Our DPA, available on request

For your diners' personal data, you are the data controller and Ontabee (Ontabee Solutions Pvt. Ltd.) is the processor, processing it only on your documented instructions.

This DPA governs only the diner data we process on your behalf. It does not cover data about you — the details you give us when you enquire, sign up, or run your account. For that data Ontabee is the controller, not a processor, and our Privacy Policy governs it.

Concretely: when you send us an enquiry through the contact form we record what you typed together with your IP address, the country it places you in, your browser’s time zone, and how you reached the site. We use it to answer you and to understand which of our pages are useful. It reaches our sales inbox and our CRM (HubSpot) — never an advertising network. Ask us at [email protected] to see or delete it.

Subject matter: operating your online ordering. Nature: storing and processing menus, customer profiles, and orders; routing transactional messages through your configured providers. Duration: the life of your account plus the retention window in our Privacy Policy.

We use only the sub-processors needed to run the service (cloud hosting; the platform-tier email service for account/billing messages). Your customer-facing payment, SMS, email, maps, and push run through your own configured providers.

Encryption in transit; provider credentials encrypted at rest in a secrets vault; tenant isolation; role-based access; audited administrative access; rate limiting. See the Security page.

We assist you in responding to access, export, and deletion requests, and will notify you without undue delay on becoming aware of a personal-data breach affecting your data.

Production data can be hosted in the region you select at onboarding (EU, India, or GCC). Where transfers occur, appropriate safeguards apply.

On termination you can export everything during a 30-day offboarding window, after which we delete or anonymize your data per the Privacy Policy.