and Subprocessors. Backup data will be deleted or rendered unavailable under the approved restoration-aware schedule.

17.3 Termination

At expiration or termination, Dohos will provide the approved export/return opportunity, then delete Covered Personal Data within the stated period unless law requires retention.

The execution copy must state export format, period, method, verification, transition assistance, charges if any, deletion period, certificate/evidence, and backup treatment.

17.4 Legal Holds and exceptions

Dohos may retain Covered Personal Data under a valid Legal Hold or legal requirement only for the scoped purpose and period, with restricted access and no unrelated use.

Dohos will notify Restaurant of the category and basis where permitted, review the hold, and delete promptly after release. A general possibility of litigation is not an indefinite hold.

17.5 Suppression evidence

Minimized suppression or consent-withdrawal records may be retained as necessary to honor the choice and evidence compliance. They may not be used to contact the person for a prohibited purpose.

18. Deidentified and aggregate data

Dohos may create or use deidentified or aggregate data from Covered Personal Data only if Annex 1 expressly authorizes the purpose and Applicable Data Protection Law permits it.

Dohos will:

• apply the applicable technical and legal standard;
• take reasonable measures to prevent association with a person or Restaurant where required;
• publicly commit or contract not to reidentify where required;
• contractually require recipients to comply;
• prevent cross-Restaurant competitive profiling;
• assess singling-out/linkability/inference risk;
• control release and retention; and
• not describe pseudonymous or hashed data as anonymous without support.

No general “aggregate analytics” right is granted by this DPA.

19. Government, legal, and third-party requests

If Dohos receives a demand for Covered Personal Data, it will, to the extent legally permitted:

• verify authority, validity, identity, jurisdiction, and scope;
• notify Restaurant promptly;
• direct the requester to Restaurant where appropriate;
• challenge an unlawful, overbroad, or conflicting demand where reasonable;
• disclose only what is required;
• preserve confidentiality and security;
• record the demand, analysis, disclosure, and prohibition on notice; and
• provide Restaurant available information needed for its duties.

Dohos will not provide a government “back door,” voluntary bulk disclosure, or transparency claim not supported by actual records.

Emergency requests require a documented urgency and authority process and post-event review.

20. Cross-border Processing

20.1 U.S. target and actual paths

The target service is U.S.-focused, but Provider support, routing, telemetry, subprocessors, backups, or personnel may create international access. Annex 1 and Annex 2 must state verified locations and access paths.

20.2 Transfer mechanisms

No EU, UK, Swiss, Canadian, or other international transfer mechanism is incorporated by this draft.

If covered data becomes subject to an international transfer restriction, the Parties must execute the approved transfer addendum, complete required assessments and supplementary safeguards, update notices/Providers, and activate the jurisdiction before Processing.

20.3 Government-access risk

Dohos will assess Provider legal entity, storage/access locations, government-request terms, encryption/key control, support, subprocessors, and challenge practices as required for the approved transfer.

21. Records, notifications, and cooperation

Each Party will maintain records reasonably necessary to demonstrate its obligations, including:

• DPA and annex versions/execution;
• data/role/purpose inventories;
• Instructions and changes;
• notices/consents/preferences;
• Privacy Requests and appeals;
• Subprocessors and changes/objections;
• security controls, tests, exceptions, and incidents;
• retention/deletion/return/legal holds;
• assessments/audits/regulator matters;
• transfers/government requests; and
• termination and remediation.

The Parties will notify each other of a material complaint, inquiry, claim, Provider notice, law change, or operational failure affecting Covered Processing and cooperate according to role and control.

22. Term, suspension, and termination

22.1 Term

This DPA continues while Dohos Processes Covered Personal Data under the Agreement and for any post-termination retention period.

22.2 Suspension

Either Party may require suspension of affected Processing where it reasonably believes the Processing violates Applicable Data Protection Law or this DPA, a Provider loses required status, or a material control fails.

The Parties will scope the suspension, preserve required rights/evidence, investigate, correct, document, and restore only after the gate passes.

22.3 Termination

A material uncured DPA breach may support termination under the Restaurant Services Agreement. The activated documents must address whether a particular State Schedule grants an additional termination right.

Termination does not erase incident, rights, deletion, audit, regulator, liability, or historical Processing duties.

23. Liability, indemnity, and insurance

Liability, indemnity, and insurance for this DPA are governed by the final Restaurant Services Agreement, Order Form, and any privacy/security rider.

The execution copy must expressly state:

• whether privacy/confidentiality/security claims use the General Cap, Enhanced Cap, or another lawful treatment;
• treatment of Security Incident response, notification, restoration, regulator, fine/penalty, statutory damages, defense, and third-party claims;
• responsibility for Restaurant versus Dohos versus Provider-controlled conduct;
• applicable indemnities and exclusions;
• insurance mapping; and
• non-waivable matters.

No cap, indemnity, fine allocation, or insurance promise is implied by this draft.

24. Conflicts and interpretation

24.1 Precedence

Mandatory Applicable Data Protection Law controls. An executed State Schedule controls this DPA for its law and scope. The DPA controls the Restaurant Services Agreement for Covered Processing privacy terms, except a signed Security Addendum provision expressly designated to control its security subject or an Order Form special term that specifically names the DPA provision and is lawful.

Public notices do not expand contractual data rights, and internal policies do not bind Restaurant unless expressly incorporated.

24.2 Severability

If a DPA provision is invalid, the Parties will preserve the maximum lawful protective effect and replace it through an authorized amendment. They will suspend affected Processing if the required role or safeguard cannot be maintained.

24.3 Amendments

Material changes to purpose, data, role, Provider, region, retention, security, rights, recording/transcript, AI training, Sale/Sharing/Targeted Advertising, or state law require the controlled amendment and Activation Record process.

A public posting alone does not amend this DPA.

25. California schedule

This Section applies only when the activated State Schedule determines that the CCPA applies to the relevant Covered Processing and assigns Restaurant as a Business and Dohos as a Service Provider or Contractor for that Processing.

25.1 Specific Business Purposes

The execution copy must list the specific Business Purposes in Annex 1. Restaurant discloses or directs collection of Covered Personal Information only for those limited and specified Business Purposes.

Reference to the entire Agreement or “services” generally is insufficient.

25.2 Restrictions

Dohos will not, except as the CCPA and its regulations expressly permit:

• Sell or Share Covered Personal Information;
• retain, use, or disclose it for a purpose other than the specific Business Purposes in Annex 1;
• retain, use, or disclose it for a commercial purpose other than those specific Business Purposes;
• retain, use, or disclose it outside the direct business relationship with Restaurant; or
• combine it with Personal Information received from or on behalf of another person, or collected from Dohos's own interaction with the Consumer, except for a legally permitted combination expressly identified in Annex 1.

25.3 Same level of protection

Dohos will comply with applicable CCPA obligations and provide the same level of privacy protection the CCPA requires for the Covered Personal Information within its role.

Dohos will notify Restaurant if it determines it can no longer meet those obligations. Restaurant may take reasonable and appropriate steps to help ensure compliant use and to stop/remediate unauthorized use.

25.4 Consumer requests

Dohos will enable Restaurant to respond to CCPA requests and will handle direct requests according to the applicable regulations and Section 11.

25.5 Subcontractors

Dohos will engage a subcontractor for Covered Personal Information only under a written contract meeting applicable Service Provider or Contractor requirements and the DPA.

25.6 Monitoring and audit

Restaurant may monitor Dohos's compliance through the proportionate audit process required by the CCPA contract rules and Section 16.

25.7 Sensitive Personal Information and opt-out preference signals

Dohos will follow the activated scope for Sensitive Personal Information, Sale/Sharing opt-outs, and recognized opt-out preference signals and will not use Covered Personal Information to evade those choices.

26. Colorado schedule

This Section applies only when the activated State Schedule determines that the Colorado Privacy Act applies and assigns Restaurant as Controller and Dohos as Processor for the relevant Covered Processing.

26.1 Instructions and roles

Dohos will adhere to Restaurant's Instructions and assist Restaurant in meeting applicable obligations. If Dohos begins determining purposes and means beyond the Processor role, it becomes a Controller for that Processing as the law provides.

26.2 Binding processing terms

Annex 1 must state:

• processing instructions;
• nature and purpose;
• type of Personal Data;
• duration;
• rights and obligations of both Parties; and
• the requirements of this Colorado Schedule.

26.3 Processor assistance

Taking account of Processing and available information, Dohos will assist Restaurant with:

• Consumer rights requests;
• security of Processing and Security Incident obligations;
• data-protection assessments;
• regulator inquiries; and
• other Controller duties requiring Processor information or action.

26.4 Confidentiality

Dohos will ensure each person Processing Colorado Personal Data is subject to confidentiality.

26.5 Subprocessors

Dohos will engage a Subprocessor only after the authorization/change process and under a contract requiring the Subprocessor to meet Dohos's obligations for the relevant Processing.

26.6 Deletion or return

At Restaurant's choice and as law requires, Dohos will delete or return all Colorado Personal Data after the service ends unless retention is legally required.

26.7 Audits and inspections

Dohos will make available information necessary to demonstrate compliance and allow/contribute to reasonable audits and inspections under Section 16 and applicable law.

26.8 Security

The Parties will implement appropriate technical and organizational measures to ensure a level of security appropriate to the risk, with responsibilities established in the Security Addendum.

27. Other U.S. state schedules

No other state schedule is activated in this draft.

Before a state is activated, counsel must complete a schedule that:

• cites current statute/regulations and effective dates;
• determines coverage, exemptions, roles, and territorial scope;
• maps required contract provisions;
• modifies definitions and rights;
• states Sensitive Data/consent, Sale/Targeted Advertising, profiling/AI, child/teen, assessment, audit, security, breach, and appeal duties;
• addresses universal opt-out mechanisms;
• states subprocessor authorization and audit terms;
• addresses cure/enforcement/private-right issues;
• reconciles Restaurant and Provider obligations; and
• receives an exact Activation Record.

A conservative nationwide control may apply across states only where counsel confirms it satisfies each activated law and does not create a false applicability or compliance claim.

Annex 1 — Processing details completion record

This Annex is intentionally unpopulated because no Restaurant, data flow, or production release is verified. The execution copy must replace each instruction below with approved facts; leaving the instructions in an execution copy is prohibited.

A. Parties and scope

B. Processing activities

For each activity, the execution copy must create a row with:

C. Target initial permitted categories

The target initial boundary may include, only after row-level approval:

• Restaurant and authorized-user identity/contact/role data;
• Restaurant Content and provenance;
• Diner contact and fulfillment data necessary for a Restaurant Transaction;
• structured order items, options, quantities, approved instructions, versions, prices, taxes, fees, tips, status, and timestamps;
• AI/voice transient processing and minimized structured interaction evidence;
• transaction communications and consent/suppression evidence;
• permitted noncredential payment evidence;
• support, privacy, accessibility, security, incident, refund, and dispute case data; and
• minimized technical/security/audit events.

The list is not authorization and must be reduced to actual necessity.

D. Target prohibited categories and uses

Unless separately approved, Annex 1 must exclude:

• full Payment Credentials and Sensitive Authentication Data;
• raw audio and raw transcript retention;
• Voiceprints, facial/biometric templates, emotion and sensitive-trait inference;
• children's profiles;
• broad medical/consumer-health profiles;
• precise geolocation beyond a necessary fulfillment address;
• government identifiers;
• employee surveillance/high-impact data;
• advertising profiles and cross-Restaurant combination;
• general model-training corpora;
• secrets, keys, passwords, tokens, and recovery codes; and
• unrelated Restaurant customer lists or data-broker enrichment.

Annex 2 — Authorized Subprocessors

No Subprocessor is authorized in this draft.

The execution copy must contain a verified row for each applicable Subprocessor:

Potential Provider names in repository or live public text are diligence candidates only and must not populate this Annex without current account/contract/configuration/traffic evidence.

Annex 3 — State and jurisdiction schedule register

The execution copy must list every activated jurisdiction:

Every unsupported state/locality remains blocked. California and Colorado text in this draft is not activation for either state.

Annex 4 — Return, deletion, and transition record

The execution copy must state:

• export eligibility, scope, format, encryption, authentication, delivery, expiry, and audit;
• correction and failed-export handling;
• active system deletion sequence;
• Subprocessor deletion/return;
• logs, caches, indexes, analytics, support, and derived data;
• backups and restoration-aware deletion;
• Legal Holds and required records;
• suppression evidence;
• deletion period and verification;
• certificate or evidence available;
• Restaurant confirmation;
• post-termination Privacy Requests/incidents/disputes; and
• final closure owner/date.