Data Processing Addendum
Version 2026-08-29-v1 · Effective 29 August 2026
Incorporated into the Restaurant Service Agreement where Kaviora processes personal data for a restaurant.
This Data Processing Addendum (“DPA”) is between the Customer identified in the Restaurant Service Agreement, as controller (“Customer”), and KAVIORA TECHNOLOGIES SHPK (NIPTM61628038K), as processor (“Kaviora”). It applies only to Customer Personal Data processed by Kaviora on Customer's behalf. For Kaviora's independent controller activities, the Privacy Notice applies.
1. Processing instructions
Kaviora will process Customer Personal Data only on Customer's documented instructions, including this DPA, the agreement, enabled features, role/configuration choices and lawful support requests, unless Albanian or applicable law requires otherwise. Kaviora will inform Customer before legally required processing unless prohibited, and will promptly notify Customer if an instruction appears to infringe data-protection law.
2. Processing details
Subject and duration
Hosting and operation of restaurant discovery, menus, QR/table sessions, orders, pickup, bookings, bill requests, staff access, messaging, inventory, analytics and support for the service term plus the deletion/return period described below.
Nature and purpose
Collection, recording, organisation, storage, encryption, retrieval, consultation, display, transmission to authorised recipients, troubleshooting, backup, export, restriction and deletion to provide and secure the service under Customer's configuration.
Data subjects and categories
Restaurant owners, staff, diners, booking guests and support contacts. Data may include identifiers and contact details; role/account data; order, table, pickup, booking, bill-request and communication data; language and consent choices; restaurant operational data linked to a person; and technical/security records. Special-category data and payment-card data are not intended inputs. Customer must not instruct Kaviora to process them without a separate written assessment and agreement.
3. Confidentiality and personnel
Kaviora will limit access to personnel who need it to perform the service, bind them to confidentiality and provide appropriate data-protection/security instruction. Access will be reviewed and removed when no longer required.
4. Security
Taking account of the state of the art, implementation cost, processing context and risk, Kaviora will maintain appropriate measures, including tenant and role controls; authentication; encryption in transit and selected-field encryption at rest; secret separation; logging and monitoring; input/file validation; rate limiting; controlled backups; vulnerability and incident handling; and testing of relevant controls. Customer is responsible for endpoint security, credential handling, role assignments and lawful configuration within its control.
5. Subprocessors
Customer gives general written authorisation for Kaviora to use subprocessors necessary to provide the service. Current or optional categories/providers are: hosting and edge delivery (Vercel); database, authentication and storage (Supabase); application monitoring (Sentry); transactional email (Resend); messaging (Twilio and Telegram); and AI-assisted menu processing (Anthropic). A provider is used only where the corresponding integration is configured.
Kaviora will impose materially equivalent data-protection duties on each subprocessor and remains responsible for its processor obligations. Kaviora will provide advance notice of a material new subprocessor through the service or account contact. Customer may object on reasonable documented data-protection grounds; the parties will seek a practical alternative, and if none exists either may end the affected feature or service without penalty for the unused prepaid period.
6. International transfers
Kaviora will not transfer Customer Personal Data to a destination lacking a valid legal basis. Where an adequacy decision does not apply, Kaviora will use an approved transfer mechanism, such as standard contractual clauses, and supplementary safeguards where required. Customer authorises transfers inherent in the listed subprocessors subject to those safeguards.
7. Assistance
Taking account of the nature of processing and information available, Kaviora will reasonably assist Customer with data-subject requests, security obligations, breach notifications, impact assessments and prior consultation. Kaviora will not independently answer a Customer-controlled request unless authorised or legally required. Customer remains responsible for deciding the lawful response.
8. Personal-data incidents
Kaviora will notify Customer without undue delay after confirming a personal-data breach affecting Customer Personal Data and will provide available information on its nature, likely consequences, affected categories/approximate volume, contact point, measures taken and mitigation. Kaviora will provide updates as facts become available. Customer is responsible for notifications to the Commissioner and affected people, including the applicable 72-hour supervisory-authority period, unless the parties agree otherwise in writing.
9. Return, deletion and retention
During the service and a reasonable communicated export window, Kaviora will make available the standard export functionality then supported. After termination or Customer's lawful instruction, Kaviora will delete or return Customer Personal Data unless law requires retention. Protected backups will be isolated from ordinary use and deleted on rotation. Kaviora may retain minimum evidence needed for security, contract, legal-claim and compliance purposes in a restricted form.
10. Demonstrating compliance and audits
Kaviora will make available information reasonably necessary to demonstrate compliance. No more than once annually, unless a confirmed incident or authority request justifies more, Customer may request a proportionate remote audit on reasonable notice. Audits must protect other tenants, security and confidential information, avoid production disruption and use existing independent reports first where sufficient. Customer bears extraordinary audit cost unless the audit shows a material Kaviora breach.
11. Roles and conflicts
Nothing in this DPA transfers Customer's controller duties to Kaviora. If Customer and Kaviora jointly determine a specific purpose and means, they will document transparent joint-controller responsibilities before that processing begins. If this DPA conflicts with the Restaurant Service Agreement on processor obligations, this DPA controls. Mandatory law prevails over both.
12. Contact
Data-protection and DPA notices: hello@kaviora.tech. Customer must keep its controller contact and instructions current in the service.