Data Processing Addendum

• Personal Data: Any data related to an identified or identifiable individual (e.g., name, email, order data)
• Data Controller: You, the outlet owner or entity providing data through the MyOutlet platform
• Data Processor: MyOutlet, processing personal data on your behalf
• Sub-Processor: Third-party service providers used by MyOutlet to help provide the platform (e.g., Google Cloud, Firebase, Razorpay)

MyOutlet will process personal data only:

• As necessary to deliver the services (store hosting, order management, etc.)
• As directed by you via your use of the platform
• To comply with legal obligations (e.g., fraud prevention)

Depending on your usage of the platform, MyOutlet may process:

• Customer Data: Name, contact number, order history, table number
• Outlet Owner Data: Name, email, phone, business details (GST, address)
• Order Metadata: Timestamps, product selection, payment status
• Device and Session Data: IP address, browser details, and location (if enabled)

We use the following trusted third parties:

• Firebase / Google Cloud (Hosting, DB, Analytics — USA/India)
• Razorpay / UPI Gateways (Payment processing — India)
• Google Sheets API (Order/menu sync — USA)

All sub-processors comply with appropriate safeguards and confidentiality.

MyOutlet implements reasonable technical and organizational measures to protect personal data including:

• HTTPS encryption
• Access controls for internal staff
• Regular data backups
• Limited retention periods for sensitive information

You, as the Data Controller, are responsible for handling:

• Customer data deletion requests
• Data access, rectification, or export requests

Upon request, MyOutlet will assist in facilitating these requests if technically feasible.

We retain personal data only as long as necessary to fulfill service obligations or legal requirements, after which it is securely deleted or anonymized.

If we become aware of a data breach affecting your store’s data, we will notify you without undue delay, including:

• Nature of the breach
• Impacted data categories
• Mitigation actions taken

If data is transferred outside India (e.g., to US-based sub-processors), we ensure that equivalent data protection measures are in place, such as standard contractual clauses or service agreements.

Upon termination of your account:

• All personal data will be deleted or returned within 60 days, unless required by law to retain it longer
• You may request a one-time export of your data within this period

For data protection concerns, contact us at:

Email: app.myoutlet@gmail.com
Phone: +91 90372 30669

DPO (Data Protection Officer): [Not yet appointed]
Email: app.myoutlet@gmail.com