Legal Pages

Data Processing Agreement

Controller/processor roles, service-provider terms, subprocessors, security, breach response, deletion, exports, and restaurant guest data handling.

Version 2026.06.07 | Effective June 7, 2026 | Last updated June 7, 2026

Roles

For restaurant guest/customer data processed to provide HostKit services, the restaurant is generally the controller/business and HostKit is generally the processor/service provider.
For HostKit billing, security, analytics, product improvement, legal compliance, support, and HostKit marketing, HostKit may act as an independent business/controller.
The parties must comply with laws that apply to their own role, including notice, consent, lawful basis, privacy-request, and messaging obligations.

HostKit processes covered data to provide services, support, security, billing, analytics, legal compliance, and documented product improvement.
HostKit will not use processor/service-provider data for unrelated purposes except as disclosed, instructed, aggregated/de-identified, or legally permitted.
Restaurants must not submit unlawful, unnecessary, or excessive sensitive data through HostKit.

HostKit uses subprocessors listed on the Subprocessors page and requires appropriate confidentiality, security, and processing terms.
HostKit uses reasonable technical and organizational security measures including access controls, encryption in transit, monitoring, logging, backups, and least-privilege practices.
HostKit will investigate confirmed security incidents and provide legally required notices or reasonable assistance to affected restaurants.

HostKit provides reasonable assistance for verified access, deletion, correction, export, opt-out, and limitation requests.
Data deletion is subject to legal holds, security needs, billing/tax requirements, backup expiration, dispute records, and suppression-list obligations.
Upon account termination, HostKit will delete or return covered data according to the agreement, policy, law, and product capabilities.