Data Processing and Sharing Agreement

This Data Processing and Sharing Agreement (the "DPA") forms part of the Agreement between The Digital Fox (Cyprus) Ltd., a company registered in Cyprus under registration number HE 415423, with registered office at Kosta Christofidi 5, 4106, Limassol, Cyprus ("Digital Fox"), and the merchant identified in the applicable invoice (the "Merchant"), together the "Parties".

This DPA applies to the processing of personal data in connection with the Digital Fox Services and is entered into pursuant to Article 28 of Regulation (EU) 2016/679 ("GDPR"). Capitalized terms not defined here have the meaning given in the Agreement.

1. Roles of the Parties

The Parties acknowledge that personal data flows between them in three distinct ways, and their roles differ for each:

1.1 Digital Fox as independent controller. Digital Fox is the independent data controller of the personal data it collects directly from guests ("Users") through the Digital Fox Web App in connection with its own digital services, including device information, electronic receipt details, reviews and feedback, and marketing preferences. This processing is governed by Digital Fox's User Privacy Policy and is outside the scope of Sections 3 to 9 of this DPA.

1.2 Digital Fox as processor for the Merchant. Where the Merchant provides personal data to Digital Fox for processing in connection with the Digital Fox Services (for example, data of the Merchant's staff for account administration, or other data processed on the Merchant's documented instructions), Digital Fox acts as processor and the Merchant acts as controller. Sections 3 to 9 of this DPA apply to this processing, as described in Annex 1.

1.3 Controller-to-controller sharing. Where Digital Fox discloses personal data to the Merchant (for example, transaction confirmation details for payment reconciliation, review content, or, with the User's consent, a User's email address for the Merchant's own marketing), each Party acts as an independent controller of the data it processes. Section 10 of this DPA applies to this sharing.

2. Duration

This DPA takes effect on the Effective Date of the Agreement and remains in force for as long as Digital Fox processes personal data in connection with the Agreement.

3. Processing on Documented Instructions

3.1 Digital Fox shall process personal data within the scope of Section 1.2 only on the documented instructions of the Merchant, including with regard to transfers of personal data to a third country, unless required to do so by Union or Member State law to which Digital Fox is subject; in such a case, Digital Fox shall inform the Merchant of that legal requirement before processing, unless that law prohibits such information on important grounds of public interest.

3.2 The Agreement, this DPA, and the Merchant's configuration and use of the Digital Fox Services constitute the Merchant's complete documented instructions. Additional instructions require the prior written agreement of both Parties.

3.3 Digital Fox shall immediately inform the Merchant if, in its opinion, an instruction infringes the GDPR or other applicable data protection law.

4. Confidentiality

Digital Fox shall ensure that persons authorized to process the personal data have committed themselves to confidentiality or are under an appropriate statutory obligation of confidentiality.

5. Security

Digital Fox shall implement appropriate technical and organizational measures to ensure a level of security appropriate to the risk, in accordance with Article 32 GDPR, including as appropriate: encryption of personal data in transit and at rest; measures to ensure ongoing confidentiality, integrity, availability, and resilience of processing systems; measures to restore availability and access to personal data in a timely manner in the event of an incident; and processes for regularly testing and evaluating the effectiveness of these measures.

6. Sub-processors

6.1 The Merchant provides a general written authorization for Digital Fox to engage sub-processors for the processing described in Section 1.2. The current list of sub-processors is available at: thedigitalfox.com/legal/subprocessors.

6.2 Digital Fox shall inform the Merchant of any intended addition or replacement of sub-processors at least fourteen (14) days in advance, by updating the list at the URL above and/or by email, giving the Merchant the opportunity to object on reasonable data protection grounds. If the Parties cannot resolve an objection in good faith, the Merchant may terminate the Agreement in accordance with its terms.

6.3 Digital Fox shall impose on each sub-processor, by way of contract, the same data protection obligations as set out in this DPA, and shall remain fully liable to the Merchant for the performance of each sub-processor's obligations.

7. Assistance

7.1 Taking into account the nature of the processing, Digital Fox shall assist the Merchant by appropriate technical and organizational measures, insofar as this is possible, in fulfilling the Merchant's obligation to respond to requests from data subjects exercising their rights under Chapter III of the GDPR. If a data subject request is made directly to Digital Fox and relates to processing under Section 1.2, Digital Fox shall promptly forward it to the Merchant.

7.2 Digital Fox shall assist the Merchant in ensuring compliance with the obligations in Articles 32 to 36 GDPR (security, breach notification, data protection impact assessments, and prior consultation), taking into account the nature of the processing and the information available to Digital Fox.

8. Personal Data Breach

Digital Fox shall notify the Merchant without undue delay after becoming aware of a personal data breach affecting personal data processed under Section 1.2, and shall provide the Merchant with information reasonably available to it to enable the Merchant to meet its obligations under Articles 33 and 34 GDPR.

9. Deletion, Return, and Audit

9.1 At the end of the provision of the Digital Fox Services, Digital Fox shall, at the choice of the Merchant, delete or return all personal data processed under Section 1.2, and delete existing copies, unless Union or Member State law requires storage of the personal data.

9.2 Digital Fox shall make available to the Merchant all information necessary to demonstrate compliance with the obligations laid down in this DPA, and shall allow for and contribute to audits, including inspections, conducted by the Merchant or an auditor mandated by the Merchant. Audits shall take place no more than once per year, upon at least thirty (30) days' written notice, during normal business hours, without disrupting Digital Fox's operations, and subject to the confidentiality provisions of the Agreement. Digital Fox may first satisfy an audit request by providing recent third-party audit reports, certifications, or equivalent documentation.

10. Controller-to-Controller Sharing

10.1 Where Digital Fox discloses personal data to the Merchant as described in Section 1.3, the Merchant processes that data as an independent controller and shall: (a) process it only for the purposes for which it was disclosed (payment reconciliation and bill matching; review handling; or, where the User has consented, the Merchant's own marketing); (b) comply with applicable data protection law, including maintaining its own privacy notice and lawful basis; (c) not disclose the data to third parties except as permitted by applicable law; and (d) implement appropriate security measures.

10.2 Where Digital Fox shares a User's email address with the Merchant on the basis of the User's consent for the Merchant's marketing, the Merchant shall: (a) send marketing communications only within the scope of that consent; (b) provide a working opt-out in every communication; (c) cease processing for marketing without undue delay upon the User's objection or withdrawal of consent, whether received directly or notified by Digital Fox; and (d) not combine, enrich, sell, or transfer the data for other purposes.

10.3 Each Party is individually responsible for its own compliance as controller for the data it processes and shall reasonably cooperate with the other in handling data subject requests and inquiries from supervisory authorities that concern the shared data.

11. International Transfers

Neither Party shall transfer personal data processed under this DPA outside the European Economic Area unless it has ensured a valid transfer mechanism under Chapter V of the GDPR, such as an adequacy decision or the European Commission's Standard Contractual Clauses. Where Digital Fox engages sub-processors outside the EEA, Digital Fox shall put such a mechanism in place.

12. Liability and Order of Precedence

12.1 The liability of each Party under this DPA is subject to the limitations and exclusions of liability set out in the Agreement.

12.2 In the event of a conflict between this DPA and the Agreement with respect to the processing of personal data, this DPA prevails.

13. Governing Law

This DPA is governed by the laws of Cyprus, and the courts of Cyprus have exclusive jurisdiction, in accordance with the Agreement.

Annex 1 – Description of Processing (Section 1.2 – Digital Fox as Processor)

• Subject matter: Processing of personal data provided by the Merchant in connection with the provision of the Digital Fox Services.
• Duration: The term of the Agreement, plus any retention period required by law.
• Nature and purpose of processing: Hosting, storage, account administration, display, and technical support necessary to provide the Digital Fox Services (including Digital Fox Insights) to the Merchant.
• Categories of data subjects: The Merchant's employees and other staff members whose data the Merchant provides (e.g., for account access or tip attribution); other individuals whose personal data the Merchant submits to the Digital Fox Services.
• Categories of personal data: Names, business contact details, account credentials and access levels, role information, and any other personal data the Merchant chooses to submit to the Digital Fox Services. No special categories of personal data are intended to be processed.
• Sub-processors: As listed at thedigitalfox.com/legal/subprocessors.