Data Processing Addendum

1. Roles and subject matter

The Controller is the business that subscribes to the service. The Processor is SiteNow (COD Solutions Oy).

Subject matter: publishing the Controller's website and receiving contacts made through it. Duration: the term of the subscription. The processing ends when the subscription ends.

2. Categories of data subjects and personal data

• Data subjects: the Controller's customers and other people who contact the site.
• Personal data: name, phone number, email address, party size and free-text note in a reservation or order; and content the Controller sends via WhatsApp.

3. Processor obligations

• We process personal data only on the documented instructions of the Controller and for providing the service.
• Everyone with access to the data is bound by confidentiality.
• We implement appropriate technical and organisational security measures (encrypted connections, access control, logging, backups).
• We assist the Controller in responding to data subject requests and in fulfilling security and impact assessment obligations.
• We notify the Controller without undue delay, and in any case within 72 hours, of any personal data breach that has come to our attention.
• At the end of the agreement we delete the personal data, unless legislation requires retention. Personal data in reservations and orders is anonymised automatically after 365 days, and WhatsApp messages are deleted after 180 days.

4. Subprocessors

The Controller gives a general authorisation to use the following subprocessors. We notify of changes by email at least 30 days in advance, and the Controller may object to a change by terminating the subscription before it takes effect.

5. Transfers outside the EEA

Where a subprocessor processes data outside the EEA, the transfer is based on the European Commission's Standard Contractual Clauses and on additional safeguards agreed with that provider.

6. Audits

The Controller has the right to verify compliance with this addendum. We primarily provide the information needed in writing; a request can be sent to privacy@usesitenow.com.