Merchant Data Processing Agreement

This agreement is between each canteen that uses VenueBites and Venushub CY LTD (Geranon 1, 7040 Larnaca, Cyprus; registration number HE442414). A manager accepts it on the company's behalf in the VenueBites console before managers can use the console; the time, the accepting user and the version are recorded with the company.

DATA PROCESSING AGREEMENT (DPA) pursuant to Article 28 of the General Data Protection Regulation (GDPR). BETWEEN: 1. The Canteen / Venue Merchant as identified in the Merchant Onboarding Form (“Controller”); 2. Venushub CY LTD, a company registered in Cyprus (“Processor”).

1. Subject Matter and Scope

1.1 The Processor operates the VenueBites digital ordering software. The Controller engages the Processor to collect, transmit, and process Customer Personal Data necessary for fulfilling food/beverage orders placed via the platform.

1.2 Data Subjects: Venue attendees and customers placing orders with the Controller.

1.3 Categories of Data: Name, phone number, pickup/seat location details, order notes, item selection, payment status, and order timestamps.

2. Roles of the Parties

2.1 Controller Role: The Controller is the Data Controller under GDPR for the processing of customer order details to perform the sale and fulfil order delivery.

2.2 Processor Role: The Processor acts as Data Processor on behalf of the Controller for order ingestion, dispatching notifications, ticket formatting, and automated data retention enforcement.

2.3 Independent Controller Status: The Processor acts as an independent Data Controller solely for its own billing, merchant ledger maintenance, system security, platform-wide rate limiting, and statutory tax compliance.

3. Obligations of the Processor

The Processor agrees to:

3.1 Process Personal Data solely on documented instructions from the Controller, including with regard to transfers outside the EEA.

3.2 Ensure all personnel authorized to process Customer Data are bound by strict confidentiality obligations.

3.3 Implement technical and organizational security measures pursuant to Article 32 GDPR (including TLS encryption, password hashing, and pseudonymized rate-limiting hashes).

3.4 Execute automated order data anonymization: personal identifiers (customer_name, customer_phone, location/seat info, notes) shall be automatically anonymized 180 days after order closure (or 24 hours for demo venues); statutory transaction ledgers shall be retained in anonymized form for 7 years to satisfy tax compliance under Cyprus Companies Law.

4. Sub-Processors & International Data Transfers

4.1 The Controller grants general authorization to the Processor to engage the following sub-processors: Railway Corp. (USA/EU): Infrastructure & Database Hosting (EU-West / Amsterdam region); Logosnet Services Ltd (Cyprus): SMS Gateway (EU local transport); Resend Inc. (USA): Transactional email service for staff management; Expo Inc. (USA), Apple Inc., Google LLC: Operational push notifications.

4.2 Where data is transferred outside the EEA, the Processor shall ensure standard contractual clauses (SCCs) or an adequacy mechanism (e.g., EU-U.S. Data Privacy Framework) are enforced.

5. Data Subject Rights & Incident Assistance

5.1 The Processor provides the /delete-my-data customer portal enabling direct, automated data erasure prior to the standard 180-day cycle.

5.2 The Processor shall notify the Controller without undue delay upon becoming aware of any personal data breach affecting Customer Personal Data.

6. Governing Law

This DPA is governed by the laws of the Republic of Cyprus.

Version 2026-10-11.