Data Processing Addendum

Last Updated: 7 November 2026

Status: Draft for legal and operational review

This Data Processing Addendum (DPA) forms part of the User & Subscription Agreement between DocResto, operated by [Legal Name / Business Name] (Service Provider), and the subscribing business identified in its Order Form (Customer). It applies where DocResto processes personal data on behalf of Customer in providing its subscribed restaurant operations software. The parties shall complete the schedules below before signing.

1. Definitions and roles

Customer determines the purposes and essential means of processing personal data submitted by or on behalf of its business and acts as controller or equivalent responsible party where applicable. DocResto acts as processor or service provider for such data, except for account administration, billing, security and legal compliance information that DocResto determines and processes for its own legitimate purposes. Data Subject means an identifiable natural person; Personal Data means information relating to such person; Subprocessor means a provider engaged by DocResto to process Customer Personal Data.

2. Documented instructions

DocResto will process Customer Personal Data only on Customer's documented instructions, including the Agreement, configuration choices, authorised support requests and this DPA, unless applicable law requires otherwise. Customer instructs DocResto to host, receive, record, organise, calculate, analyse, retrieve, transmit, back up, secure, troubleshoot, return and delete data as necessary for the Services. DocResto shall inform Customer if an instruction appears unlawful, where permitted and reasonably practicable.

3. Customer obligations

Customer warrants that it has all necessary authority, notices, permissions and lawful grounds for collection and disclosure of personal data, including information about staff, guests, suppliers and delivery recipients. Customer determines retention requirements, configures permissions and is responsible for data accuracy and lawful instructions.

Customer shall not upload sensitive or regulated data beyond supported service specifications without prior written agreement.

4. Confidentiality and personnel

DocResto shall limit access to Customer Personal Data to authorised personnel and contractors with a need to know, subject to appropriate confidentiality obligations and access controls.

5. Security measures

DocResto shall maintain reasonable technical and organisational security controls appropriate to the nature and risk of processing, including access controls, authentication, encryption in transit where supported, logging, vulnerability management, backup procedures, incident response and personnel access management. Specific implemented measures must be confirmed in Schedule B; no unverified security certification or recovery objective is promised.

6. Subprocessors

Customer grants general authorisation to engage subprocessors necessary to operate the Services, including hosting, databases, AI service providers, communications, analytics and support infrastructure, subject to appropriate contractual data-protection obligations. DocResto shall maintain a current subprocessor list and provide notice of material additions or replacements through [notice channel] at least [notice period] before use where reasonably practicable. Customer may raise a substantiated objection within [objection period]; parties shall discuss a commercially reasonable alternative, and if none exists Customer may terminate the affected service subject to applicable commercial terms.

7. International transfers

Customer authorises processing in the locations disclosed in Schedule C. DocResto shall apply any safeguards required by laws applicable to the transfer. Locations, providers and transfer mechanisms must be verified before execution; this DPA does not represent that all data stays in Pakistan.

8. Security incidents

DocResto shall notify Customer without undue delay after confirming a personal-data breach affecting Customer Personal Data, and provide available information about its nature, likely effects, containment and remedial steps. Initial notice may be incomplete and supplemented as investigation proceeds. Customer is responsible for legally required notifications to affected persons or regulators unless law assigns that duty to DocResto. A contractual target of [hours] may be inserted after operational validation.

9. Assistance and requests

Taking into account the nature of processing and information available, DocResto shall reasonably assist Customer with access, correction, deletion and other valid data-subject requests, security assessments, incident investigations and regulatory inquiries where legally required. Customer remains responsible for assessing and responding to requests as controller. Reasonable charges may apply for exceptional assistance not otherwise required by law or the Agreement.

10. Retention, return and deletion

Upon termination and subject to available product functionality, Customer may request export of its available Customer Personal Data during [export window]. Following that period, DocResto shall delete or anonymise Customer Personal Data from active systems within [deletion window], unless lawful retention is required. Backup copies will expire under [backup retention schedule] and remain protected pending expiry. DocResto may retain limited billing, security and dispute records as permitted or required by law.

11. Audit and evidence

On reasonable written request, DocResto shall provide available information reasonably necessary to demonstrate compliance with this DPA, subject to confidentiality, security, third-party rights and protection of other customers. Any on-site audit requires prior agreement on scope, timing, costs and safeguards; it shall not expose proprietary source code or unrelated customer data. Mandatory statutory inspection rights prevail.

12. AI-assisted processing

Where Customer enables AI chatbot or analysis features, Customer instructs DocResto to transmit the minimum data reasonably necessary to the disclosed AI provider(s) for the requested functionality. Provider identity, hosting region, retention, model-training terms and applicable safeguards must be listed in Schedule C. AI output may be inaccurate and must be reviewed by Customer. Customer Personal Data shall not be used to train general-purpose third-party models unless expressly disclosed and lawfully authorised.

13. Third-party integrations

Customer authorises exchanges with integrations it activates. An independent third-party provider may act as a separate controller under its own terms; DocResto does not assume control over that provider's independent processing. Subprocessors engaged directly by DocResto remain subject to Section 6.

14. Liability and precedence

The liability allocation and limitations in the Agreement apply to this DPA to the extent permitted by law. Nothing excludes non-excludable statutory obligations. In a conflict concerning processing of Customer Personal Data, this DPA prevails over the general Agreement; mandatory law prevails over both.

15. Duration and governing law

This DPA lasts for the period DocResto processes Customer Personal Data under the Agreement. It is governed by the governing-law provisions of the Agreement, subject to mandatory applicable data-protection law.

SCHEDULE A - PROCESSING DETAILS

Subject matter: provision of restaurant operations and analytics SaaS.

Duration: subscription term plus documented retention and deletion periods.

Nature and purpose: hosting, transaction processing, reporting, analytics, support, security, backup and authorised integrations.

Data subjects: Customer's staff, restaurant guests, suppliers, contractors, business contacts and authorised users, as applicable.

Categories: identity and contact details, role/access records, order and transaction information, delivery details, supplier and staff records, usage logs and other fields configured by Customer.

Sensitive categories: none intended unless expressly agreed in writing.

SCHEDULE B - SECURITY CONTROLS TO CONFIRM

[Hosting environment and region]; [encryption at rest and in transit]; [access management/MFA]; [role-based access]; [logging and monitoring]; [backup frequency and retention]; [incident response contact]; [vendor access controls]; [deletion procedure].

SCHEDULE C - SUBPROCESSORS AND TRANSFERS TO COMPLETE

[Provider name] | [Purpose] | [Data categories] | [Processing country] | [Retention/training policy] | [Safeguard].

Include Chatular/AI provider if actually used, and separately list any underlying model or infrastructure providers where relevant.

SCHEDULE D - CONTACTS AND EXECUTION

Customer legal name: [Customer entity]

DocResto operating legal name: [Legal Name / Business Name]

Customer privacy contact: [Email]

DocResto privacy contact: [Email]

Effective date: [Date]

Signatures or verified electronic acceptance: [Details]

Operational note: Complete all brackets, confirm actual technical practices and obtain Pakistani legal review before use.