ORDER CONNECTS01Roles
This Data Processing Agreement (DPA) forms part of the Terms of Service between OrderConnects and the Customer. For personal data the Customer puts into the platform, including diner, staff and driver data, the Customer is the controller and OrderConnects is the processor.
02Processing details
| Item | Details |
|---|---|
| Subject matter | Providing the OrderConnects platform under the Terms |
| Duration | The term of the agreement plus the export and deletion period |
| Nature and purpose | Hosting, order routing, payments, delivery, messaging, reporting and support |
| Data subjects | Customer's diners, staff, drivers and franchisees |
| Data types | Names, phone numbers, emails, delivery addresses, order history, device and location data during deliveries, staff account data |
03Our obligations
- Process personal data only on the Customer's documented instructions, including through platform settings.
- Ensure staff with access are bound by confidentiality.
- Apply appropriate technical and organisational security measures, described below.
- Help the Customer respond to data subject requests and meet its security and breach obligations.
- Notify the Customer without undue delay, and within 48 hours, after becoming aware of a personal data breach affecting Customer data.
- Delete or return Customer data at the end of the agreement, as the Customer chooses.
04Sub-processors
The Customer authorises OrderConnects to use the sub-processors listed below. We will give at least 30 days' notice of new sub-processors, and the Customer may object on reasonable grounds.
| Sub-processor | Purpose | Location |
|---|---|---|
| Cloudways | Hosting and storage | Asia |
| Meta Platforms | WhatsApp Business messaging | Global |
| Google (Firebase, Maps) | Push notifications, maps and routing | Global |
| [Payment gateways] | Payment processing | [Region] |
| SendPK | OTP and order SMS | Pakistan |
05Security measures
- Encryption in transit (TLS) and at rest.
- Role-based access control in the platform and least-privilege access for staff.
- Daily encrypted backups with point-in-time restore.
- Logging, monitoring and alerting on production systems.
- Regular security reviews and dependency updates.
06International transfers
Where Customer data is transferred outside the country where it was collected, OrderConnects will use safeguards required by applicable law, such as standard contractual clauses where relevant.
07Audits
On reasonable request and not more than once a year, OrderConnects will provide information needed to show compliance with this DPA, such as security documentation or audit summaries.
08Liability and precedence
Liability under this DPA is subject to the limits in the Terms. If this DPA conflicts with the Terms on data protection matters, this DPA prevails.
Email legal@orderconnects.com