Data processing agreement (DPA)

The parties

HaiLa Tech SRL (“HaiLa”), with its registered office at str. Vlaicu Pârcălab 63, Chișinău MD-2012, Republic of Moldova, acts as a processor for the data it processes on the Restaurant’s behalf and as an independent controller for its own data, in accordance with the roles matrix in section 3. Data protection contact: dpo@haila.md.

The Restaurant is the legal entity or professional that has accepted the Terms and Conditions for Restaurants and that acts as a controller for the data of its own guests, in accordance with the same matrix.

This DPA applies to every Restaurant that uses HaiLa’s services. The Restaurant’s identification details, its data protection contact and the date of entry into force are those in the Main Contract, in the sign-up form or in the accepted offer.

1. Purpose and status of the DPA

This Data Processing Agreement (the “DPA”), also called the “Data Processing Annex” in the Terms and Conditions for Restaurants, forms part of the contract between HaiLa and the Restaurant and sets out the roles, responsibilities and conditions applicable to the processing of personal data through the HaiLa platform.

The parties acknowledge that the legal role is determined neither by the commercial name of the data nor by the notion of “data ownership”, but by who determines the purposes and means of the processing for each specific flow.

The DPA refers to Law No. 195/2024 on personal data protection, in force from 23 August 2026, and to the GDPR principles transposed through that framework.

2. Definitions

3. Roles matrix

4. Principles for Shared Data between controllers

• Each party processes Shared Data only for purposes that are legitimate, specified and compatible with the relationship with the data subject.
• Each party is responsible for the existence of a legal basis for the processing it carries out for its own purposes.
• Each party provides data subjects with the information required by law for its own processing.
• The passing of data is limited to the information necessary for managing the request, the booking and the relevant operational relationship.
• Data received from the other party may not be used for direct marketing without a valid legal basis and without complying with the requirements applicable to commercial communications.
• The parties cooperate reasonably to identify the competent controller when a data subject makes a request.

5. Data of HaiLa guests passed to the Restaurant

Depending on the feature, HaiLa may pass to the Restaurant:

• the guest’s first name and/or identifier;
• phone number;
• the date and time requested;
• number of people;
• preferences relevant to the booking;
• booking status and operational updates;
• other data strictly necessary for preparing and serving the visit.

The Restaurant may use this data to confirm and manage the booking, to contact the guest about the visit, to prepare the table, to manage the experience at the venue, to comply with legal obligations and to manage its own relationship with the guest.

6. Data of the Restaurant’s guests processed through HaiLa

For phone bookings, its own website, guests without a booking (walk-in), internal CRM, internal notes or other flows initiated by the Restaurant, the Restaurant is mainly the controller. To the extent that HaiLa only provides the software infrastructure and processes the data in accordance with the Restaurant’s instructions, the clauses in Part B of this DPA apply.

7. CRM and internal notes

• The Restaurant decides whether to enter internal notes in the CRM and which ones, and is responsible for their lawfulness, relevance and accuracy.
• The Restaurant will not enter notes that are discriminatory, disparaging, excessive or unrelated to serving the guest.
• Special categories of data must be avoided, except in situations where they are strictly necessary and there is an applicable legal basis.
• HaiLa will not use the Restaurant’s internal notes for ranking, recommendations, scoring, marketing or other purposes of its own without documenting a separate legal basis and without the necessary information notice.
• Access to internal notes must be limited to the Restaurant’s authorised staff.

8. Caller ID

• If the Restaurant activates Caller ID, the number associated with the call may be used to look up an existing record and to display the available operational information to authorised staff.
• Caller ID does not, in itself, involve recording the content of the call.
• The Restaurant is responsible for the use of the function in its own relationship with the guest.
• HaiLa processes the data strictly within the limits of the configuration and of the role established for that flow.
• Any function for audio recording, transcription or analysis of the call requires separate documentation and is not covered by default by this DPA.

Part B. Clauses for processing on the Restaurant’s behalf

The clauses in this part apply when HaiLa acts as a processor and processes Restaurant Data on the Restaurant’s behalf.

9. Subject matter, duration, nature and purpose of the processing

10. Data subjects and categories of data

11. The Restaurant’s instructions

HaiLa processes Restaurant Data only on the basis of the Restaurant’s documented instructions, including with regard to transfers, unless the law requires otherwise.

The instructions result from the Main Contract, from the activated modules, from the configurations made by the Restaurant’s authorised users, from this DPA and from later written instructions accepted by HaiLa.

If HaiLa reasonably considers that an instruction infringes the applicable data protection legislation, it will inform the Restaurant and may suspend performance of the instruction until the matter is clarified.

12. Confidentiality and access

• HaiLa ensures that the persons authorised to process Restaurant Data are subject to confidentiality obligations.
• Access is granted on the need-to-know principle and, where possible, on the principle of least privilege.
• HaiLa maintains authentication and access control mechanisms appropriate to the risk.
• The Restaurant is responsible for managing the accounts, roles and credentials of its own team.

13. Technical and organisational measures

The measures may be updated in the course of the service, provided that they do not materially reduce the overall level of protection applicable to the processing.

14. Sub-processors

• The Restaurant authorises HaiLa to use sub-processors to provide the service, subject to the conditions in this section.
• HaiLa will impose on sub-processors data protection obligations substantially equivalent to the relevant obligations in this DPA.
• HaiLa will maintain a current list of the relevant sub-processors and will make it available to the Restaurant, in accordance with Annex B.
• For a new sub-processor that involves Restaurant Data, HaiLa will give reasonable prior notice, through the contractual mechanism or through the established channel.
• The Restaurant may raise a reasoned objection, on serious data protection grounds. The parties will try to identify a reasonable solution.
• HaiLa remains liable to the Restaurant for the performance of the obligations undertaken by the sub-processor, to the extent provided by law and by the contract.

15. International transfers

HaiLa will not transfer Restaurant Data to a state or to an international organisation except on the basis of an applicable legal mechanism and of the documented instructions relating to the service.

As applicable, the mechanisms may include an adequacy decision, standard contractual clauses or other safeguards permitted by Law No. 195/2024.

The processing locations declared by HaiLa are indicated in the List of Sub-processors.

16. Data subjects’ requests

• If HaiLa directly receives a request that clearly concerns Restaurant Data processed exclusively on the Restaurant’s behalf, HaiLa will inform the Restaurant and, where appropriate, will direct the requester to the Restaurant.
• HaiLa will give the Restaurant reasonable assistance with access, rectification, erasure, restriction, portability and objection, taking into account the nature of the processing and the information available.
• The Restaurant remains responsible for the legal assessment of the request and for the reply to the data subject, if it is the competent controller.
• If the request also concerns HaiLa Data for which HaiLa is the controller, HaiLa will deal separately with the part that falls to it.

17. Security incidents

HaiLa will notify the Restaurant without undue delay after becoming aware of a security incident affecting Restaurant Data processed on the Restaurant’s behalf.

To the extent that the information is available, the notification will include:

• the nature of the incident;
• the categories of data and of persons affected, if known;
• the likely consequences;
• the measures taken or proposed;
• the contact point for coordination;
• further information, as the investigation progresses.

The Restaurant is responsible for assessing its obligation to notify the National Centre for Personal Data Protection (CNPDCP) and/or the data subjects when it acts as a controller. HaiLa will give reasonable assistance in this process.

18. Impact assessment (DPIA) and prior consultation

Taking into account the nature of the processing and the information available, HaiLa will give the Restaurant reasonable assistance with data protection impact assessments and, where appropriate, with the prior consultation of the competent authority.

19. Records and demonstrating compliance

• HaiLa keeps the records required by law for the processing activities carried out on behalf of controllers, to the extent that the obligation applies.
• HaiLa will make available to the Restaurant the information reasonably necessary to demonstrate compliance with the obligations applicable to the processor.
• Any information provided for this purpose remains confidential and may not be used for other purposes.

20. Audit

The Restaurant may request reasonable information and evidence regarding HaiLa’s compliance with this DPA. A direct on-site audit is used only if the documentation available is not sufficient or if there is a reasonable ground relating to an incident or to a material non-compliance.

• Notice of the audit is given within a reasonable period, except in justified emergencies.
• The audit takes place during normal working hours and without compromising the security of other customers, trade secrets or HaiLa’s infrastructure.
• The parties may agree to use an independent auditor bound by confidentiality.
• The extraordinary costs generated by the audit may be borne by the Restaurant if the audit does not identify a material non-compliance attributable to HaiLa, to the extent permitted by the contract.

21. Return and deletion of data

On termination of the relevant service, at the Restaurant’s choice and subject to legal obligations, HaiLa will delete or return the Restaurant Data processed exclusively on the Restaurant’s behalf.

Data may remain temporarily in backups until their normal rotation, with restricted access and without active use, except for a necessary restoration.

This obligation does not require the deletion of HaiLa Data for which HaiLa has an independent role as controller and its own basis for retention.

22. The Restaurant’s obligations

The Restaurant must:

• ensure that the data provided to HaiLa is collected and processed lawfully;
• provide data subjects with the information notices necessary for its own processing;
• configure and use the platform in compliance with the law;
• manage employees’ access and promptly deactivate accounts that are no longer needed;
• avoid entering excessive or sensitive data without necessity and a legal basis;
• respond to the requests of data subjects for which it is the controller;
• inform HaiLa of any instruction or incident relevant to the processing carried out through the platform.

23. HaiLa’s obligations

HaiLa must:

• process Restaurant Data in accordance with the documented instructions, for the flows in which it acts as a processor;
• apply technical and organisational measures appropriate to the risk;
• maintain confidentiality;
• control and document the relevant sub-processors;
• assist the Restaurant, within reasonable limits, with data subjects’ rights, incidents, the DPIA and demonstrating compliance;
• not use Restaurant Data for purposes of its own that are incompatible with the role of processor.

24. Unlawful instructions and abusive use

HaiLa may refuse or suspend an instruction that would clearly infringe data protection legislation, the security of the service or the rights of other customers. HaiLa will inform the Restaurant of the reason, to the extent permitted by law.

25. Liability

Each party is liable for its own breaches of legal and contractual obligations, within the limits provided by law and by the Main Contract. This DPA does not limit the rights of data subjects and cannot remove liability that cannot be excluded by law.

If the competent authority or a court classifies a processing operation differently from the role envisaged by the parties, the parties will cooperate to adjust the relevant documentation and processes.

26. Priority of the documents

In the event of a conflict between this DPA and the Main Contract with regard to data protection, this DPA prevails for data protection matters. For commercial and financial matters the Main Contract remains applicable.

27. Term

This DPA applies for the whole period during which HaiLa processes personal data for the Restaurant or together with it, in connection with the contracted services.

Annex A. Documented instructions and modules

The general instructions below apply to the modules activated for the Restaurant, in accordance with the contracted package and the Commercial Annex.

Annex B. Sub-processors

The sub-processors used by HaiLa, the services they provide, the data they receive and the processing locations are those in the List of Sub-processors, published at restaurants.haila.md/legal/subprocessors. The list is kept current, and changes to it are announced in accordance with section 14.

Annex C. Contacts for data protection and incidents

• HaiLa: dpo@haila.md, for privacy, incidents and matters relating to this DPA.
• The Restaurant: the contact indicated in the Main Contract, in the sign-up form or in the accepted offer.