4. Data Processing & Protection Agreement

v1.0
This DPA forms part of the Merchant Terms of Service and allocates responsibilities under the Digital Personal Data Protection Act, 2023 ("DPDP Act") and the Information Technology Act, 2000.

## 4.1 Roles

| Data set | Wephoton | Merchant |
|---|---|---|
| Diner platform accounts (mobile number, OTP verification, device identifiers, cross-restaurant order history) | **Data Fiduciary** | · |
| Order data for your outlets (items, table, status, amounts, diner name/contact shared for fulfilment) | Data Processor (processing on your behalf for fulfilment) and Data Fiduciary for platform operation, security, and legal compliance | **Data Fiduciary** for your own use (service, records, your customer relations) |
| Your staff logins (names, contact, credentials, activity/audit logs) | Data Processor / Fiduciary for security | Data Fiduciary (you collect staff consent) |
| Ratings/reviews of your outlets | Data Fiduciary (platform content) | Recipient |

## 4.2 Wephoton's obligations

1. Process personal data only for providing the Service, security, legal compliance, and as instructed through Platform features; never sell it or use diner data to advertise competing restaurants to your diners.
2. Apply reasonable security safeguards: TLS encryption in transit, encrypted storage and hashed credentials at rest, role-based access, **row-level tenant isolation so one merchant's data is not readable by another**, kitchen-room-scoped realtime channels, rate limiting, and audit logs.
3. Notify you without undue delay of any personal data breach affecting your tenant data, and make required notifications to the Data Protection Board of India and CERT-In.
4. Maintain server and security logs for at least 180 days in accordance with the CERT-In Directions, 2022.
5. Engage sub-processors only under contracts imposing equivalent protections. Current sub-processors: **[VPS PROVIDER, REGION]** (server hosting); **PhonePe Private Limited**, **PayU Payments Private Limited**, and **Cashfree Payments India Private Limited** (diner payment processing, per the gateway you select); **Razorpay Software Pvt. Ltd.** (subscription billing); **MSG91** (SMS/OTP delivery); **Resend** (transactional email). Error monitoring is self-hosted by Wephoton; no third party receives error data. We will notify material sub-processor changes; continued use constitutes acceptance, or you may terminate per Section 1.6.
6. Assist with data principal requests (access, correction, erasure) relating to your tenant data via Platform tools or support.
7. On termination, export and delete data per Section 1.7 of the Merchant Terms.

## 4.3 Merchant's obligations

1. Use diner data received through the Platform **only** for fulfilling orders and servicing those diners. Do not export diner contact data for marketing without your own valid, DPDP-compliant consent collected independently of the Platform.
2. Obtain consent from your staff for processing their data on the Platform (logins, activity logs).
3. Do not attempt to access data of other merchants or diners beyond what the Platform exposes to you.
4. Comply with the DPDP Act as an independent Data Fiduciary for data you control; you are solely responsible for your own marketing communications and their compliance (including TRAI telemarketing regulations).
5. Report any suspected breach or unauthorised access observed on your side to **support@wephoton.in** within 24 hours.

## 4.4 Data location

Platform data is hosted on Wephoton-managed servers at **[VPS PROVIDER, REGION]**. Limited data may be processed by the sub-processors listed above in their respective regions. Transfers comply with the DPDP Act (no transfers to countries restricted by the Central Government).

---