Data Processing Agreement

1. Parties and roles

The restaurant is the controller (Data User), and BIDLX SOLUTIONS SDN. BHD. is the processor (Data Processor). This agreement applies automatically on acceptance of the Terms of Use and for the duration of the subscription.

2. Subject matter and scope

• Purpose: providing the restaurant management service (POS, HR, customers, loyalty, reservations and more), storing its data and displaying it to the restaurant's authorised users.
• Data subjects: the restaurant's staff, customers and job applicants.
• Data categories: identity and contact data, employment, salary, attendance and check-in location data, ID documents, and order, loyalty and reservation data, as entered by the restaurant.
• The restaurant does not enter sensitive data (such as health, religious, criminal or biometric data) unless it has a legal basis to do so and bears responsibility for it.

3. BidLX's obligations as processor

• Processing data only on the restaurant's documented instructions (including its use and configuration of the system), never for our own purposes, and informing the restaurant if we believe an instruction breaches the law.
• Ensuring everyone on our team with access to the data is bound by confidentiality.
• Applying appropriate security measures as described in the privacy policy.
• Reasonably assisting the restaurant in responding to data subject requests, impact assessments and its legal obligations.
• Notifying the restaurant of any breach affecting its data without undue delay and within 48 hours of becoming aware of it at most, enabling it to notify regulators within statutory deadlines.
• Deleting or returning the data to the restaurant at the end of the service at its choice, unless the law requires us to keep it.
• Providing reasonable information demonstrating our compliance with this agreement on request.

4. Sub-processors and transfers

• The restaurant gives general authorisation to use sub-processors to provide the service, currently including Supabase Inc. and Vercel Inc., provided we bind them to protection obligations no less than this agreement; we remain liable to the restaurant for their performance.
• We notify the restaurant 30 days before adding or replacing a sub-processor; the restaurant may object on reasonable data protection grounds and terminate the service if the objection cannot be resolved.
• Any transfer of data outside the restaurant's country follows the safeguards in the privacy policy and the requirements of Malaysian and Saudi law.

5. Restaurant's obligations

• Having a legal basis for all data it enters, informing staff and customers about the processing of their data (including recording staff location at check-in) and obtaining consent where required.
• Entering only necessary data, keeping it accurate, and granting staff permissions only as needed.
• Responding to data subject requests and notifying regulators of breaches concerning it as required by law.

6. Term and precedence

This agreement remains in force while BidLX processes the restaurant's data. Where it conflicts with the Terms of Use on data protection, this agreement prevails. It is subject to the same governing law, dispute resolution and limitation of liability as the Terms of Use.

7. Contact us

BIDLX SOLUTIONS SDN. BHD. — Email: support@bidlx.com, for any question or request about your data or this document.