Data Processing Agreement

The applicable schedule must define the subject matter, nature, purpose and duration of processing and the categories of personal data and data subjects according to the functions actually configured for the Customer.

• Potential data subjects, only where the configured service processes them: restaurant customers, restaurant employees, reservation guests, delivery customers and restaurant account users.
• Potential data categories, only where actually processed: name, phone, email, order information, reservation information, employee operational information, applicable customer addresses and account identifiers.

OCTK processes personal data subject to this DPA only under the Customer’s documented and lawful instructions, unless law requires OCTK to carry out particular processing independently.

If OCTK considers that a Customer instruction violates an applicable legal obligation, it may inform the Customer and suspend that instruction to the extent necessary while the matter is addressed lawfully.

OCTK takes appropriate steps to ensure that persons authorized to access personal data are subject to suitable confidentiality obligations and access data only to the extent necessary to perform their duties.

OCTK applies technical and organizational measures appropriate to the level of risk and nature of the data processed to protect personal data against loss, damage, alteration, disclosure or unauthorized access.

No unverified certification, technical standard, audit, backup, availability or infrastructure guarantee is stated.

OCTK may engage subprocessors to the extent necessary to provide the service, subject to appropriate data-protection obligations consistent with the processing and applicable law.

OCTK maintains current information concerning subprocessors used to process Customer data. No provider is listed until verified.

The architecture records a new subprocessor, its effective date, notices required for affected customers and any objection right or response required by the approved agreement or applicable law.

If OCTK receives a request concerning personal data it processes only for a Customer, OCTK may direct the requester to that Customer and provides reasonable assistance needed for the Customer to respond, to the extent allowed by the nature of processing and the system.

If OCTK becomes aware of a breach or compromise affecting personal data processed for a Customer, it documents and assesses the incident and notifies the Customer without undue delay to the extent needed to enable the Customer to meet its legal obligations.

The notice includes, to the extent then available, the nature of the incident, categories of data and people potentially affected, likely consequences and measures taken or proposed to limit harm.

Personal data processed under this DPA is processed outside the Arab Republic of Egypt in its entirety. The infrastructure has no Egyptian region, so there is no configuration in which processing remains inside Egypt.

The Customer is informed, before entering into this DPA, that the destinations are the United States for storage, server-side processing, authentication and files; the Russian Federation for address geocoding in the customer ordering flow; and an external routing service for delivery route calculation. The current list of subprocessors and the categories each receives is maintained in the Privacy Notice.

OCTK does not carry out a transfer beyond those described without updating that list and informing the Customer. The requirements, safeguards, licences or permits required by Egyptian law and applicable regulatory decisions for these transfers are under review and are not represented as complete.

When services involving processing on the Customer’s behalf end, OCTK, under the approved policy and applicable legal and technical requirements, makes the prescribed means available to retrieve and/or delete or destroy the data, except data that must be retained by legal obligation.

No export, active deletion or backup-retention period is stated until it is approved.

OCTK reasonably cooperates with the Customer in matters needed to demonstrate compliance with obligations concerning processing OCTK carries out on its behalf, to the extent required by law and the nature of the service.

The approved DPA must identify its version, effective date, last updated date, jurisdiction and lifecycle status, and the version associated with a Customer subscription must be recorded by the authoritative backend.