Data Processing Addendum

This Data Processing Addendum (the "Addendum") forms part of the Terms of Service, or any other written agreement for the Services, between Vitabyte, Inc., a New York corporation with its principal office at 3525 30th Ave, Suite 306, Astoria, NY 11103 ("Vitabyte"), and the customer that accepts it ("Customer"). Together those terms are the "Agreement".

This Addendum applies whenever Vitabyte processes Customer Personal Data on Customer's behalf in providing the Services. It does not apply to personal data that Vitabyte handles as an independent controller or business, such as account, sign-in, billing and acceptance records, which are covered by our Privacy Policy.

Customer accepts this Addendum for itself and, where the law requires, for its affiliates that use the Services under Customer's account.

Capitalized terms not defined here have the meaning given in the Agreement.

• "Data Protection Laws" means all privacy and data protection laws of the United States and its states that apply to the processing of Customer Personal Data under the Agreement, including the California Consumer Privacy Act as amended by the California Privacy Rights Act and its regulations ("CCPA"), other state consumer privacy laws, and the New York SHIELD Act; and, where they apply to a particular transfer or processing activity, the laws of other countries.
• "Customer Personal Data" means personal data that Customer, its users or its end users submit to the Services, or that the Services collect on Customer's behalf, and that Vitabyte processes as a processor or service provider. It includes data about Customer's guests, employees, job applicants, contacts, and the devices and device users Customer manages.
• "Personal data" means information that identifies, relates to, describes or is reasonably capable of being linked to an identified or identifiable natural person or household, and includes "personal information" as defined in Data Protection Laws.
• "Processing" means any operation performed on personal data, such as collection, recording, storage, use, retrieval, disclosure, transfer, erasure or destruction.
• "Controller" includes a "business"; "processor" includes a "service provider" or "contractor", each as defined in Data Protection Laws.
• "Data Subject" means the person to whom Customer Personal Data relates.
• "Security Incident" means a breach of security that leads to the accidental or unlawful destruction, loss, alteration, unauthorized disclosure of, or access to, Customer Personal Data in Vitabyte's or its sub-processors' systems. It does not include unsuccessful attempts that do not compromise the security of Customer Personal Data, such as blocked scans, failed sign-in attempts or denial-of-service attacks.
• "Sub-processor" means a third party that Vitabyte engages to process Customer Personal Data.
• "Services" means the Vitabyte products Customer uses under the Agreement, which may include Translink, VITAPOS, VitaRemote, VITABYTE CRM, Angie, Angie Eats and F&B inventory.

• Customer is the controller of Customer Personal Data, or acts as a processor on behalf of its own controller. Vitabyte is Customer's processor or, where Customer is itself a processor, Customer's sub-processor.
• Customer is responsible for having a lawful basis for the processing, for giving the notices and obtaining the consents that Data Protection Laws require, including for employee monitoring, VitaRemote remote sessions and session recording, marketing messages and phone-call transcription, and for the accuracy of the data it submits.
• Customer will not instruct Vitabyte to process data in a way that violates Data Protection Laws, and will not submit to the Services full payment card numbers, security codes, or any category of data the Agreement prohibits.

• Vitabyte will process Customer Personal Data only on Customer's documented instructions. The Agreement, this Addendum, Customer's configuration of the Services, and actions by Customer's authorized users in the Services are Customer's complete instructions. Additional instructions require written agreement.
• Vitabyte may process Customer Personal Data otherwise only where the law requires it. In that case Vitabyte will tell Customer before processing, unless the law prohibits that notice.
• Vitabyte will inform Customer promptly if, in its opinion, an instruction violates Data Protection Laws. Vitabyte is not required to perform legal review of Customer's instructions.
• Vitabyte may create aggregated or de-identified data from its operation of the Services to secure, maintain and improve them, provided the data cannot reasonably be linked back to Customer or any Data Subject, and Vitabyte publicly commits to keep it in that form and not attempt to re-identify it.

• When Customer uses Angie, Chat or set-up assistance, Vitabyte sends to the configured language-model provider only the data needed to answer the request, limited to what the requesting user is permitted to see.
• The language-model provider is configured by a Vitabyte super administrator and is a Sub-processor under section 9.
• Vitabyte will not use Customer Personal Data to train third-party foundation models, and will engage model providers only on terms that prohibit them from doing so.
• Actions taken through an AI feature run under the requesting user's permissions and any approvals Customer requires, and are recorded in the audit trail.

Vitabyte will ensure that every person it authorizes to process Customer Personal Data is bound by a written or statutory duty of confidentiality, receives appropriate privacy and security training, and has access only to the extent needed to perform their duties. Access to production data is granted individually, recorded, and removed when no longer needed.

• Vitabyte will implement and maintain the technical and organizational measures in Annex 1, which are designed to protect Customer Personal Data against Security Incidents and are appropriate to the risk. These measures form part of Vitabyte's written information security program under the New York SHIELD Act.
• Vitabyte may update the measures over time, provided the update does not materially lower the overall level of protection.
• Customer is responsible for its own security choices in the Services, including user access, enforcing multi-factor authentication for its users, protecting its credentials and API keys, the devices it connects, and settings such as whether VitaRemote prompts device users before a session.
• Payment card data is entered into fields or terminals provided by Customer's payment processor. The Services store tokens and the last four digits, not full card numbers. Each party remains responsible for its own obligations under the Payment Card Industry Data Security Standard.

• Customer gives general authorization for Vitabyte to engage Sub-processors. The current list is available on request in writing by mail (certified mail or courier) to Vitabyte, Inc., Attn: George Karabelas, CEO, 3525 30th Ave, Suite 306, Astoria, NY 11103.
• The categories of Sub-processors are: infrastructure hosting, storage and backup; email, text-message and telephone delivery; identity and anti-abuse services; language-model providers for AI features; support and ticketing tools; and error monitoring.
• Payment processors, gateways, point-of-sale systems, delivery platforms, and other third-party services that Customer chooses to connect are not Vitabyte's Sub-processors. They act under Customer's own agreements with them, and Vitabyte sends data to them on Customer's instruction.
• Vitabyte will impose on each Sub-processor written data protection obligations that are no less protective than this Addendum, to the extent appropriate to the service it provides. Vitabyte remains responsible for each Sub-processor's performance of those obligations.
• Notice and objection. Vitabyte will give at least 30 days' notice before a new Sub-processor begins processing Customer Personal Data, by updating the list and notifying Customer's administrators by email or in the Services. Customer may object in writing by mail (certified mail or courier) to Vitabyte, Inc., Attn: George Karabelas, CEO, 3525 30th Ave, Suite 306, Astoria, NY 11103 within that period on reasonable grounds relating to data protection. The parties will discuss the objection in good faith. If Vitabyte cannot offer a reasonable alternative, Customer may terminate the affected Service by written notice and receive a refund of prepaid fees for the unused period of that Service.
• In an emergency that threatens the security or availability of the Services, Vitabyte may replace a Sub-processor with shorter notice, and will give notice as soon as practicable afterwards. The objection right still applies.

• The Services give Customer tools to find, export, correct and delete Customer Personal Data, subject to records that must be kept by law or kept append-only for integrity, such as financial records, labor records and the audit trail.
• If Vitabyte receives a request from a Data Subject concerning Customer Personal Data, it will not respond on its merits except to direct the person to Customer, and will pass the request to Customer without undue delay where the request identifies Customer.
• Where Customer cannot fulfil a request using the tools, Vitabyte will provide reasonable assistance on written request. Vitabyte may charge reasonable fees for assistance beyond what the tools provide, unless the need arises from Vitabyte's breach.
• Vitabyte will provide reasonable information to help Customer carry out data protection assessments and consult with regulators, where Customer does not otherwise have access to that information.

• Vitabyte will notify Customer of a confirmed Security Incident without undue delay and in any event within 72 hours after becoming aware of it.
• The notice will go to Customer's administrators and any security contact Customer has recorded. It will describe, so far as then known, the nature of the incident, the categories and approximate number of Data Subjects and records affected, the likely consequences, the measures taken or proposed, and a contact for more information. Vitabyte will provide further information as it becomes available.
• Vitabyte will take reasonable steps to contain, investigate and remedy the incident, and will reasonably cooperate with Customer's own investigation and notifications.
• Unless the law requires otherwise, Customer decides whether to notify Data Subjects and regulators about Customer Personal Data, and Vitabyte will not name Customer in a public notice without Customer's consent.
• Notice under this section is not an admission of fault or liability.

Documentation. On written request, no more than once in any 12-month period, Vitabyte will provide information reasonably needed to demonstrate compliance with this Addendum, such as a summary of its security program, responses to a reasonable security questionnaire, and any independent assessment reports it then holds, all under confidentiality.

On-site or remote audit. If that information is not enough to demonstrate compliance, or a regulator requires it, or after a Security Incident affecting Customer Personal Data, Customer may conduct an audit, itself or through an independent auditor bound by confidentiality who is not a competitor of Vitabyte, subject to these limits:

1. at least 30 days' written notice with a proposed scope, unless a regulator or a Security Incident requires shorter notice;
2. no more than once in any 12-month period, except where a regulator requires it or after a Security Incident;
3. during normal business hours, without unreasonable disruption to Vitabyte's operations;
4. without access to other customers' data, or to information that would compromise the security of the Services;
5. at Customer's expense, including Vitabyte's reasonable time at its then-current rates, unless the audit reveals a material breach of this Addendum by Vitabyte.

Customer will share a copy of the audit report with Vitabyte, and Vitabyte will promptly address any material non-compliance it confirms.

• During the term, Customer may export Customer Personal Data using the Services' export features.
• After the Agreement ends, Vitabyte will keep Customer Personal Data available for export for 30 days, and will then delete it within 90 days, except as below.
• Backups are overwritten on their normal cycle and are not restored except to recover from a disaster. Data in backups remains protected by this Addendum until overwritten.
• Vitabyte may keep Customer Personal Data where the law requires it, and may keep the append-only audit trail and acceptance records as evidence for as long as a claim could be brought. Kept data remains protected by this Addendum and is processed only for those purposes.
• On written request, Vitabyte will confirm deletion in writing.
• Retention periods during the term are set out in our Data Retention and Deletion Policy.

Where Customer Personal Data is subject to the CCPA or a similar state law, Vitabyte, as a service provider or processor:

• will not sell or share Customer Personal Data, as those terms are defined in the CCPA;
• will not retain, use or disclose Customer Personal Data for any purpose, including any commercial purpose, other than the business purposes specified in this Addendum and the Agreement, or as the law otherwise permits a service provider;
• will not retain, use or disclose Customer Personal Data outside the direct business relationship between Customer and Vitabyte;
• will not combine Customer Personal Data with personal data it receives from or on behalf of another person, or collects from its own interactions with a consumer, except as the CCPA permits a service provider to do;
• will comply with applicable obligations under the CCPA and provide the same level of privacy protection the CCPA requires;
• will notify Customer if it determines it can no longer meet its obligations under the CCPA;
• grants Customer the right, on notice, to take reasonable and appropriate steps to stop and remedy unauthorized use of Customer Personal Data;
• will contract with Sub-processors on terms that impose these same obligations.

Vitabyte certifies that it understands and will comply with these restrictions.

• Vitabyte provides the Services from the United States, and Customer Personal Data is stored and processed primarily in the United States.
• If Customer transfers to Vitabyte personal data that is subject to the data protection law of the European Economic Area, the United Kingdom or Switzerland, the parties agree that the Standard Contractual Clauses adopted by the European Commission (Module Two, controller to processor, or Module Three, processor to processor, as applicable), with the UK International Data Transfer Addendum or Swiss amendments where relevant, are incorporated by reference. For that purpose: Annex 1 of this Addendum supplies the security measures; section 4 supplies the description of the transfer; the optional docking clause and the option in Clause 11 do not apply; general authorization applies to Sub-processors with the notice period in section 9; and the governing law and forum are those of Ireland, unless the clauses require otherwise.
• If the Standard Contractual Clauses conflict with this Addendum, the clauses govern for that transfer.
• Vitabyte will not transfer Customer Personal Data to a Sub-processor in another country without a transfer safeguard that Data Protection Laws require.

Each party's liability arising out of or related to this Addendum, whether in contract, tort or otherwise, is subject to the limitations and exclusions of liability in the Agreement. Those limits apply in aggregate to all claims under the Agreement and this Addendum together. Nothing in this section limits either party's liability to Data Subjects where the law does not allow it to be limited.

If there is a conflict between documents, the following order applies, highest first:

1. the Standard Contractual Clauses, where they apply under section 15;
2. this Addendum, as to the processing of Customer Personal Data;
3. the Agreement, including the Terms of Service and any order form;
4. the Privacy Policy, which describes Vitabyte's practices but does not create obligations to Customer beyond this Addendum.

• This Addendum is governed by the law of the State of New York, and disputes about it are resolved in the courts the Agreement specifies, the state and federal courts located in the Eastern District of New York, except as section 15 provides for the Standard Contractual Clauses.
• Vitabyte may update this Addendum to reflect changes in Data Protection Laws or the Services, with notice to Customer. An update will not materially lower the protection of Customer Personal Data without Customer's agreement. The Services record which version Customer accepted.
• If any provision is held unenforceable, the rest remains in effect.
• This Addendum ends when Vitabyte no longer processes Customer Personal Data, except that sections that by their nature should survive will survive.

This Addendum is accepted electronically. An administrator of Customer accepts it by ticking the acceptance box and typing their full name and title, which is their electronic signature and has the same effect as a handwritten signature under the federal E-SIGN Act and the New York Electronic Signatures and Records Act. The administrator confirms they are authorized to bind Customer. The Services record the version of this Addendum, a SHA-256 hash of its text, the date and time, the network address and the browser user agent, in an append-only record.

Notices to Vitabyte under this Addendum: in writing by mail (certified mail or courier) to Vitabyte, Inc., Attn: George Karabelas, CEO, 3525 30th Ave, Suite 306, Astoria, NY 11103.