Data Processing Agreement

About this agreement

This Data Processing Agreement forms part of the WaveOrder Terms of Service between the business that runs a store on WaveOrder (the "Controller", "you") and VenueBoost Inc., operating WaveOrder (the "Processor", "we", "WaveOrder"). It covers the personal data of your customers that WaveOrder processes on your behalf, and is written to meet Article 28 of the EU General Data Protection Regulation (GDPR) and the UK GDPR.

It applies from the date your store accepted the Terms of Service and lasts for as long as WaveOrder processes that data for you. Where this agreement and the Terms of Service say different things about your customers' data, this agreement applies.

How WaveOrder handles your own account details (your name, email and billing) is described in our Privacy Policy, where WaveOrder decides how that data is used. This agreement is about the data of your customers, where you decide.

Definitions

Words used in this agreement have the meaning they have in the GDPR: "personal data", "processing", "controller", "processor", "sub-processor", "data subject", "personal data breach" and "supervisory authority". In addition:

• "Customer data" means the personal data of your customers, drivers and other people that WaveOrder processes on your behalf to run your store, as described in Annex I.
• "Data protection law" means the GDPR, the UK GDPR and the UK Data Protection Act 2018, the Swiss Federal Act on Data Protection, and any other data protection law that applies to the processing of customer data, including the law of Albania where it applies.
• "Service" means WaveOrder as described in the Terms of Service, including the storefront, the admin, messaging, payments and the other features a store uses.
• "Terms of Service" means the agreement between you and us for the use of WaveOrder.

Who decides, who processes

• You are the controller: you decide why your customers' details are collected and how they are used, you need a lawful basis for it, and you tell your customers about it in your own privacy notice.
• VenueBoost Inc., operating WaveOrder is the processor: we process those details only to run your store and the features you choose to use.
• We do not sell your customers' data, use it to advertise to them, or share it with other stores.

Your responsibilities

As controller, you are responsible for:

• Having a lawful basis for collecting and using your customers' data, including consent where the law requires it, for example before sending marketing messages.
• Telling your customers how their data is used, in a privacy notice on your store. WaveOrder lets you publish one as a legal page.
• Making sure your instructions to us, including how you set up your store, comply with data protection law.
• The accuracy of the customer data you enter or import, and the content you send to your customers.
• Not using the service to collect special categories of data, or data about children, unless the law allows it and you have told us in writing.

Our obligations

As processor, and as Article 28(3) GDPR requires, we:

• process customer data only on your documented instructions, including for transfers outside the European Economic Area, unless the law requires otherwise (see "Your instructions");
• make sure everyone authorised to process customer data is bound to confidentiality (see "Confidentiality");
• take the security measures required by Article 32 GDPR (see "Security" and Annex II);
• use sub-processors only as set out in "Sub-processors";
• help you, through appropriate technical and organisational measures, to answer your customers' requests to exercise their rights (see "Helping with your customers' requests");
• help you meet your obligations on security, breach notification, impact assessments and prior consultation, taking into account the nature of the processing and the information available to us;
• delete or return customer data when the service ends (see "When the agreement ends");
• make available the information needed to show compliance and allow audits (see "Information and audits").

We keep a record of the processing we carry out on your behalf, as Article 30(2) GDPR requires, and make it available to a supervisory authority on request.

What is processed

Subject matter and purpose

Running your online store on WaveOrder: showing your catalogue, taking orders, bookings and requests, taking payments, sending order updates and messages, arranging delivery, and the reports and tools in your admin.

Nature of the processing

Collecting, storing, organising, displaying, sending and deleting data, as the store and its customers use WaveOrder.

Duration

For as long as your store uses WaveOrder, then until the data is deleted as set out under "When the agreement ends".

Whose data

• Your customers: people who visit your store, order, book, ask for a quote or message you
• Drivers you add to deliver your orders
• Your team members, as far as their details appear with your store's orders

What data

• Names
• Phone numbers, including WhatsApp numbers
• Email addresses
• Delivery addresses and, when the customer allows it, location
• Orders, bookings, quotes and requests, with notes
• Payments: amount, status and method (card numbers are handled by the payment provider and never stored by WaveOrder)
• Messages exchanged with your store, including through WhatsApp
• Reviews and anything else the customer types into your store
• Technical data such as IP address, device and approximate location

WaveOrder is not built for special categories of data (such as health data). Please do not ask your customers for them in notes, forms or messages.

Your instructions

We process your customers' data only on your documented instructions. Those are the Terms of Service, this agreement, and what you set up and do in your WaveOrder admin. If the law requires us to process it in another way, we will tell you first unless the law forbids that.

If we believe an instruction breaks data protection law, we will tell you.

Confidentiality

Only people at WaveOrder who need to, to run and support the service, can reach your customers' data. Each of them is bound to keep it confidential. Our support team opens a store only to help it, and every such visit is logged.

Security

We keep technical and organisational measures in place to protect your customers' data, as Article 32 GDPR requires. Among them:

• Encryption in transit: every page and connection uses HTTPS
• Passwords are stored only as secure hashes
• Each request is checked against the store it belongs to, so one store cannot see another's data
• Roles inside your store (owner, manager, staff, driver) limit what each team member can see and do
• Two-step login for every account, which an owner can require for the whole team
• Limits on repeated sign-in attempts
• A log of administrative actions, including support access to a store

We review these measures as the service and the risks change.

Sub-processors

You allow WaveOrder to use the sub-processors listed here to provide the service. Each is bound by a written contract with data protection obligations no weaker than this agreement's, and WaveOrder remains responsible to you for their work.

Before a new sub-processor starts handling your customers' data, we update this list and tell store owners by email at least 30 days in advance, so you can object within that time. If you object on reasonable data protection grounds and we cannot resolve it, you may stop using the affected feature or close your account.

• Microsoft Azure — Hosting: the servers that run WaveOrder and its database. Data: All store data held by WaveOrder, including customers' details, orders and messages. Location: Provider's regions.
• Supabase — File storage for uploads such as logos, product images, receipts and print files. Data: Files a store or its customers upload, which can include personal details. Location: Provider's regions.
• Stripe (including Stripe Connect) — Card payments from customers to stores that take cards. Data: Name, email, amount and payment details (card details go straight to Stripe). Location: Provider's regions.
• POK — Card payments from customers to stores that offer POK. Data: Order reference, amount and the details the customer gives to pay. Location: Provider's regions.
• Twilio — Sending and receiving WhatsApp messages: order updates, reminders, campaigns and the store's WhatsApp assistant. Data: Phone numbers and message content. Location: Provider's regions.
• Resend — Sending emails: order confirmations, reminders, review requests and receipts. Data: Email address, name and the email's content. Location: Provider's regions.
• OpenAI — Writing replies for the WhatsApp assistant, on stores that switch it on. Data: The message text, with the store's catalogue and settings. Location: Provider's regions.
• HolaOra — The chat assistant on stores that use it. Data: Chat messages and what the customer shares in them. Location: Provider's regions.
• Google Maps and Places — Address search and the delivery map at checkout. Data: The address typed and, with the customer's permission, device location. Location: Provider's regions.
• ipapi.co — Turning a visitor's IP address into an approximate country and city. Data: IP address. Location: Provider's regions.
• Sentry — Error monitoring, including a sample of recorded visits to reproduce errors. Data: Technical data about the visit and what was on screen when an error happened. Location: Provider's regions.
• PostHog — Usage analytics, only where the visitor's cookie choice allows it. Data: Pages visited, device and approximate location. Location: Provider's regions.
• Google Analytics — Usage analytics on stores, only where the visitor's cookie choice allows it. Data: Pages visited, device, approximate location and an online identifier. Location: Provider's regions.
• Microsoft Clarity — Usage analytics and recordings of visits on stores, only where the visitor's cookie choice allows it. Data: Pages visited, clicks and scrolling, device and what was on screen. Location: Provider's regions.
• Meta (Instagram) — For stores that connect Instagram: reading comments on the store's posts and sending the replies the store set up. Data: Instagram username, comment and message text. Location: Provider's regions.
• Cloudflare — Network and security service in front of some of WaveOrder's addresses. Data: IP address and the request as it passes through. Location: Provider's regions.

Helping with your customers' requests

Your customers may ask to see, correct, export or delete their data. Your admin lets you find a customer, change their details and delete them. Where you need more, we help you answer, taking into account what the service can do.

Customers can also ask WaveOrder directly, through the "Delete or export my data" form on our contact page. We confirm who is asking before acting and answer within 30 days.

We also help you, as far as we reasonably can, with data protection impact assessments and with consulting a supervisory authority, where the law requires them.

If something goes wrong

If we become aware of a personal data breach affecting your customers' data, we tell you without undue delay, and in any case within 72 hours of becoming aware of it.

We tell you what we know at the time, and more as we learn it: what happened, which kinds of data and roughly how many people are affected, the likely consequences, and what we are doing about it. We help you with the notifications you have to make to the authority and to your customers.

When the agreement ends

Before your store's account is closed, you can ask us for a copy of your customers' data and orders, and we will send it in a commonly used, machine-readable format.

Within 30 days after your store's account is closed, we delete your customers' data, unless the law requires us to keep some of it, in which case we keep only that, only for as long as required, and use it for nothing else. Copies in backups are removed as those backups expire.

Information and audits

We make available the information you need to show that this agreement is being followed, and we answer reasonable written questions, such as a security questionnaire.

Where that is not enough, you, or an independent auditor you appoint who is bound to confidentiality, may audit our compliance with this agreement, with at least 30 days' notice, during business hours, and in a way that does not put other stores' data at risk. Unless an audit follows a breach or is required by an authority, it happens at most once a year and at your cost.

International transfers

VenueBoost Inc., operating WaveOrder is based in the United States, and WaveOrder's team works from Albania. Some sub-processors process data outside the European Economic Area and the United Kingdom.

Where your customers' data is transferred to a country without an adequacy decision, the transfer relies on the European Commission's Standard Contractual Clauses (and the UK addendum where UK law applies), or on another safeguard recognised by Article 46 GDPR, such as a recipient's certification under the EU-US Data Privacy Framework.

Standard Contractual Clauses

Where customer data is transferred from the European Economic Area to a country without an adequacy decision, and no other Article 46 GDPR safeguard applies, the European Commission's Standard Contractual Clauses (Implementing Decision (EU) 2021/914) are incorporated into this agreement by reference, as follows:

• Module Two (controller to processor) applies where you are a controller, and Module Three (processor to processor) where you act as a processor for someone else.
• Clause 7 (docking clause) applies.
• Clause 9: option 2 (general written authorisation) applies, with notice of new sub-processors as set out in "Sub-processors".
• Clause 11: the optional language does not apply.
• Clause 13: the supervisory authority is the one competent for you, as data exporter.
• Clause 17: the law of Ireland applies. Clause 18: the courts of Ireland have jurisdiction.
• Annex I of the Clauses is completed by Annex I of this agreement, Annex II by Annex II, and Annex III by the sub-processor list.

For transfers from the United Kingdom, the International Data Transfer Addendum issued by the UK Information Commissioner applies alongside the Clauses. For transfers from Switzerland, the Clauses apply with the adjustments required by Swiss law.

Term and precedence

This agreement starts when your store accepts the Terms of Service and ends when we no longer process customer data for you. The obligations on confidentiality, deletion and security continue for as long as we hold any customer data.

If this agreement conflicts with the Terms of Service on the processing of customer data, this agreement wins. If it conflicts with the Standard Contractual Clauses where they apply, the Standard Contractual Clauses win.

If a part of this agreement is found invalid, the rest stays in force, and the invalid part is replaced by a valid one as close to its purpose as possible.

General

Liability under this agreement follows the Terms of Service. Governing law and disputes also follow the Terms of Service, except where data protection law requires otherwise.

We may update this agreement to follow the law or to reflect changes to the service, such as a new sub-processor. The version is shown at the top. When a new version changes your rights, your store's owner is asked to accept it before continuing to use the admin.

Questions about this agreement: legal@waveorder.app.

Annex I: Details of the processing

The parties

• Data exporter and controller: the business that runs the store, as named in its WaveOrder account (and in the signed copy of this agreement, where there is one).
• Data importer and processor: VenueBoost Inc., operating WaveOrder. Contact: legal@waveorder.app.

Categories of data subjects

The store's customers and prospective customers; drivers the store adds; the store's team members as far as they appear with orders.

Categories of personal data

Identity and contact details; delivery addresses and location; orders, bookings, quotes and requests; payment status and method; messages; reviews; technical data such as IP address and device.

Special categories of data

None intended. The service is not designed for them.

Frequency of the transfer

Continuous, for as long as the store uses the service.

Nature and purpose of the processing

Hosting and running the store and its admin, taking and managing orders and payments, sending messages, arranging delivery, providing reports, and supporting the store.

Retention

For as long as the store uses the service, then deleted as set out in "When the agreement ends", except where the law requires longer retention.

Transfers to sub-processors

As listed under "Sub-processors", for the purposes stated there, for the duration of the service.

Annex II: Technical and organisational measures

Access control

• Every account signs in with a password stored only as a secure hash; two-step login is available to every account and can be required by the store owner.
• Roles inside each store (owner, manager, staff, driver) limit what each person can see and do.
• Repeated sign-in attempts are limited.
• WaveOrder staff reach a store only to support it; such access is logged.

Separation of stores

Every request is checked against the store it belongs to, so one store cannot read or change another store's data.

Transmission

All traffic between browsers, apps and WaveOrder, and between WaveOrder and its sub-processors, is encrypted with HTTPS/TLS.

Storage

Data is held with the hosting and storage providers listed under "Sub-processors", in their secured data centres. Private files, such as payment receipts, are kept in private storage and opened only through short-lived signed links.

Availability and recovery

Regular backups of the database, kept for a limited period, so the service can be restored after an incident.

Logging and monitoring

Administrative actions and errors are logged and monitored, so problems and misuse can be found and investigated.

Development and change

Changes to the service go through code review and automated tests before release. Secrets are kept out of the code.

People

Staff and contractors with access to customer data are bound to confidentiality and access only what their role needs.

Incidents

Suspected breaches are investigated straight away and handled as set out in "If something goes wrong".

Sub-processors

Sub-processors are chosen for their security and bound by written data protection terms.

Related documents

• Terms of Service — the agreement this one is part of
• Privacy Policy — how WaveOrder handles your own account data