Data Processing Agreement

Version 1 · Effective October 6, 2026

This Data Processing Agreement ("DPA") forms part of the Terms of Service between CGS Tech Lab ("we", "Processor") and the business using Food Drama ("you", "Controller"). It applies when we process Customer Data on your behalf.

It is intended to meet the requirements of the EU and UK GDPR (Article 28). Capitalised terms not defined here have the meaning given in the Terms.

1. Roles and scope

  • Roles. You are the controller of Customer Data and we are your processor.
  • Our own uses. We are an independent controller only for:
    • security, fraud prevention and legal compliance; and
    • creating anonymised, aggregated data that identifies no person or Restaurant.
  • What is processed:
    • Subject matter: providing the Platform: ordering, reservations, dine-in, gift cards, vouchers, customer records, communications and related features.
    • Duration: while your account is active, plus the periods in section 9.
    • Data subjects: your Diners and their gift card or voucher recipients.
    • Personal data: names, email addresses, phone numbers, delivery addresses, order and booking details, notes, IP addresses, marketing preferences, and gift card and voucher details.
    • Special category data: dietary preferences and allergy notes, only if a Diner chooses to give them.

2. Your instructions and responsibilities

  • We process Customer Data only on your documented instructions. These are the Terms, this DPA, and your use and settings of the Platform, including your retention settings.
  • We will tell you if we believe an instruction breaks data protection law. We may refuse to follow it.
  • You are responsible for:
    • the lawfulness of the processing, including your lawful basis and any consents (including marketing and allergy consents);
    • the notices you give Diners;
    • the accuracy of Customer Data; and
    • responding to Diners' requests.
  • You must not instruct us to process Customer Data unlawfully.

3. Confidentiality

Everyone we authorise to process Customer Data is bound by confidentiality.

4. Security

We maintain appropriate technical and organisational measures, including:

  • encryption in transit (HTTPS);
  • encryption of stored secrets and payment-provider credentials;
  • password hashing;
  • two-factor authentication;
  • access limited by Restaurant and role;
  • activity logging;
  • automatic deletion under retention rules; and
  • regular backups.

We may update these measures as long as the overall level of protection is not reduced.

5. Sub-processors

  • Your general authorisation. You authorise us to use sub-processors. The current list is in our Privacy Policy, section 4.
  • Their obligations. We bind each sub-processor to data protection obligations no less protective than this DPA. We remain responsible for their performance as the law requires.
  • Changes. We give at least 30 days' notice of a new sub-processor, by updating the Privacy Policy and notifying you in your dashboard.
  • Objections. You may object on reasonable data protection grounds within that period. If we can't resolve your objection, your only remedy is to cancel the affected subscription, under the Terms.

6. Diner requests

The Platform includes tools to help you answer Diners' requests:

  • export and deletion;
  • consent records;
  • unsubscribe; and
  • retention settings.

Diners can also download or delete their own data using links in order emails. We tell you when they do.

If we receive a request directly, we will pass it to you or handle it through those tools. We will not respond on your behalf except as the Platform does automatically.

7. Personal data breaches

  • Our notice to you. We will notify you without undue delay, and where feasible within 72 hours, after becoming aware of a breach affecting Customer Data.
  • What the notice includes. The information reasonably available to us, to help you meet your own notification obligations.
  • Your notice to us. You must tell us within 24 hours if you become aware of a breach involving the Platform.
  • Who notifies whom. You are responsible for notifying authorities and Diners where the law requires it, unless the law places that obligation on us.

8. Assistance and audits

  • Assistance. We provide reasonable information to help you with data protection impact assessments and consultations with authorities, at your cost where the effort is significant.
  • Evidence of compliance. We make available the information reasonably needed to show we comply with this DPA. This is normally our written answers and security documentation.
  • On-site audits. If the law requires an on-site audit, you may carry one out:
    • no more than once a year;
    • with at least 45 days' written notice;
    • during business hours;
    • at your cost; and
    • by an auditor bound by confidentiality.

9. Return and deletion

  • During your account. Customer Data is deleted under your retention settings and our standard retention periods in the Privacy Policy.
  • When your account ends. You have 30 days to export Customer Data from the dashboard. After that we delete or anonymise it within a further 60 days.
  • What we keep. Records the law requires us to keep, and backups, which are overwritten on their normal cycle and are not restored except for disaster recovery.

10. International transfers

  • Where we work. We are based in India. Our sub-processors may process Customer Data in other countries.
  • Requests from authorities. If a public authority asks us for Customer Data, we'll tell you promptly, unless the law forbids it. We'll challenge requests we believe are unlawful, and disclose only what we're legally required to.
  • Safeguards. Where the law requires it, transfers are made under:
    • the European Commission's Standard Contractual Clauses (Module 2, controller to processor; or Module 3, processor to processor, for onward transfers); and
    • for UK data, the UK Addendum or the International Data Transfer Agreement.

These are incorporated by reference, including the optional docking clause (Clause 7), which lets further parties accede.

11. Liability

Each party's liability under this DPA is subject to the limitations and exclusions in the Terms, except where the law does not allow it.

12. Term and precedence

This DPA lasts as long as we process Customer Data for you. If it conflicts with the Terms on data protection, this DPA prevails.

13. Contact

Data protection questions: developer@fooddrama.io. Data protection contact: Sonu Singh, developer@fooddrama.io, CGS Tech Lab, 1st Floor, Sai Complex, Kaspate Wasti Road, Wakad, Pimpri-Chinchwad, Pune, Maharashtra 411057, India.