1.    SCOPE AND SUBJECT MATTER OF THE AGREEMENT

This Data Processing Agreement (“DPA”) is an agreement between LiveDispatcher s.r.o., a limited liability company with a registered seat at Krásnohorská 22, 851 07 Bratislava, the Slovak Republic, Business Registration No.: 45 355 517, registered with the Commercial Register of District Court Bratislava I, Section: Sro, Insert No.: 64082/B (“OrderLord”, “Processor”, “we,” “us,” or “our”) and you or the entity you represent (“Customer”, “Controller”, “you” or “your”). This DPA supplements the OrderLord Terms of Service (“TOS”) available at https://app.orderlord.com/tos, as updated from time to time between Customer and OrderLord. Unless otherwise defined in this DPA, all capitalized terms used in this DPA will have the meanings given to them in Section 2 of this DPA.

2.    DEFINITIONS

Controller means the natural or legal person, public authority, agency, or other body that, alone or jointly with others, determines the purposes and means of the processing of Personal Data.

Data Protection Laws mean all laws and regulations, including laws and regulations of the European Union, the European Economic Area, and their Member states, applicable to the Processing of Personal Data under the DPA.

GDPR means REGULATION (EU) 2016/679 OF THE EUROPEAN PARLIAMENT AND OF THE COUNCIL of 27 April 2016 on the protection of natural persons with regard to the processing of personal data and on the free movement of such data, and repealing Directive 95/46/EC (General Data Protection Regulation).

Non-adequate country means a country deemed not to provide an adequate level of protection for Personal Data within the meaning of Regulation (EU) 2016/679.

Personal Data means any information relating to an identified or identifiable natural person (‘data subject’).

Personal Data Breach means the unauthorized acquisition, access, use, or disclosure of Personal Data.

Personnel means all employees, directors, contractors, sub-contractors, representatives, agents, and/or the employees of such contractors, sub-contractors, representatives, and agents.

Process or Processing means any operation or set of operations that is performed on Personal Data or on sets of Personal Data, whether or not by automated means, such as collection, recording, organization, structuring, storage, adaptation or alteration, retrieval, consultation, use, disclosure by transmission, dissemination or otherwise making available, alignment or combination, restriction, erasure or destruction.

A processor means a natural or legal person, public authority, agency, or other body which processes Personal Data on behalf of the Controller.

Services mean the services provided to the Customer under the TOS.

Sub-processor or Sub-contractor means a third party sub-contractor engaged by the Processor which, as part of the subcontractor’s role of delivering the Services, Processes the Personal Data of the Customer.

Technical and Organisational Measures means those measures aimed to ensure a level of security appropriate to the risk of Processing.

3.    TERM AND APPLICATION OF THIS DPA

3.1    This DPA shall be valid and effective as of the day the Customer accepts the TOS and it shall continue in force until the termination of Services either by Customer or OrderLord pursuant to TOS.

3.2    This DPA shall apply to:

a) all Personal Data provided from the effective date of this DPA by the Customer to OrderLord for Processing;

b) all Personal Data otherwise received by OrderLord for Processing on Customer’s behalf in relation to the Services.

4.    CUSTOMER INSTRUCTIONS

4.1    The Customer acting as Controller instructs OrderLord to carry out the processing of Personal Data as further specified herein.

4.2    When carrying out Processing, OrderLord will act only on the basis of documented instructions of the Customer and perform the Processing of Personal Data only for the purposes determined by the Customer.

4.3    The Customer warrants that Personal Data that will be processed by OrderLord under this DPA have been collected by the Customer in accordance with Data Protection Laws and the Processing of the Personal Data may be delegated to OrderLord accordingly. Notably, the Customer has an obligation to assess the lawfulness of the processing of Personal Data stored on the OrderLord management delivery system.

4.4    The control of Personal Data remains with the Customer, and as between the Customer and OrderLord, the Customer shall at all times remain the Controller for the purposes of the Processing, the TOS, and this Data Processing Agreement.

5.    CATEGORIES OF PERSONAL DATA AND PURPOSE OF THE PERSONAL DATA PROCESSING

5.1    In order to perform the Services, the Customer authorizes and requests that OrderLord process the following Personal Data which are uploaded by the Customer into the OrderLord delivery management system:

a) contact details of Customers’ clients: name, address, GPS coordinates of address, e-mail, and phone number, which are necessary for processing of orders (including notification of clients about the order status);

b) e-mails of Customer’s clients in order to inform clients about Customers’ promotions or events;

c) order details: these include, in addition to the details of clients under points (a) and (b) above, notes about a client, ordered food, time of placing the order, expected time of delivery, time of cancellation of the order, time of skipping the order (if applicable) and the actual time of delivery, details about the ordered food (description, price, discount, delivery fee, tip for the driver, payment method) for purpose of providing an overview about each order and generation of financial and statistical reports.

d) details of Customer’s drivers: name, phone number, photo, GPS location, e-mail, and time of last online access, which are necessary for managing drivers.

6.    CATEGORIES OF DATA SUBJECTS

6.1    Data subjects include clients of the Customer and the Customer’s employees, contractors, or partners. Data subjects may also include individuals attempting to communicate or transfer any Personal Data while using the Services.

7.    NON-DISCLOSURE AND CONFIDENTIALITY

7.1    OrderLord will keep Personal Data confidential and will not disclose Personal Data in any way to any third party without the prior written approval of Customer, except where: (i) disclosure is necessary for the performance of Services or the performance of the Processing; or (ii) subject to OrderLord’s obligations related to inquiries and incidents in this DPA, where Personal Data need to be disclosed to a competent public authority to comply with a legal obligation.

7.2    OrderLord will provide its personnel with access to Personal Data only to the extent necessary to perform the Processing. OrderLord will ensure that any Personnel it authorizes to have access to Personal Data processed by or on behalf of OrderLord, will respect and maintain the confidentiality and security of such Personal Data.

8.    RESPONSIBILITY OF ORDERLORD

8.1    OrderLord shall Process Personal Data solely for the provision of the Services, and agrees to:

a) Process and use Personal Data for the purposes set forth in this DPA or only on documented instructions from the Customer and for no other purpose except with the express prior written consent of the Customer, or

b) Not divulge Personal Data to third parties except to those of its Personnel who are engaged in the processing of the Personal Data and are subject to the binding obligations or except as may be required by any law or regulation;

c) Implement appropriate Technical and Organizational Measures to safeguard Personal Data from unauthorized or unlawful Processing or accidental loss, destruction, or damage, regarding the state of technological development and the cost of implementing any measures. Such measures shall ensure a level of security appropriate to the harm that might result from unauthorized or unlawful Processing or accidental loss, destruction, or damage and to the nature of the Personal Data to be protected;

d) Inform the Customer, as soon as possible, in the event of the exercise by Data Subjects of any of their rights under the Data Protection Laws in relation to the Personal Data, and, if necessary, assists the Customer in complying with the obligation to respond to those requests.

8.2    OrderLord shall maintain the records of Processing activities as required by Data Protection Laws.

9.    CROSS BORDER AND ONWARD DATA TRANSFER

9.1    OrderLord shall not transfer Personal Data to any Non-adequate country or make such Personal Data accessible from any such Non-adequate country without fulfillment of the legal requirements of transfer Personal Data to a Non-adequate country according to Data Protection Laws and without prior notification of Customer.

9.2    If OrderLord uses a Sub-processor based in a Non-adequate country, OrderLord will enter into an agreement with the Sub-processor in accordance with the EU model contract. OrderLord will provide a copy of the agreement with the Sub-processor to the Customer, immediately upon the request of the Customer.

9.3    In case of breach of any of the foregoing warranties, the Customer may terminate this DPA with immediate effect.

9.4    OrderLord uses trusted third parties listed below to provide its Services such as cloud computing services providers and cloud communications platform providers.

Amazon Web Services Inc., with registered seat at 410 Terry Avenue North, Seatlle, WA 98109-5210, USA

DigitalOne LLC, with registered seat at 101 Avenue of the Americas 10th Floor New York, NY 10013, USA

EuroSMS s.r.o., with registered seat at Račianska 71, 831 02, Bratislava, Slovakia

Twillio Inc., with registered seat at 645 Harrison Street 3rd Floor San Francisco, CA 94107 USA

9.5    OrderLord uses the following trusted partner to provide its Services such as external delivery service.

OTL Omega Telematics and Logistics ltd., with registered seat at Premiere House, Wing B, 2nd Floor, Borehamwood WD6 1JH, UK

10.    SUB-PROCESSING

10.1    OrderLord shall not subcontract any of its processing operations performed on behalf of the Customer under this DPA and the TOS without the prior consent of the Customer.

10.2    Where OrderLord subcontracts its obligations under the DPA, with the consent of the Customer, it shall do so only by way of a written agreement with the Sub-processor which imposes the same obligations on the Sub-processor as are imposed on OrderLord under this DPA. Where the Sub-processor fails to fulfill its data protection obligations under such written agreement OrderLord shall remain fully liable to the Customer for the performance of the Sub-processor’s obligations under such agreement.

10.3    The Customer as Controller may request that OrderLord audit the Sub-processor or provide confirmation that such an audit has occurred (or, where available, obtain or assist Controller in obtaining a third-party audit report concerning Sub-processor’s operations) to ensure compliance with such obligations. The Controller also will be entitled, upon written request, to receive copies of the relevant terms of OrderLord’s agreement with Sub-processors that may process Personal Data, unless the agreement contains confidential information, in which case OrderLord may provide a redacted version of the agreement.

11.    TECHNICAL AND ORGANIZATIONAL MEASURES

11.1    When Processing Personal Data on behalf of Customer in connection with the Services, OrderLord shall ensure that it implements and ensures compliance with appropriate Technical and Organizational Measures for the Processing of such data. Accordingly, OrderLord will implement the following measures designated to:

deny unauthorized persons access to data-processing equipment used for processing Personal Data (equipment access control);

prevent the unauthorized reading, copying, modification, or removal of data media (data media control);

prevent the unauthorized input of Personal Data and the unauthorized inspection, modification or deletion of stored Personal Data (storage control);

prevent the use of automated data-processing systems by unauthorized persons using data communication equipment (user control);

ensure that persons authorized to use an automated data-processing system only have access to the Personal Data covered by their access authorisation (data access control);

ensure that it is possible to verify and establish to which individuals’ Personal Data have been or may be transmitted or made available using data communication equipment (communication control);

ensure that it is subsequently possible to verify and establish which Personal Data has been put into automated data-processing systems and when and by whom the input was made (input control);

prevent the unauthorized reading, copying, modification, or deletion of Personal Data during transfers of those data or during transportation of data media (transport control);

ensure that installed systems may, in case of interruption, be restored (recovery);

ensure that the functions of the system perform, that the appearance of faults in the functions is reported (reliability), and that stored Personal Data cannot be corrupted by means of a malfunctioning of the system (integrity); and

encrypt all Customers’ passwords to the OrderLord delivery management system.

11.2    No person will be appointed by OrderLord to Process Personal Data unless that person: (i) is competent and qualified to perform the specific tasks assigned to him by OrderLord; (ii) has been authorized by OrderLord; and (iii) has been fully instructed by OrderLord in the procedures and statutory regulations relevant to the performance of the obligations of OrderLord under this DPA, in particular the limited purpose of the Personal Data Processing.

12.    AUDIT RIGHTS

12.1    The Customer may audit OrderLord’s compliance with the terms of the Agreement and this DPA up to once per year.

12.2    If a third party is to conduct the audit, such a third party must be mutually approved by both parties and must execute a written confidentiality agreement acceptable to OrderLord before conducting the audit.

12.3    To request an audit, the Customer must submit a detailed audit plan at least 4 weeks in advance of the proposed audit date describing the proposed scope, duration, and start date of the audit. OrderLord will review the audit plan and provide the Customer with any concerns or questions (for example, any request for information that could compromise OrderLord’s security, privacy, or employment policies).

12.4    The audit reports are confidential information of the parties under the terms of the DPA. Any audits are to be performed at the Customer’s expense.

12.5    Any request for OrderLord to provide assistance with an audit is considered a separate service if such audit assistance requires the use of different or additional resources. OrderLord will seek the Customer’s written approval and agreement to pay any related fees before performing such audit assistance.

13.    INCIDENT MANAGEMENT AND BREACH NOTIFICATION

13.1    OrderLord evaluates and responds to incidents that create suspicion of unauthorized access to, or handling of, Personal Data

13.2    The Customer is informed of such incidents and, depending on the nature of the activity, defines escalation paths and response teams to address those incidents. OrderLord will work with the Customer and with the appropriate technical teams to respond to the incident. The goal of the incident response will be to restore the confidentiality, integrity, and availability of the Services environment, and to establish root causes and remediation steps.

13.3    OrderLord operations staff is instructed on responding to incidents where handling of Personal Data may have been unauthorized.

13.4    OrderLord shall notify the Customer without undue delay after becoming aware of a Personal Data breach. OrderLord shall promptly investigate any security breach and take reasonable measures to identify its root cause(s) and prevent a recurrence. As information is collected or otherwise becomes available unless prohibited by law, OrderLord will provide the Customer with a description of the security breach, the type of data that was the subject of the breach, and other information the Customer may reasonably request concerning the affected persons. The parties agree to coordinate in good faith on developing the content of any related public statements or any required notices for the affected persons.

14.    OBLIGATION AFTER THE TERMINATION OF PERSONAL DATA PROCESSING SERVICES

14.1    The parties agree that on the termination of the Services, OrderLord will anonymize any Personal Data that belong to Customer and that are stored in the OrderLord delivery management system, unless applicable laws prevent all or part of this Personal Data from anonymization. In that case, OrderLord warrants it will not actively Process those Personal Data anymore and it will keep those Personal Data confidential.

15.    GOVERNING LAW

15.1    This DPA (and any further rules, policies, or guidelines incorporated by reference) shall be governed and construed in accordance with the laws of Slovakia, without giving effect to any principles of conflicts of law.