Data Processing Agreement with Annexes 115–117

DATA PROCESSING AGREEMENT

under Article 28 of the General Data Protection Regulation (GDPR)

1. Subject Matter and Relationship to the Agreement

1.1 The Processor operates the software platform "Thank You Vibes" (the "Platform") with the Tipping Module and the Compliance Module. In providing the Platform, the Processor processes personal data on behalf of the Controller.

1.2 This Data Processing Agreement ("DPA") forms part of the agreement between the parties under the Master Platform Terms 112, the applicable Module Terms and any Order (together the "Agreement"). It applies to all modules that the Controller has ordered.

1.3 In matters of data protection, this DPA prevails over the other documents of the Agreement.

1.4 The details of the processing (subject matter, nature and purpose, categories of data and data subjects) are set out in document 115 (Annex 1). The technical and organisational measures are set out in document 116 (Annex 2) and the sub-processors in document 117 (Annex 3). The annexes form part of this DPA.

2. Duration

The processing takes place for the term of the Agreement and, where necessary, for the subsequent period of export, deletion and statutory retention under clause 9.

3. Processing on Behalf and Own Controllership

3.1 This DPA covers only processing that the Processor carries out on behalf of the Controller, as described in document 115 (Annex 1).

3.2 Where the Processor processes personal data as an independent controller, in particular to provide and secure the Platform, to invoice its fees, to prevent fraud and misuse, to comply with its legal obligations and to document the acceptance of contract documents and the confirmations of Workers, this processing is not covered by this DPA. The Privacy Notice Platform 113 describes it.

4. Instructions

4.1 The Processor processes personal data only on documented instructions from the Controller, unless it is required to do so by the law of the European Union, of a Member State or of the Republic of Cyprus. In that case, the Processor informs the Controller of that legal requirement before processing, unless the law prohibits such information on important grounds of public interest.

4.2 Documented instructions are this DPA, the Agreement, the Controller's configuration of the Platform in the Dashboard and individual instructions in text form.

4.3 Instructions that go beyond the agreed scope of services are treated as change requests. The Processor may charge for the additional effort unless otherwise agreed.

4.4 The Processor informs the Controller without undue delay if it considers that an instruction infringes the GDPR or other data protection law. The Processor may suspend the execution of the instruction until the Controller confirms or changes it.

5. Confidentiality

5.1 The Processor ensures that all persons authorised to process personal data have committed themselves to confidentiality or are under an appropriate statutory obligation of confidentiality.

5.2 The Processor restricts access to personal data on a need-to-know basis and ensures that authorised persons process personal data only in accordance with the Controller's instructions.

5.3 The Controller is responsible for the lawfulness of the processing of the personal data it provides, for informing data subjects and, where required, for obtaining their consent.

5.4 The confidentiality obligation survives the termination of this DPA.

6. Security of Processing

6.1 The Processor implements the technical and organisational measures required under Article 32 GDPR to ensure a level of security appropriate to the risk.

6.2 The measures in place when this DPA is concluded are set out in document 116.

6.3 The Processor may develop and adapt the measures, provided that the level of protection is not reduced. The Processor informs the Controller of material changes on request or as part of its general notifications.

7. Sub-processors

7.1 The Controller grants the Processor general written authorisation to engage sub-processors. The sub-processors engaged when this DPA is concluded are listed in document 117.

7.2 Ancillary services that the Processor uses as telecommunications services, postal or transport services, maintenance and user support, disposal of data carriers or other measures to ensure the confidentiality, availability, integrity and resilience of hardware and software are not sub-processing within the meaning of this clause. The Processor nevertheless makes appropriate contractual arrangements and carries out controls for such services.

7.3 The Processor imposes on each sub-processor by contract the same data protection obligations as set out in this DPA. For sub-processors in third countries, clause 11 applies.

7.4 The Processor informs the Controller in text form of any intended addition or replacement of a sub-processor at least four (4) weeks before it takes effect, in particular by updating document 117 and notifying the Controller in the Dashboard or by e-mail.

7.5 The Controller may object to the change in text form within two (2) weeks of receiving the notification on important data protection grounds. If the Controller does not object in time, the change is deemed approved.

7.6 If the Controller objects with justification and the sub-processor is necessary for the provision of the services, the parties will seek an appropriate solution. If no solution is found, either party may terminate the affected module for good cause.

7.7 The Processor remains responsible to the Controller for the performance of the sub-processor's data protection obligations.

8. Assistance

8.1 Taking into account the nature of the processing, the Processor assists the Controller by appropriate technical and organisational measures, insofar as possible, in responding to requests from data subjects exercising their rights under Chapter III GDPR.

8.2 Taking into account the nature of the processing and the information available to it, the Processor assists the Controller in complying with its obligations under Articles 32 to 36 GDPR.

8.3 If data subjects or supervisory authorities contact the Processor concerning data processed on behalf of the Controller, the Processor forwards the request to the Controller without undue delay, where legally permitted, and does not respond to it on the merits without the Controller's instructions.

8.4 The Processor notifies the Controller without undue delay, and in any event within twenty-four (24) hours after becoming aware of it, of any personal data breach affecting data processed on behalf of the Controller. The notification contains, to the extent available at that time:

• a) a description of the nature of the breach;
• b) the categories of data and, where possible, the categories and approximate number of data subjects concerned;
• c) the likely consequences of the breach;
• d) the measures taken or proposed by the Processor to address or mitigate the breach;
• e) the contact details of the Processor's point of contact.

8.5 The Processor makes available to the Controller all information necessary to demonstrate compliance with the obligations laid down in Article 28 GDPR.

9. Export, Deletion and Retention

9.1 For ninety (90) days after the termination of a module, the Controller may export the personal data of that module through the export functions of the Dashboard (in particular CSV or Excel) or request an export from the Processor.

9.2 After this period, the Processor deletes the personal data processed on behalf of the Controller for the terminated module, unless the law requires it to be stored.

9.3 Where statutory retention obligations apply, the Processor restricts the data concerned and processes it only to comply with those obligations until the retention period expires.

9.4 Personal data contained in backup systems may remain technically in existence until the end of the regular backup retention period, at most ninety (90) days, provided that productive access is excluded, the data is not processed for other purposes and deletion takes place in the regular backup cycles.

9.5 The Processor confirms the deletion in text form on request.

10. Audits

10.1 The Processor makes available to the Controller on request all information necessary to demonstrate compliance with this DPA.

10.2 Because the Platform is a multi-tenant system and in order to protect the confidentiality of other customers, the Controller shall primarily rely on suitable evidence, in particular certifications under Article 42 GDPR, reports of independent auditors, penetration test and audit reports, and self-assessments and remote audits.

10.3 Where this evidence is insufficient, the Controller may have audits or inspections carried out by an independent third party bound to confidentiality, after reasonable prior notice, during normal business hours and with due regard to the Processor's operations, security requirements and trade secrets. On-site audits are limited to once per calendar year unless there are specific indications of a material breach.

10.4 The Controller bears the costs of an audit. If the audit reveals a material breach of this DPA or of data protection law for which the Processor is responsible, the Processor bears the reasonable costs of the audit.

11. International Transfers

11.1 Personal data is processed in a third country or transferred to a third country or an international organisation only if the conditions of Chapter V GDPR are met.

11.2 Where the Processor or a sub-processor processes personal data outside the European Economic Area or makes it accessible from there, the Processor ensures an appropriate legal basis under Chapter V GDPR, in particular an adequacy decision of the European Commission (Art. 45 GDPR), including the EU-US Data Privacy Framework, or standard contractual clauses under Commission Implementing Decision (EU) 2021/914, together with supplementary measures where required.

11.3 The Processor informs the Controller on request of the safeguards used.

12. Liability

12.1 The parties are liable to data subjects in accordance with Article 82 GDPR.

12.2 In the internal relationship, the Controller indemnifies the Processor against claims insofar as the damage results solely from a lawful, documented instruction of the Controller and the Processor is not at fault and has not breached this DPA or the GDPR.

12.3 In the internal relationship, the Processor indemnifies the Controller against claims insofar as the damage results from a breach of this DPA or of data protection law for which the Processor is responsible.

12.4 In all other respects, clause 15 of the Master Platform Terms applies, insofar as it does not conflict with mandatory data protection law.

13. Final Provisions

13.1 This DPA takes effect when the Controller accepts it electronically in the ordering process or in the Dashboard, or when both parties sign it. It remains in force for as long as the Processor processes personal data on behalf of the Controller.

13.2 Notices and instructions under this DPA may be given in text form, including e-mail.

13.3 Clause 23 of the Master Platform Terms (governing law, jurisdiction, language, severability) applies.

Annex 1 to the Data Processing Agreement 114

DESCRIPTION OF THE PROCESSING

This annex describes the processing that the Provider carries out on behalf of the Customer under the Data Processing Agreement 114 (Art. 28(3) GDPR).

A. Tipping Module

Subject matter and purpose: provision of the Tipping Module to the Controller: management of Workers, QR codes and tip pools, allocation and reporting of tips, payout reporting, Guest feedback.

Nature of processing: collection, recording, organisation, storage, adaptation, retrieval, use, disclosure by transmission to sub-processors under document 117, alignment, restriction, erasure.

Categories of data subjects: Workers of the Controller; Authorised Users of the Controller; Guests.

Categories of personal data:

• a) Worker master data: name, e-mail address, telephone number, position, unit, assigned place and pool, language, profile photo where provided, bank details (IBAN);
• b) tip and transaction data: amount, currency, date and time, QR code and recipient, status, Platform Usage Fee, net amount, transaction identifiers of the payment service provider;
• c) Guest data: ratings and free-text feedback, e-mail address where provided;
• d) data of Authorised Users: name, e-mail address, telephone number, role and permissions.

B. Compliance Module

Subject matter and purpose: provision of the Compliance Module to the Controller: recording of hotel details, licence route, hotel profile, facilities and installations, and the resulting overview of requirements and forms.

Nature of processing: as under A.

Categories of data subjects: the Controller's hotel manager and other responsible persons named in official forms; Authorised Users.

Categories of personal data: name, function, contact details and other details of responsible persons that the official forms require and that the Controller enters.

C. Common Provisions

Special categories of data (Art. 9 GDPR): not intended. If the Controller enters such data in free-text fields, it does so on its own responsibility.

Place of processing: application server and database in Frankfurt, Germany; Firebase services (except Firebase Cloud Messaging and Firebase Remote Config, which are not tied to a region), e-mail delivery and monitoring in the European Union. Third-country access: see document 117.

Contact at the Processor: legal@thank-you.app. A data protection officer has not been appointed.

Contact at the Controller: the contact details stored in the Dashboard.

Annex 2 to the Data Processing Agreement 114 (Article 32 GDPR)

TECHNICAL AND ORGANISATIONAL MEASURES

1. Confidentiality

1.1 Physical access control. Physical access to the data centres is controlled by their operators (Laravel VPS on DigitalOcean infrastructure, Frankfurt, and Google Cloud, Frankfurt, as listed in document 117), in particular by access control systems, video surveillance and security personnel.

1.2 System access control. Servers are administered only by named staff of the Provider over encrypted connections. Servers are protected by firewalls, and services are logically separated by network segmentation. Staff accounts are personal and protected by multi-factor authentication. Additional measures: password policy with minimum complexity, encryption of laptops, smartphones and data carriers, automatic screen lock.

1.3 Data access control. The number of administrators is limited to the minimum necessary. Access to customer data is restricted to designated staff for specific reasons and is logged. Local copies are deleted without undue delay after use. All staff have signed a confidentiality undertaking.

1.4 Separation control. Logical tenant separation in the software (tenant and place scoping), role-based permission concept including database permissions, separate production and test systems.

1.5 Pseudonymisation. Records are identified by technical IDs instead of plain personal data wherever possible.

2. Integrity

2.1 Transfer control. Data is transmitted between servers and clients only over TLS-encrypted connections (at least TLS 1.2). Data at rest is encrypted at database and storage level. Bank details are additionally encrypted at field level.

2.2 Input control. Creation, modification and deletion of records are logged with user ID and timestamp (audit log). Contract documents and confirmations are stored with version and timestamp. Inputs are validated at application level (e-mail format, IBAN check digit, VIES validation of VAT numbers).

3. Availability and Resilience

3.1 Availability is supported by the data centre features of the hosting provider (fire detection and suppression, climate control, uninterruptible power supply).

3.2 Measures of the Provider: documented backup and recovery concept with regular restore tests, emergency plan, monitoring and alerting, patch management.

4. Rapid Recovery

The Provider regularly tests its automated recovery mechanisms and the systems involved. Backups are retained for at most ninety (90) days.

5. Regular Review

5.1 Data protection by default. The Platform uses data-protection-friendly default settings where technically possible (data minimisation, need-to-know defaults, restrictive data sharing).

5.2 Security tests. Penetration tests and security audits are carried out at regular intervals to an extent appropriate to the size of the company and its infrastructure.

5.3 Processor control. Sub-processors are selected with particular care; their security measures are checked in advance; data processing agreements under Article 28 GDPR are concluded; data is destroyed after the end of the engagement.

6. Incident Response

The Provider maintains an incident response process with defined escalation paths, identification, containment, preservation of evidence, recovery and lessons learned. The Controller is notified in accordance with clause 8.4 of the Data Processing Agreement 114 within twenty-four (24) hours of the Provider becoming aware of a personal data breach.

Annex 3 to the Data Processing Agreement 114

SUB-PROCESSORS

This list sets out the sub-processors that the Provider engages for processing on behalf of the Customer. Changes are made in accordance with clause 7 of the Data Processing Agreement 114.

1. Sub-processors

Sub-processor

Service

Location of processing

Transfer mechanism

Google Cloud EMEA Limited, 70 Sir John Rogerson's Quay, Dublin 2, Ireland; privacy notice: https://cloud.google.com/terms/cloud-privacy-notice

Managed MySQL database (Cloud SQL); Firebase Authentication, Cloud Firestore, Cloud Functions and App Check (mobile applications)

Cloud SQL: Frankfurt, Germany; Firebase: European Union

Data Privacy Framework (Google LLC); standard contractual clauses under the Cloud Data Processing Addendum

Google LLC, 1600 Amphitheatre Parkway, Mountain View, CA 94043, United States; privacy notice: https://firebase.google.com/support/privacy

Firebase Cloud Messaging and Firebase Remote Config (mobile applications)

Not tied to a region; processing may also take place in the United States

Data Privacy Framework (Google LLC); standard contractual clauses under the Firebase Data Processing and Security Terms

Laravel Holdings Inc., 60 Broad Street, 24th Floor #1559, New York, NY 10004, United States; privacy policy: https://laravel.com/privacy

Hosting of the application server (Laravel VPS on the infrastructure of DigitalOcean, LLC, 105 Edgeview Drive, Suite 425, Broomfield, CO 80021, United States), server management (Laravel Forge), application monitoring (Laravel Nightwatch)

Server: Frankfurt, Germany; Nightwatch: European Union

Data Privacy Framework

Twilio Ireland Limited, 70 Sir John Rogerson's Quay, Dublin 2, D02 R296, Ireland; privacy notice: https://www.twilio.com/en-us/legal/privacy

Sending of system e-mails (Twilio SendGrid)

European Union (SendGrid EU data residency)

Data Privacy Framework (Twilio Inc.); standard contractual clauses under the Twilio Data Protection Addendum

Functional Software, Inc. (Sentry), 45 Fremont Street, 8th Floor, San Francisco, CA 94105, United States; privacy policy: https://sentry.io/privacy/

Error monitoring

European Union (Frankfurt, Germany)

Data Privacy Framework; standard contractual clauses as a fallback under the Sentry Data Processing Addendum

2. Independent Controllers (Not Sub-processors)

The following providers do not act on behalf of the Customer. They process data as independent controllers under their own terms:

Provider

Role

Stripe Payments Europe, Limited, 1 Grand Canal Street Lower, Grand Canal Dock, Dublin, D02 H210, Ireland; privacy policy: https://stripe.com/privacy

Payment processing and Connected Account under the agreement concluded directly between the Customer and Stripe

Apple Distribution International Limited (Apple Pay), Hollyhill Industrial Estate, Hollyhill, Cork, Ireland; privacy policy: https://www.apple.com/legal/privacy/en-ww/

Wallet service used by Guests for payment

Google Ireland Limited (Google Pay), Gordon House, Barrow Street, Dublin 4, Ireland; privacy policy: https://policies.google.com/privacy

Wallet service used by Guests for payment

3. Updates

The Provider notifies the Customer of changes to this list in accordance with clause 7.4 of the Data Processing Agreement 114.