Legal

Data Processing Addendum

This Data Processing Addendum (“DPA”) forms part of the agreement between the business using Springlink (“Customer” or “Controller”) and Springlink OÜ, registry code 17416182 (“Springlink” or “Processor”). It applies when Springlink processes personal data on Customer's behalf to provide the Services.

1. Definitions and scope

“Data Protection Laws” means the GDPR, Estonian law supplementing it, and other applicable data-protection law. “Customer Personal Data” means personal data processed by Springlink on Customer's behalf. GDPR terms such as controller, processor, processing, data subject, supervisory authority, and personal data breach have their GDPR meanings.

Customer is the controller and Springlink is the processor for restaurant-client membership, loyalty, reward, referral, offer, communication, website-interaction, and related data processed under Customer's instructions. Springlink remains a controller for its own account, security, billing, and service-usage processing described in its Privacy Policy.

2. Instructions and compliance

• Springlink will process Customer Personal Data only to provide the Services and on documented instructions.
• Customer instructs Springlink to perform the processing described in Schedule 1.
• Customer is responsible for lawful instructions, legal bases, notices, consents, and data accuracy.
• Springlink will inform Customer if it believes an instruction infringes Data Protection Laws.
• If law requires other processing, Springlink will notify Customer before processing unless that notice is legally prohibited.

3. Confidentiality and personnel

Springlink limits access to personnel who need it to provide or secure the Services. Those personnel are subject to appropriate confidentiality duties and receive relevant privacy and security guidance.

4. Security

Springlink will maintain technical and organisational measures appropriate to the processing risks, including the measures in Schedule 2. Springlink can update measures when the update does not materially reduce the overall protection of Customer Personal Data.

5. Subprocessors

Customer gives general written authorisation for Springlink to use subprocessors. Current subprocessors are listed in the Springlink Subprocessor List. Springlink will impose data protection duties that provide substantially equivalent protection and remains responsible for the subprocessor's performance to the extent required by law.

Springlink will publish material subprocessor changes. Customer can make a reasonable, documented data-protection objection. The parties will try in good faith to resolve it. If no reasonable alternative exists, either party can terminate the affected Services.

6. International transfers

Springlink will not transfer Customer Personal Data outside the EEA without a lawful transfer mechanism. Where an adequacy decision does not apply, the parties incorporate the then-current EU controller-to- processor Standard Contractual Clauses. Springlink will apply appropriate supplementary measures and require equivalent onward-transfer protection from subprocessors.

7. Data-subject requests

Taking account of the nature of processing, Springlink will provide reasonable assistance for Customer to respond to requests for access, correction, deletion, restriction, objection, or portability. If Springlink receives a request relating to Customer Personal Data, it will refer the requester to Customer or notify Customer, unless prohibited by law.

8. Personal data breaches

Springlink will notify Customer without undue delay after becoming aware of a personal data breach affecting Customer Personal Data. The notice will provide available information reasonably needed for Customer's regulatory and data-subject duties. Springlink will investigate, mitigate, remediate, and keep Customer informed. Notification is not an admission of fault or liability.

9. Assessments, consultations, and audits

Springlink will provide information reasonably necessary to demonstrate compliance and assist with data protection impact assessments or regulatory consultations related to the Services. Customer must first use available documentation. If that is insufficient, Customer can conduct one reasonable audit per year on at least 30 days' notice, during business hours, without disrupting the Services or exposing another customer's data. Additional audits are allowed after a material breach or when required by an authority.

10. Return and deletion

During an active subscription, Customer can access and export supported Customer Data. After service closure, Springlink will delete or anonymise Customer Personal Data under the account lifecycle described in the Terms of Service, typically within 180 days for a paid account or 60 days for a trial account. A verified accelerated-deletion request can be completed within 48 hours. Springlink can retain data required by law and inaccessible backup copies until their protected backup cycle expires. This DPA continues to apply to retained Customer Personal Data.

11. AI processing

Springlink will not, and will require its subprocessors not to, use Customer Personal Data to train, fine-tune, or otherwise develop a general-purpose machine-learning or AI model. AI providers may process the minimum data necessary to generate proposed content at inference time under no-training and zero or limited-retention controls.

12. Liability and order of precedence

Liability under this DPA is subject to the single aggregate liability provisions in the Terms of Service, except where Data Protection Laws prohibit a limitation. If this DPA conflicts with the Terms of Service on a data-protection matter, this DPA controls.

Schedule 1: Processing details

Schedule 2: Security measures

• TLS encryption in transit and provider-managed encryption at rest where available.
• Role-based and least-privilege access with authenticated manager and client accounts.
• Logical separation using restaurant and user identifiers and database access rules.
• Production application and database hosting in Frankfurt with protected backups.
• Logging, error monitoring, dependency maintenance, and incident-response procedures.
• Secrets managed outside source code and restricted production access.
• Data minimisation, controlled subprocessors, and confidentiality obligations.
• Recovery, deletion, and business-continuity processes proportionate to the Services.

Contact

Data-protection notices under this DPA can be sent to [email protected].

Subprocessor List

Springlink uses the following providers to help deliver the Services. A provider is a subprocessor only to the extent it processes personal data on behalf of a Springlink restaurant customer. Some providers also process data as an independent controller under their own terms.

International transfers

Where required, Springlink relies on an adequacy decision, EU Standard Contractual Clauses, and supplementary measures for transfers outside the European Economic Area. Springlink remains responsible for its subprocessors as required by the Data Processing Addendum.

AI providers

Springlink routes supported AI inference through Vercel's AI gateway. Available downstream model providers can change. Springlink requires controls that prohibit using Customer Personal Data to train a provider's models and uses zero or limited retention where available.

Changes

Springlink can update this list as the Services change. Customers can contact [email protected] with questions or a reasonable data-protection objection to a new subprocessor.