Dohos Vendor and Subprocessor Addendum

TARGET-STATE DRAFT — NOT APPROVED OR EFFECTIVE

This is proposed contract text for a future Provider relationship between an identified Dohos legal entity and an identified Vendor. It is not approved, executed, incorporated, or effective. It is not evidence that a Vendor, product, account, service, subprocessor, region, security control, data use, AI model, communications route, payment role, service level, insurance policy, or production connection is approved or active. This draft must be completed against the Vendor's actual contract, product, account, configuration, data flows, and subcontractors; signatures and public documentation alone do not authorize production use.

Proposed addendum

This Vendor and Subprocessor Addendum (Addendum) forms part of the written agreement and order document between the Dohos legal entity identified in the applicable order document (Dohos) and the Provider legal entity identified there (Vendor). It applies only to the exact Services, products, accounts, regions, data, actions, Capabilities, customers, and term identified in the executed annexes.

1. Purpose and scope

1.1 Covered Services

This Addendum governs only the Vendor services identified in Annex 1 (Covered Services) and supplements the governing commercial agreement with requirements for:

• scope and instructions;
• confidentiality and data protection;
• security and secure development;
• AI and model use;
• voice, recording, transcription, and communications;
• payment data and financial actions;
• subprocessors and locations;
• access, support, legal process, and government requests;
• service levels, resilience, incidents, and audit;
• intellectual property, data, content, and output rights;
• compliance, insurance, indemnity, liability, and remedies; and
• suspension, transition, deletion, and exit.

1.2 No implied product or feature

Dohos's purchase or use of one Covered Service does not authorize another Vendor product, preview, beta, model, region, endpoint, support feature, data use, or subprocessor. Bundled technical availability does not add scope.

1.3 Production gate

Vendor may receive Production Data or perform a production action only after Dohos completes the Activation Record for the exact account, configuration, release, data flow, customer scope, and jurisdiction. A signed Addendum, API key, connected account, successful test, or Vendor approval does not itself activate production use.

1.4 Disabled Vendor uses

Unless a separately negotiated provision and Activation Record expressly permits them, Vendor must not:

• sell, rent, share for cross-context behavioral advertising, or monetize Customer Data;
• use Customer Data to train or improve a general or third-party model;
• create Voiceprints or biometric identifiers/information;
• infer emotion, health, ethnicity, age, disability, protected class, or other sensitive traits;
• retain raw recordings or raw/substantially verbatim Transcripts;
• collect or store Payment Credentials or Sensitive Authentication Data outside an approved payment role;
• initiate Marketing or artificial/prerecorded outbound communications;
• make autonomous Restaurant acceptance, refund, substitution, payment, pricing, employment, credit, healthcare, or other high-impact decisions;
• combine Customer Data with unrelated customer or third-party data for profiling;
• disclose Customer Data to data brokers, advertisers, or public datasets;
• use Customer Data for demonstration, benchmarking publication, model cards, case studies, or sales;
• move Customer Data to an unapproved country or region; or
• use an unlisted subprocessor.

2. Definitions

Activation Record means Dohos's controlled record binding the exact Vendor legal entity, agreement, product, account, region, configuration, data/actions, subprocessors, customer scope, release, evidence, approvals, start, expiry, monitoring, and rollback.

Affiliate means an entity controlling, controlled by, or under common control with a Party. An Affiliate is not automatically authorized to access Customer Data.

AI System means any model, algorithmic system, automated decision tool, speech system, prompt/tool workflow, or machine-learning component Vendor uses to provide or support Covered Services.

Applicable Requirements means the laws, regulations, binding orders, Provider/network rules, contractual requirements, and approved standards that apply to Vendor's actual Services, roles, data, locations, industries, customers, and conduct. A list in this Addendum is not exhaustive.

Authorized Personnel means Vendor personnel with a current need, approved role, training, confidentiality duty, authentication, and access authorization for the exact Covered Service.

Customer Data means data, content, instructions, records, metadata, prompts, inputs, outputs, configurations, credentials, logs, support material, or other information Dohos, a Restaurant, a Diner/Payer/Caller/user, or their systems submit to or make available through Vendor, and data Vendor creates or derives for the Covered Services. Customer Data excludes Vendor's independently developed technology but not Customer-specific derived data merely because transformed.

De-identified Data means data processed using a documented, validated method so it cannot reasonably identify or be linked to an individual, Restaurant, Dohos customer, transaction, call, or tenant, with contractual and technical prohibitions on reidentification. Removing direct identifiers alone is insufficient.

Documentation means Vendor's controlled technical, security, data, legal, support, and operational materials for the exact Covered Services.

Dohos Customer means a Restaurant or other Dohos customer whose data or operations are within the approved scope.

Payment Credentials means card numbers, verification codes, PINs, bank credentials, passwords, authentication codes, cryptographic payment data, wallet secrets, or equivalent access/authorization data.

Personal Data means information subject to privacy, consumer-data, breach, biometric, communications, employment, or similar protection because it identifies, relates to, describes, is reasonably linkable to, or is processed about a person or household, as applicable.

Restricted Data means Payment Credentials, Sensitive Authentication Data, raw recordings/Transcripts, Voiceprints, authentication secrets, government identifiers, financial-account access data, precise geolocation, health data, data about minors, employee data, and other data classified as restricted in Annex 2.

Security Incident means suspected or confirmed unauthorized or unlawful access, acquisition, use, disclosure, alteration, loss, destruction, unavailability, exfiltration, or processing of Customer Data or compromise of a system, credential, key, model, account, dependency, or control materially affecting Covered Services. It includes prohibited retention, training, secondary use, cross-tenant exposure, or unauthorized action.

Sensitive Authentication Data has the meaning used by applicable payment-card standards and includes security codes and certain authentication data prohibited from storage after authorization.

Services Data means limited telemetry Vendor creates about operation of the Covered Services that is not Customer Data, provided Vendor documents the fields, purposes, retention, recipients, and safeguards in Annex 2. Vendor may not relabel content, prompts, outputs, recordings, Transcripts, identifiers, or customer-specific behavior as Services Data to avoid obligations.

Subprocessor means a Vendor Affiliate or third party that processes Customer Data for or on behalf of Vendor or can access Customer Data through hosting, support, security, AI, communications, payment, analytics, development, or other operations.

Vendor Materials means Vendor's preexisting or independently developed software, models, tools, Documentation, and technology, excluding Customer Data, Dohos Materials, Restaurant Content, and Customer-specific deliverables owned or licensed to Dohos under the governing agreement.

Other capitalized terms have the meanings in the governing agreement or Dohos's Data Processing Addendum.

3. Instructions and permitted purpose

3.1 Documented instructions

Vendor will process Customer Data and perform actions only on Dohos's documented instructions in the governing agreement, this Addendum, Annex 2, and authenticated service requests within approved functionality. If instructions conflict, Vendor must stop the affected processing and request clarification.

3.2 Purpose limitation

Vendor may process Customer Data only to provide, secure, support, and maintain the exact Covered Services for Dohos, consistent with Annex 2. Generic purposes such as “improve services,” “analytics,” “research,” “safety,” or “business operations” are not authorized without exact data, activity, necessity, recipients, retention, and controls.

3.3 Unlawful instruction

If Vendor reasonably believes an instruction violates Applicable Requirements, it must notify Dohos before processing, explain the specific concern, suspend only affected scope, and cooperate on a lawful alternative. Vendor may omit notice only where law prohibits it and must document the prohibition.

3.4 No independent controller use

Any proposed Vendor use as an independent controller, business, third party, seller, sharer, advertiser, model developer, or other independent role must be expressly identified in Annex 2, separately justified, disclosed, and approved. Silence or standard online terms do not create the role.

3.5 Data minimization

Vendor must limit collection, access, fields, frequency, granularity, location, copies, logs, retention, and personnel to what is necessary for the approved purpose. Optional telemetry and support access must default off unless approved.

4. Compliance and cooperation

4.1 Applicable Requirements

Vendor will comply with Applicable Requirements directly governing its Covered Services and assist Dohos with Dohos's obligations allocated in this Addendum. Vendor does not warrant legal conclusions outside its actual role, but it must provide accurate facts needed for Dohos and counsel to assess them.

4.2 Licenses and authorizations

Vendor must maintain every license, registration, authorization, certification, personnel qualification, carrier/network approval, and governmental permission required for Vendor's actual conduct. Vendor will provide evidence on request and notify Dohos of restriction, lapse, investigation, or material challenge.

4.3 No unsupported compliance claims

Vendor must not represent the Covered Services as “compliant,” “certified,” “approved,” “HIPAA compliant,” “PCI compliant,” “biometric free,” “no training,” “zero retention,” “end-to-end encrypted,” or equivalent without exact scope, issuer/standard, date, evidence, limitations, and configuration. Marketing material does not modify the agreement.

4.4 Regulatory assistance

Vendor will reasonably assist Dohos with regulator, court, consumer, customer, payment-network, carrier, insurer, and auditor inquiries concerning Vendor's Covered Services, data, controls, incidents, or records. Fees and scope for extraordinary assistance must be fair and specified, except Vendor bears costs caused by its breach.

4.5 Record integrity

Vendor will maintain accurate records of instructions, access, processing, changes, subprocessors, incidents, deletion, and control performance for the periods in Annex 2 and provide exportable evidence without exposing other customers.

5. Confidentiality and personnel

5.1 Confidentiality

Vendor will protect Dohos Confidential Information and Customer Data under written confidentiality obligations at least as protective as the governing agreement. Obligations survive while information remains confidential or protected.

5.2 Authorized Personnel

Vendor will limit access to Authorized Personnel and maintain identity verification appropriate to role, background screening where lawful and risk-appropriate, confidentiality, training, least privilege, authentication, supervision, access logging, periodic review, and prompt revocation.

5.3 Workforce location and status

Annex 3 must identify countries/regions and classes of employees, contractors, support personnel, reviewers, and administrators with potential access. A remote-access location is a processing location even if primary storage remains elsewhere.

5.4 Contractor control

Vendor remains responsible for personnel and subcontractors it uses. Contractor classification or an agency arrangement does not reduce flow-down, supervision, confidentiality, security, incident, deletion, or audit duties.

5.5 Support access

Support access to Customer Data must be disabled by default where practical, limited to a scoped case and time, approved, logged, visible to Dohos where feasible, and ended when the case closes. Vendor must not use support access for unrelated inspection or training.

6. Security program

6.1 Security Addendum

Vendor will implement and maintain the safeguards in Annex 3 and Dohos's Security Addendum as incorporated for the Covered Services. Controls must match actual architecture and evidence, not merely a policy statement.

6.2 Governance

Vendor will maintain accountable security leadership, policies, risk assessment, asset/data inventory, secure design/development, access control, vulnerability management, logging/monitoring, incident response, continuity, Provider management, training, and independent review appropriate to risk.

6.3 Identity and access

Vendor must use unique identities, least privilege, strong authentication, step-up/dual control for sensitive actions, session and service-account control, secrets management, timely joiner/mover/leaver processes, and periodic access certification.

6.4 Tenant isolation

Vendor must enforce logical and, where required, physical isolation among Dohos, Dohos Customers, environments, regions, models, retrieval stores, accounts, and other Vendor customers. Tenant selection may not rely solely on client-supplied identifiers.

6.5 Encryption and keys

Vendor must protect Customer Data in transit and at rest using approved current methods and manage keys/secrets through controlled generation, storage, access, rotation, backup, revocation, and destruction. Annex 3 must identify key ownership and any Vendor ability to decrypt.

6.6 Secure development

Vendor will apply secure requirements, design review, code/dependency review, testing, build/release integrity, artifact provenance, secrets scanning, vulnerability remediation, change approval, rollback, and separation of environments. Material AI/model/prompt/tool changes are releases subject to the same discipline.

6.7 Vulnerability management

Vendor will discover, assess, prioritize, remediate, verify, and disclose vulnerabilities based on exploitability and impact. Annex 3 must state risk-based remediation targets, exceptions, compensating controls, and escalation; no numerical target is promised by this draft.

6.8 Logging and monitoring

Vendor must log material authentication, privileged access, data access/export, configuration, model/tool, key, subprocessor, deletion, and security events with integrity, time synchronization, tenant scope, alerting, retention, and access controls.

6.9 Penetration and independent assessment

Vendor will conduct risk-appropriate independent penetration testing and control assessments and provide current scoped reports or summaries, remediation status, and material exceptions. A certification or report does not replace Dohos's right to investigate specific risk.

6.10 No weakening

Vendor may not materially reduce safeguards during the term without prior notice, impact information, and Dohos's approval where required. An improvement in one control does not excuse an undisclosed reduction elsewhere.

7. Data location, transfers, and segregation

7.1 Approved locations

Customer Data may be processed or stored only in the countries/regions listed in Annex 2, including backups, support, telemetry, security, and Subprocessor access.

7.2 Transfer controls

Vendor will implement any transfer mechanism, assessment, supplementary measure, localization, notice, and record required for the approved scope. If a lawful transfer path fails, Vendor will suspend affected transfer and support migration or localization.

7.3 Environment segregation

Production Data may not enter development, demo, model-training, public benchmark, sales, or other nonproduction environments unless Annex 2 documents necessity and equivalent safeguards. Synthetic or minimized Test Data is preferred.

7.4 Cross-customer use

Vendor must not pool Customer Data with other customer data for retrieval, analytics, training, benchmarking, or model context unless expressly approved. De-identified aggregate Services Data requires the controls in Section 12.

8. Retention, deletion, return, and legal holds

8.1 Retention schedule

Annex 2 must identify a specific trigger and duration for each content, metadata, log, cache, backup, support copy, safety/abuse record, model artifact, derived data, and legal record. “As long as necessary” is insufficient without a defined decision rule and maximum.

8.2 Deletion

Vendor will delete Customer Data on instruction, rights request, purpose completion, account closure, contract termination, or schedule expiry, subject only to a documented legal hold or mandatory law. Deletion must propagate through production, indexes, caches, queues, logs where feasible, support, analytics, exports, backups, Subprocessors, and derived artifacts on the approved cycle.

8.3 Return and portability

Before deletion or as otherwise required, Vendor will provide Customer Data and configurations in a documented, usable, secure format with schema, provenance, relationships, and integrity information sufficient for transition, subject to rights and security limits.

8.4 Legal holds

Vendor may retain identified Customer Data under a legally required hold only for the exact scope and duration, isolate it from ordinary use, restrict access, document authority, and resume deletion when the hold ends. Vendor must notify Dohos unless prohibited.

8.5 Deletion evidence

Vendor will provide deletion status, systems/Subprocessors covered, date, exceptions, backup cycle, and authorized attestation. Dohos may require targeted technical validation for material or incident-related deletion.

8.6 No hostage rights

Vendor may not withhold Customer Data export, suppression records, security evidence, rights assistance, or lawful transition solely to pressure payment of a good-faith disputed amount, subject to reasonable security and undisputed charges expressly tied to transition.

9. Privacy rights and regulated requests

9.1 Assistance

Vendor will provide tools and assistance for access, correction, deletion, portability, restriction, objection, opt-out, consent withdrawal, appeal, and authorized-agent requests for Customer Data within the time and format in Annex 2.

9.2 Direct requests

If Vendor receives a request concerning Customer Data, it will not respond substantively except on Dohos's instruction or where law requires. It will promptly route the request, preserve the deadline, and disclose any mandatory response.

9.3 Authentication and isolation

Vendor must support proportionate authentication without creating new biometric or sensitive data and must isolate other people, Restaurants, tenants, and customers. Inability to isolate data is a material design risk.

9.4 Corrections and provenance

Vendor must preserve the difference among source content, automated output, human correction, structured transaction evidence, and historical versions. Corrections may not silently rewrite evidence.

9.5 Sensitive data

Vendor may process Restricted Data only if Annex 2 expressly authorizes the exact field, purpose, role, location, access, retention, consent/authority, and controls. No optional or inferred sensitive data processing is allowed.

10. Subprocessors

10.1 Complete list

Annex 4 must identify every Subprocessor legal entity, service, purpose, data, actions, location, access, contract, retention, and effective date. A category, brand family, affiliate group, or mutable webpage without stable evidence is insufficient.

10.2 Prior authorization

Vendor may appoint a new or replacement Subprocessor only under the specific or general written-authorization process in Annex 4. The process must provide advance notice with material facts, a meaningful review/objection period where applicable, and a safe alternative or termination path.

10.3 Flow-down

Vendor must impose written obligations at least as protective for the Subprocessor's role, including instructions, confidentiality, security, data location, rights, incidents, audit, retention/deletion, AI/training, legal process, transition, and further subcontracting.

10.4 Responsibility

Vendor remains responsible for each Subprocessor's performance to the extent permitted by law and the governing agreement. Dohos's authorization does not waive Vendor's duties.

10.5 Emergency changes

An emergency Subprocessor substitution may occur only to prevent material security, safety, or continuity harm, with the narrowest scope, immediate notice, full facts, temporary controls, and prompt ordinary review. It cannot be used for convenience.

10.6 Objection and exit

If Dohos reasonably objects based on privacy, security, AI, data-location, legal, payment, communications, customer, or regulatory risk, Vendor must use reasonable efforts to avoid that Subprocessor, provide an equivalent approved alternative, or allow termination of affected Covered Services with transition and unused prepaid Fee treatment in Annex 1.

11. AI, models, and automated systems

11.1 AI inventory

Annex 5 must identify each model/system, provider, legal entity, product, model family/version/status, endpoint, region, prompt/tool/retrieval role, input/output data, retention, training, human review, safety/abuse processing, subprocessors, limitations, evaluation, and change controls.

11.2 No training or improvement

Vendor may not use Customer Data, prompts, outputs, interactions, fine-tunes, embeddings, evaluations, feedback, or support material to train, fine-tune, improve, benchmark, or evaluate a general or third-party model unless Annex 5 expressly states the exact use and Dohos separately approves it. The target posture is no such use.

11.3 Customer isolation

Customer Data, retrieval stores, context, embeddings, caches, tools, and output must be tenant-scoped and unavailable to other customers or public responses. Vendor must test prompt injection, retrieval leakage, tool abuse, model memorization, and cross-session exposure.

11.4 Voice and biometrics

Vendor must not create or use a Voiceprint, identify/authenticate/link a person by voice, infer sensitive traits, or retain raw audio/Transcript unless separately approved under the Recording Schedule. Transient speech processing must be verified against actual Provider logging and support behavior.

11.5 Action limits

AI output may not itself authorize a charge, refund, Restaurant acceptance, substitution, price/tax change, communication consent, legal assent, identity, emergency action, or high-impact decision. Deterministic Dohos controls and authorized human/user actions govern.

11.6 Grounding and claims

Vendor must accurately disclose model limitations, source/citation behavior, confidence limits, known material errors, model status, evaluation scope, and changes. Vendor may not claim accuracy, safety, non-hallucination, bias elimination, or compliance without scoped current evidence.

11.7 Model changes

A model/version/status, prompt, tool, retrieval, safety, data, logging, retention, training, region, endpoint, subprocessor, or output-behavior change is material and requires advance notice, evidence, reevaluation, and Dohos approval before production use.

12. Services Data, analytics, and de-identification

12.1 Services Data inventory

Annex 2 must list each Services Data field, source, purpose, legal role, recipient, location, access, retention, deletion, and opt-out/control. Unlisted telemetry is Customer Data and subject to Dohos's instructions.

12.2 Permitted internal operations

Dohos may approve minimum Services Data for billing, security, fraud prevention, service operation, and capacity planning if Vendor cannot reasonably perform the purpose with less data and does not use content or identify Dohos Customers unnecessarily.

12.3 De-identified aggregate use

Any approved aggregate use requires documented de-identification, minimum cohort/risk controls, no reidentification or customer ranking, no public/customer-specific disclosure, no model training unless separately approved, and periodic reidentification testing.

12.4 Benchmarking

Vendor may not benchmark Dohos, a Restaurant, a model, transaction, call, or user publicly or for other customers without express written approval of data, method, cohort, claims, confidentiality, and publication.

13. Communications and recording

13.1 Communications role

If Vendor transmits calls, texts, email, or other messages, Annex 5 must identify exact sender/seller, Program, channel, number/domain, content class, recipient source, consent/authority data, registration, opt-out/help, suppression, timing/frequency, jurisdiction, Provider role, data, and evidence.

13.2 No independent outreach

Vendor may not contact Dohos Customers, Diners, Payers, Callers, Restaurant personnel, or users except to transmit approved Messages, provide approved support, address security/legal requirements, or as law requires. It may not market its own or another party's services using Customer Data.

13.3 Suppression

Vendor must accept, apply, preserve, return, and delete suppression data according to Dohos's instructions; prevent queued/retried messages after opt-out; and provide delivery/reply/error evidence. Vendor may not use suppression lists for targeting.

13.4 Recording and Transcript

Vendor must keep persistent Recording and raw Transcript Storage disabled unless Annex 5 and a separate Recording Schedule approval expressly activate them. Provider safety/abuse logs, support captures, caches, and debugging copies count for this analysis.

13.5 Identity and delivery

Vendor must preserve approved sender/caller identity, prevent spoofing or route evasion, protect numbers/domains/accounts, and provide accurate delivery states. Vendor does not guarantee recipient receipt or legal consent through carrier acceptance.

14. Payment and financial-service controls

14.1 Exact role

If Vendor handles payment or financial data/actions, Annex 5 must identify Payment Provider role, merchant/account ownership, charge/funds flow, fees, settlement, payouts, refunds/disputes, losses/reserves, data/PCI scope, tax reporting, and regulatory status.

14.2 Credential handling

Vendor may receive Payment Credentials or Sensitive Authentication Data only in the exact approved PCI-scoped service. It must prevent those data from entering AI, voice, recordings, Transcripts, general logs, analytics, support, or other Covered Services.

14.3 No unauthorized value movement

Vendor must not change merchant, payee, recipient, amount, currency, fee, payout, bank, refund destination, or funds flow except on authenticated authorized instructions within Annex 5. It must reject out-of-scope or conflicting instructions.

14.4 Payment evidence

Vendor must provide non-secret object/status/amount/fee/refund/dispute/settlement evidence sufficient for Dohos reconciliation, audit, Payer support, and regulator response without exposing Payment Credentials.

14.5 PCI and network evidence

Vendor will maintain applicable PCI DSS validation, network/acquirer approvals, and responsibility evidence for its role and notify Dohos of lapse, scope change, restriction, compromise, or material finding.

15. Intellectual property, content, and output

15.1 Vendor Materials

Vendor retains Vendor Materials subject to the licenses and service commitments in the governing agreement. Vendor warrants it has the rights necessary to provide them and grant those rights.

15.2 Customer Data and Dohos Materials

As between Vendor and Dohos, Dohos and its licensors retain rights in Customer Data, Dohos software, Restaurant Content, prompts, configurations, brand, and materials. Vendor receives only the limited rights necessary for Covered Services.

15.3 Deliverables

Annex 1 must identify ownership/license, dependencies, third-party materials, source delivery, modification, support, and exit for custom deliverables. Payment alone does not determine ownership.

15.4 AI output

Vendor must disclose material output-rights limitations, third-party claims process, training sources/categories where contractually available, safeguards, and indemnity. No Party guarantees that AI output is unique, accurate, protectable, noninfringing, or fit for unreviewed use.

15.5 Open source and third-party components

Vendor must maintain a component inventory, comply with licenses, disclose material copyleft/source/provenance obligations, monitor vulnerabilities, and avoid terms that conflict with the granted rights or confidentiality.

15.6 Publicity

Vendor may not use Dohos's or a Restaurant's name, logo, data, metrics, quotes, relationship, or case study without specific written approval of exact content, medium, duration, and withdrawal. Listing Vendor as a Subprocessor is not endorsement.

16. Service levels, support, and changes

16.1 Service levels

Annex 1 must state exact availability, support, response/restoration, maintenance, recovery, reporting, credits/remedies, exclusions, and measurement for Covered Services. Public status pages or marketing claims are not contractual commitments unless expressly incorporated as stable terms.

16.2 Support

Vendor will provide staffed support contacts, severity definitions, escalation, status, root-cause and corrective-action process, language/time zone, and emergency security/privacy paths in Annex 1.

16.3 Maintenance and changes

Vendor must provide advance notice of maintenance and material changes to APIs, models, features, data, security, pricing, terms, subprocessors, regions, limits, support, deprecations, and end of life. Emergency changes require prompt notice and evidence.

16.4 Compatibility and deprecation

Vendor will provide a commercially reasonable migration period and assistance for deprecations stated in Annex 1. If a change creates material legal, security, data, accessibility, customer, or operational harm, Dohos may suspend or terminate affected scope and receive the agreed unused prepaid Fee treatment.

16.5 No hidden previews

Vendor may not move Dohos to beta, preview, experimental, model-auto-upgrade, or materially different behavior without approved opt-in and reevaluation.

17. Business continuity and resilience

17.1 Program

Vendor will maintain and test business continuity, disaster recovery, backups, restoration, dependency, capacity, region/provider failure, ransomware, and personnel continuity appropriate to Covered Services.

17.2 Recovery objectives

Annex 3 must state measured and tested recovery objectives and data-loss tolerances for exact components. No numerical objective is promised by this draft.

17.3 Backup limits

Backups must be encrypted, access-controlled, tenant/data scoped, tested, retained/deleted under the schedule, and excluded from ordinary analytics/training. Restore tests must not reintroduce deleted or suppressed data into active use.

17.4 Dependency continuity

Vendor must identify critical cloud, communications, payment, model, identity, data, and other dependencies, concentration, alternatives, and single points of failure in Annex 3.

17.5 Dohos continuity assistance

Vendor will provide current export, status, incident, recovery, and transition information sufficient for Dohos to operate safe fallback and communicate truthfully to customers.

18. Security and data incidents

18.1 Notification

Vendor will notify Dohos without undue delay and within the exact maximum in Annex 3 after discovering a Security Incident affecting Covered Services or Customer Data. A contractual time does not delay earlier notice reasonably needed for containment or legal deadlines.

18.2 Initial notice

Notice must include known date/time, detection, nature, systems/products/accounts, data/actions, Restaurants/people/jurisdictions, threat, containment, Vendor/Subprocessors, evidence, and contact, clearly distinguishing confirmed facts from estimates.

18.3 Cooperation

Vendor will preserve evidence, contain and eradicate the cause, prevent unauthorized use/training/disclosure, investigate scope/root cause, provide updates, support notification and regulator/customer/insurer response, remediate, validate closure, and provide a final report.

18.4 Communication control

The Parties will coordinate external communications where lawful. Vendor may make legally required notices but must provide advance notice and accurate facts where permitted. Neither Party may minimize, speculate, or make unsupported attribution.

18.5 Costs

The governing agreement must allocate reasonable investigation, remediation, notice, restoration, credit monitoring where appropriate, regulator, defense, and other costs based on breach, causation, law, indemnity, liability, and insurance. No allocation is selected by this draft.

18.6 Reactivation

Affected Covered Services remain suspended until material cause is remediated, controls and data disposition are verified, required notices/actions are complete, and Dohos approves a new Activation Record.

19. Audit and assurance

19.1 Standard evidence

Vendor will provide current independent reports/certifications, penetration summaries, security/privacy documentation, subprocessor list, data maps, business continuity results, vulnerability status, insurance, and compliance evidence identified in Annex 3.

19.2 Additional information

Dohos may request reasonable targeted information when standard evidence does not address a material risk, Incident, regulator/customer requirement, control failure, material change, or suspected breach.

19.3 Audit

Subject to reasonable notice, confidentiality, security, scope, frequency, and noninterference, Dohos or a qualified independent auditor may assess Vendor's compliance for Covered Services. An Incident, credible material deficiency, or regulator requirement may justify expedited assessment.

19.4 Other customers and secrets

Vendor may protect other customers' data and genuine security-sensitive or proprietary information through redaction, clean-room review, summary, or independent assessor evidence, but not use those limits to conceal Dohos-specific material risk.

19.5 Remediation

Findings require risk, owner, plan, compensating control, target, evidence, and verification. A plan without timely completion may require suspension or termination.

20. Legal process and government requests

20.1 Notice

Unless prohibited, Vendor will notify Dohos before disclosing Customer Data in response to subpoena, warrant, court order, regulator, national-security, or other governmental demand and provide a copy and response deadline.

20.2 Narrow response

Vendor will verify authority, challenge facially invalid or overbroad demands where reasonable, seek confidentiality/protection where appropriate, disclose only legally required data, preserve a record, and direct the requester to Dohos where lawful.

20.3 Prohibited notice

If notice is prohibited, Vendor will document the legal basis and seek permission to notify. It will provide delayed or aggregate transparency when lawful.

20.4 Voluntary disclosure

Vendor may not voluntarily disclose Customer Data to a government or law-enforcement body except to address an imminent legally recognized emergency, protect rights/safety as law permits, or on Dohos's instruction. Vendor must document the basis and scope.

21. Insurance

21.1 Required coverage

Annex 1 must identify insurance types, limits, retentions, insurers, ratings, territories, retroactive dates, endorsements, additional-insured status where appropriate, primary/noncontributory terms, subrogation, and notice based on Covered Services.

21.2 Relevant lines

Review must consider commercial general liability, technology errors and omissions, cyber/privacy, media, crime/social engineering, professional liability, workers' compensation/employers liability, automobile if applicable, and specialized payment, communications, AI, biometric, or product coverage.

21.3 Evidence and change

Vendor will provide certificates and requested policy/endorsement evidence and notify Dohos of cancellation, nonrenewal, material reduction, exclusion, claim, or exhaustion affecting Covered Services.

21.4 No limit by insurance

Insurance does not create compliance, replace controls, or limit liability unless the governing agreement expressly says so and law permits.

22. Representations and warranties

22.1 Authority

Vendor represents that it has authority to enter the agreement and provide Covered Services, and that Vendor Materials and its performance will not knowingly violate applicable rights or binding obligations.

22.2 Service conformity

Vendor warrants Covered Services will materially conform to the executed Documentation and service specifications during the warranty/term stated in Annex 1. No performance level is supplied by this draft.

22.3 Malicious code and unauthorized features

Vendor warrants it will not knowingly introduce malicious code, hidden access, undisclosed data exfiltration, disabling devices unrelated to lawful suspension, or features designed to bypass Dohos's controls.

22.4 Accurate disclosures

Vendor warrants material responses about data, security, AI, subprocessors, locations, incidents, compliance, insurance, service performance, and product configuration are accurate and not misleading when provided, and it will correct material errors promptly.

22.5 No absolute warranty

The final agreement must not imply that Vendor guarantees uninterrupted, error-free, secure, lawful, noninfringing, unbiased, or accurate service beyond substantiated enforceable commitments and non-waivable law.

23. Indemnity, liability, and remedies

23.1 Required negotiation

Annex 1 must state indemnity, defense, settlement, liability caps, enhanced/super caps, exclusions, direct-remediation costs, equitable relief, service remedies, and exclusions from limitation for the exact risk. No monetary amount or cap is selected by this draft.

23.2 Indemnity subjects

Counsel should consider Vendor indemnity for third-party claims arising from:

• Vendor Materials or Services infringement/misappropriation;
• Vendor breach of confidentiality, data, security, AI, communications, payment, or subprocessor duties;
• Vendor violation of law directly governing its conduct;
• Vendor employment/worker claims;
• bodily injury/property damage caused by Vendor; and
• Vendor fraud, willful misconduct, or gross negligence where recognized.

23.3 Dohos indemnity

Any Dohos indemnity should be limited to Dohos-provided materials or unlawful instructions within Dohos's responsibility and exclude Vendor contribution, independent use, undisclosed processing, or failure to warn.

23.4 Defense and settlement

The final terms must address notice, control, participation, conflicts, counsel, cooperation, admission, injunctive relief, settlement consent, and allocation for mixed fault. No Party may settle in a way that admits fault, imposes duties, discloses data, or restricts operations of the other without consent.

23.5 Non-waivable and direct duties

Indemnity and caps do not create legal authority or eliminate non-waivable duties, regulator remedies, or a Party's direct responsibility. Counsel must test enforceability in the chosen forum and relevant jurisdictions.

24. Term, suspension, termination, and transition

24.1 Term

The Addendum term follows the governing agreement but each Covered Service and Activation Record has its own start, expiry, renewal, and evidence-refresh date in Annex 1.

24.2 Suspension

Dohos may suspend affected Covered Services for material legal, privacy, security, AI, payment, communications, Provider, data, customer, or continuity risk. Vendor may suspend only under fair, scoped contractual rights and must preserve security, rights, export, incident, deletion, and transition duties.

24.3 Termination rights

The final agreement must provide termination for material breach, repeated service failure, Security Incident, unlawful processing, unapproved Subprocessor/location, unsupported material change, loss of required authorization/insurance, insolvency, and convenience if commercially agreed.

24.4 Transition assistance

Vendor will provide the transition period, data/configuration export, Documentation, knowledge transfer, credential/account/number/domain/model transfer where applicable, parallel operation, deletion, and support in Annex 1. Fees must be stated and reasonable; Vendor bears remediation caused by its breach.

24.5 No data or operational hostage

Vendor must not impede lawful export, porting, rights, security response, refunds/disputes, suppression, or transition through proprietary format, withheld keys, disabled access, or disputed Fees beyond expressly negotiated fair terms.

24.6 Survival

Confidentiality, rights, data protection, security/incident, legal holds, deletion, audit, IP, payment, liability, legal process, transition, and provisions that by nature apply after termination survive for the applicable period.

25. Hierarchy, online terms, and changes

25.1 Hierarchy

The executed order document, this Addendum, DPA/security terms, and governing agreement must state an exact conflict hierarchy. Non-waivable law controls. A later online term cannot silently override a negotiated provision.

25.2 Online terms

Vendor must identify every online agreement, policy, DPA, SLA, support, acceptable-use, product, AI/model, security, subprocessor, pricing, and documentation page that applies, with stable version/date and change process. Mere continued use is not assent to a material adverse change where the negotiated agreement requires written approval.

25.3 Material changes

Vendor will provide advance notice and impact details for material legal, data, security, AI, subprocessor, region, feature, model, API, pricing, support, service, or end-of-life changes. Dohos may reject, suspend, or terminate affected scope under the final terms.

25.4 No retroactive cure

A later contract, DPA, deletion, subprocessor notice, control, certification, or disclosure does not retroactively authorize earlier processing or cure a prior breach. Historical conduct and data require separate remediation.

Annex 1 — Parties, Services, commercial terms, service levels, risk, and transition

Until every applicable field is completed, the Vendor is not approved for production.

B. Vendor responsibility matrix

The executed annex must allocate product, account, instructions, data, security, support, changes, incidents, audit, privacy rights, AI, communications, payment, intellectual property, insurance, and transition between Vendor, Dohos, Restaurant, other Providers, and Subprocessors.

C. Service-level and support schedule

Define components, user-visible availability, measurement source, period, exclusions, maintenance, response/restoration/resolution, recovery, reporting, chronic failure, credits/remedies, claims, contacts, and evidence. Provider component uptime is not automatically Dohos's end-to-end SLA.

Annex 2 — Data, privacy, retention, rights, and location schedule

A. Processing inventory

For each data class, identify person/tenant, source, fields, purpose, legal/contract role, instruction, systems, recipients, locations, access, retention, deletion, rights, incident, and evidence.

B. Restricted and prohibited data

Mark each Restricted Data class as prohibited or conditionally allowed with exact controls. Blank means prohibited. Payment Credentials, raw Recording/Transcript Storage, Voiceprints, sensitive inference, and general AI training remain prohibited absent separate activation.

C. Retention/deletion matrix

List content, metadata, logs, caches, telemetry, support, abuse/safety, analytics, backups, legal records, derived data, and Subprocessor copies with triggers, durations, deletion methods, backup cycle, legal hold, and evidence.

D. Rights and regulatory assistance

State intake, authentication, search/isolation, export, correction, deletion, objection, opt-out, appeal, direct request, response time, fee, audit, and escalation.

Annex 3 — Security, personnel, assurance, continuity, and incident schedule

A. Control specification

Map governance, assets/data, identity/access, tenant isolation, cryptography, secrets, endpoint/network/cloud, application/API, secure development/supply chain, vulnerabilities, logging/monitoring, backups/recovery, physical security, personnel, Subprocessors, incidents, and deletion to exact evidence.

B. Assurance packet

Identify independent reports/certifications, scope/entity/product/region, period, exceptions, penetration testing, remediation, customer-control considerations, insurance, and expiry. No report is accepted outside its exact scope.

C. Incident schedule

Define notification maximum, staffed contacts, severity, initial/update/final content, evidence, containment, forensics, legal/insurer/customer/regulator support, costs, remediation, and reactivation.

D. Continuity schedule

Define dependencies, redundancy, recovery objectives, backup/restore, region/provider/personnel failure, exercises, results, exceptions, customer communication, export, and exit.

Annex 4 — Subprocessor authorization and change schedule

A. Approved Subprocessor list

The executed list must contain legal entity, service, purpose, data, actions, location, remote access, contract date, safeguards, incident/deletion terms, effective date, and evidence. The draft list is intentionally empty.

B. Change process

State notice method, advance period, material facts, objection grounds, review, alternative, termination/transition, emergency process, and historical version retention.

C. Further subcontracting

Vendor must maintain the complete chain and prove equivalent flow-down. An unlisted lower-tier processor is an unapproved Subprocessor.

Annex 5 — AI, communications, payment, and other regulated capability schedule

A. AI/model record

Identify model/system/provider/version/endpoint/region, inputs/outputs, prompts/tools/retrieval, data/retention/training/support, evaluation, action limits, changes, incident, and exit.

B. Voice/recording record

Identify audio/transcript paths, transient/Persistent behavior, logs/caches/review, disclosure/consent role, Voiceprint prohibition, retention, deletion, and jurisdiction evidence.

C. Communications record

Identify sender/seller/Program/channel/number-domain/route/registration, recipient source/authority, templates, timing/frequency, suppression/help, data, jurisdictions, delivery evidence, changes, and exit.

D. Payment record

Identify merchant/account, charge/funds flow, fees, settlement/payout, refunds/disputes/losses, Payment Credentials/PCI, tax reporting, regulatory/network roles, evidence, and exit.

E. Other regulated capability

Any healthcare, employment, credit, insurance, education, legal, Restricted Product, international, biometric, location, minor, or other heightened capability requires a separately completed specialist section and Activation Record.