Data Processing Addendum

1. Scope and Roles

This Data Processing Addendum (“DPA”) forms part of the Terms of Service between FastSail Technologies LLC, a Michigan limited liability company doing business as Palate (“Palate,” “Service Provider”), and the restaurant customer (“Customer,” “Business”).

For personal data that Palate processes on Customer’s behalf — including guest data and employee data (“Customer Personal Data”) — Customer is the Business/Controller and Palate is the Service Provider/Processor.

The parties intend for Palate to be a “service provider” (CCPA/CPRA) or “processor” (other US state privacy laws) with respect to Customer Personal Data, and for this DPA to satisfy the contract requirements those laws impose on such relationships.

2. Processing Details

3. Service Provider / Processor Obligations

Palate will:

1. Process only on documented instructions from Customer and only as necessary to provide the Service, unless required by law — in which case Palate will inform Customer first unless legally prohibited.
2. Not sell or share Customer Personal Data, and not retain, use, or disclose it for any purpose other than providing the Service or as otherwise permitted for a service provider under applicable law. Palate certifies that it understands these restrictions and will comply with them.
3. Not combine Customer Personal Data with personal information from other sources, except as permitted for a service provider under applicable law.
4. Ensure confidentiality — personnel authorized to process Customer Personal Data are bound by confidentiality obligations.
5. Implement security measures appropriate to the risk, as set out in Annex II.
6. Engage sub-processors only per Section 5.
7. Assist Customer in responding to consumer rights requests, per Section 6.
8. Assist Customer with security, breach notification, and any required data protection assessments, taking into account the information available to Palate.
9. Return and delete Customer Personal Data at the end of the relationship, per Section 10.
10. Make available the information necessary to demonstrate compliance, and enable Customer to monitor Palate’s compliance, per Section 7.

4. Business / Controller Obligations

Customer will:

1. Provide the notices and obtain the consents required for the personal data it provides and instructs Palate to process — including, for SMS, prior express written consent before any marketing message.
2. Issue instructions that comply with applicable law.
3. Be responsible for the accuracy and legality of Customer Personal Data, including its obligations as the employer of its staff with respect to employee data, wage-and-hour records, and any employee-monitoring notice or consent its state requires before enabling clock-in location or photo capture.

5. Sub-Processors

1. Customer provides general authorization for Palate to engage the sub-processors listed at https://palate.pro/subprocessors, which is the current and controlling list. Annex III reproduces it as of this DPA’s effective date.
2. Palate will impose data protection obligations on each sub-processor substantially similar to those in this DPA.
3. Palate will give Customer at least 30 days’ advance notice of a new sub-processor, by email to the account’s billing contact and by updating the sub-processor page. Customer may object on reasonable data protection grounds within that period. If the parties cannot resolve the objection, Customer may terminate the affected part of the Service and receive a refund of prepaid fees covering the period after termination.
4. Palate remains liable for its sub-processors’ performance of these data protection obligations.

6. Consumer Rights Requests

Palate will assist Customer, by appropriate technical and organizational measures and taking into account the nature of the processing, in fulfilling Customer’s obligation to respond to consumer rights requests — access, deletion, correction, portability, and opt-out.

If Palate receives a request directly from a consumer or an employee about Customer Personal Data, Palate will refer that person to Customer, notify Customer of the request within five business days, and provide the records Customer needs in order to respond.

7. Audits and Compliance Verification

Palate will make available the information necessary to demonstrate compliance with this DPA.

Palate satisfies a verification request by providing its then-current security documentation, including its SOC 2 Type II report once available, and by responding to a reasonable security questionnaire. Where that is insufficient for Customer to meet a specific legal obligation, Customer may request an assessment, no more than once in any twelve-month period except following a personal data breach, on at least 30 days’ written notice, during business hours, without unreasonable disruption, at Customer’s expense, subject to confidentiality, and limited to systems and records relevant to Customer Personal Data. Palate need not disclose another customer’s data or information that would compromise its security.

8. Personal Data Breach

Palate will notify Customer without undue delay and in any event within 72 hours of becoming aware of a breach of security leading to the unauthorized access to, disclosure of, or destruction of Customer Personal Data.

The notice will describe, to the extent known: the nature of the breach and the categories and approximate number of data subjects and records affected; the likely consequences; the measures taken or proposed; and a contact point for further information. Palate will supplement the notice as more becomes known, and will provide the information reasonably available to assist Customer’s own notification obligations under applicable US state breach notification laws.

Customer, as the business, is responsible for notifying affected individuals and regulators where the law requires it. Palate will not notify Customer’s data subjects on Customer’s behalf without Customer’s instruction, except where Palate is independently required to.

9. Liability

This DPA is subject to the limitation of liability in Section 12 of the Terms of Service. Palate’s breach of its data protection obligations under this DPA is one of the excluded claims listed there, and is therefore not subject to the fee-based liability cap.

10. Return and Deletion of Customer Personal Data

This Section states what Palate actually does, and matches the commitment Palate publishes to its customers and the Terms of Service.

During the term. Customer may export Customer Personal Data at any time using the export functions in the Admin application, and may request an export from Palate, which Palate will provide within 10 business days.

On termination.

1. Return — 30 days. Customer keeps read-only access for 30 days to view and export Customer Personal Data. Palate will also provide an export on request during this window, within 10 business days.
2. Retention — a further 90 days. Palate retains the data for 90 further days so that Customer can return without data loss.
3. Deletion — after 120 days. At the end of that 120-day period Palate permanently deletes Customer Personal Data from its active systems.
4. Exceptions. Palate may retain records it is required to keep by law, such as transaction and tax records, and the security audit log for its 13-month retention period. Copies in routine encrypted backups are overwritten on Palate’s ordinary backup cycle. Retained copies remain subject to this DPA and are not processed for any other purpose.

Earlier deletion on instruction. Customer may instruct Palate in writing to delete Customer Personal Data earlier than the schedule above, and Palate will do so within 30 days of the instruction, subject to the same legal-retention exceptions. Deleting earlier forfeits the return window in step 1, so Customer should export first.

11. Term

This DPA terminates with the Terms of Service, except for provisions that by their nature survive — including Sections 8, 9, and 10.

Annex I — Processing Description

See Section 2.

Annex II — Technical and Organizational Measures

• Encryption: TLS in transit with HSTS; AES-256-GCM for sensitive secrets such as MFA seeds at rest; database encryption at rest provided by the managed hosting platform.
• Access control: Role-based access; data scoped per restaurant location so one location cannot reach another’s data; opaque session tokens with instant revocation; multi-factor authentication available for owner and manager accounts; re-authentication for sensitive operations; PIN-based staff access with manager overrides.
• Authentication hardening: Argon2id password hashing, breach-password screening, rate limiting, and account lockout.
• Audit logging: A tamper-evident, insert-only audit log retained for 13 months in active systems, then archived to cold storage and purged. The archive and purge job runs under a separate database role with narrowly limited permissions.
• Monitoring: Error and performance monitoring via Sentry with personal information scrubbed from reports; uptime monitoring with a public status page.
• Network security: Web application firewall; HSTS; CSRF protection; restricted cross-origin access; private networking between application and data services.
• Operational: Centralized secret management; principle of least privilege; separate least-privilege database credentials for migrations and for archival.
• Resilience: The managed database platform provides a high-availability standby and point-in-time recovery. Backups are encrypted.
• Payment card data: Out of scope for this DPA — Palate stores, processes and transmits no full card numbers; card data is captured by Stripe and never enters Palate’s systems. Palate’s written acknowledgement of its responsibility for the security of account data it could affect, and its undertaking to supply its Attestation of Compliance on request, are in Section 4.9 of the Terms of Service (PCI DSS Requirement 12.9).

Palate’s recovery time and recovery point objectives are set from measured restore drills rather than asserted in advance; Palate does not commit to a figure it has not tested. Current recovery capability is available to Customer on request under Section 7.

Annex III — Approved Sub-Processors

Reproduced from https://palate.pro/subprocessors as of the effective date. That page controls.