Data Processing Addendum

Last updated: November 9, 2026 · Version 2026-11-09

This Data Processing Addendum ("DPA") forms part of the Terms of Service (the "Agreement") between EBOX3, Apartat de correus 1033, AD500 Andorra, NIF L-714284-H ("ebox3", the "Processor") and the Customer (the "Controller"). It applies automatically when the Customer accepts the Agreement, without a separate signature. Capitalised terms not defined here have the meaning given in the Agreement or in the applicable Data Protection Law.

"Data Protection Law" means the Andorran Law 29/2021 of 28 October on the protection of personal data (Llei 29/2021, qualificada de protecció de dades personals) and its regulations, and, to the extent applicable to the processing, Regulation (EU) 2016/679 (GDPR), the UK GDPR, and US state privacy laws (such as the California Consumer Privacy Act as amended). "Personal data breach", "data subject", "processing" and similar terms have the meaning given in Data Protection Law.

1. Scope and roles

1.1 This DPA applies to the personal data of End Customers and other individuals that ebox3 processes on behalf of the Customer in providing the Service ("Customer Personal Data"). The Customer is the controller and ebox3 is the processor (or "service provider" or "processor" under US law). Where the Customer is itself a processor for another controller, ebox3 is its sub-processor and the Customer is responsible for obtaining all authorisations needed from that controller.

1.2 This DPA does not apply to data that ebox3 processes as a controller: account, billing, support and marketing data about the Customer and its staff, and the free REYSTI customer accounts that End Customers open with ebox3 (account, saved tickets and marketing consent). That processing is governed by our Privacy Policy. This DPA does not apply either to anonymised or aggregated data.

2. Details of the processing

• Subject matter: the provision of the Service under the Agreement.
• Nature of the processing: collection through Kiosks and ordering channels, recording, storage, organisation, retrieval, transmission to the Customer's kitchen screens, printers, staff applications and payment terminal, transcription of voice orders, sending of order-ready text messages and digital tickets, reporting, backup, and erasure.
• Purpose: providing the Service to the Customer under the Agreement, including support, security and the prevention of abuse.
• Duration: the term of the Agreement plus the export and deletion period of section 12.
• Categories of data subjects: End Customers; the Customer's staff (Users) using Kiosks, staff applications or the back office.
• Categories of data: order contents and history, amounts, timestamps, order, table and pager numbers, optional first name, optional phone number or e-mail, loyalty identifiers and points, payment references returned by the terminal (no card numbers), voice audio while transcribed and order transcripts, User names, PIN-based sign-ins and activity logs, technical data of Kiosks and devices.
• Special categories: none intended. The Customer must not configure the Service to collect special-category or biometric data. Dietary choices may incidentally reveal information; the Customer is responsible for assessing this.
• Frequency: continuous, for as long as the Service is used.

3. Customer instructions and obligations

3.1 ebox3 processes Customer Personal Data only on the documented instructions of the Customer, including with regard to international transfers. The Agreement, this DPA and the Customer's configuration and use of the Service are the Customer's complete instructions. Additional instructions require ebox3's written agreement and may be charged. ebox3 will inform the Customer if, in its opinion, an instruction infringes Data Protection Law, and may suspend the instruction until it is confirmed or changed.

3.2 The Customer warrants that it has a lawful basis for the processing, has given all required notices to End Customers (including at the Kiosk and for voice ordering), has obtained all required consents (including for text messages and loyalty programmes) and that its instructions comply with Data Protection Law. The Customer is solely responsible for the accuracy, quality and legality of Customer Personal Data and of the means by which it was obtained.

4. ebox3 obligations

ebox3 will:

• process Customer Personal Data only for the purposes of section 2, unless required otherwise by law (in which case ebox3 informs the Customer before processing where legally allowed);
• ensure that persons authorised to process it are bound by confidentiality, by contract or by law;
• implement the security measures of section 5 and Annex 1;
• not sell Customer Personal Data, not "share" it for cross-context behavioural advertising, and not combine it with other data except as permitted by Data Protection Law for the Service;
• not store voice audio after transcription, and not use voice data to identify individuals;
• keep a record of the processing it carries out on behalf of the Customer where Data Protection Law requires it.

5. Security

5.1 ebox3 implements appropriate technical and organisational measures, taking into account the state of the art, the costs of implementation and the nature, scope, context and purposes of the processing and the risks for individuals. The measures in place are described in Annex 1. ebox3 may update these measures provided the overall level of protection is not materially reduced.

5.2 The Customer is responsible for the security of its own devices, Kiosks, printers, payment terminals, networks, accounts, PIN codes and credentials, and for the measures it must take as controller. The Customer acknowledges that the measures in Annex 1 are appropriate for the processing described in section 2.

6. Sub-processors

6.1 The Customer gives ebox3 a general written authorisation to engage sub-processors, including those in the categories listed in section 7. ebox3 imposes on each sub-processor, by contract, data protection obligations providing a level of protection substantially similar to that of this DPA, and remains responsible to the Customer for its sub-processors as required by Data Protection Law.

6.2 ebox3 keeps an up-to-date list of the sub-processors it uses (with their function and location), available to the Customer on request by e-mail to legal@reysti.com.

6.3 ebox3 will notify the Customer by e-mail or in the Service at least 30 days before a new or replacement sub-processor starts processing Customer Personal Data, except where an urgent replacement is needed for the security or continuity of the Service, in which case ebox3 notifies the Customer as soon as possible. The Customer may object in writing on reasonable data-protection grounds within that period. The parties will discuss the objection in good faith. If it cannot be resolved, the Customer's sole and exclusive remedy is to terminate the affected subscription by notice before the change takes effect, without penalty but without refund of fees already paid for the current period.

7. Sub-processor categories

The following are not sub-processors of ebox3: (a) the payment processor and terminal provider chosen by the Customer (for example SumUp or Square), which the Customer engages directly under its own terms and which acts for the Customer; (b) Redsys and our banks Creand and MoraBanc, which process only ebox3's own fees and receive no End Customer data; (c) internet, telecommunication and mobile operators that only transmit data.

8. International transfers

8.1 Andorra benefits from an adequacy decision of the European Commission. The Customer authorises ebox3 and its sub-processors to transfer Customer Personal Data outside Andorra and the EEA where necessary to provide the Service. Such transfers are made on the basis of an adequacy decision (including the EU-US Data Privacy Framework for certified recipients) or of standard contractual clauses approved by the European Commission and, where required, supplementary measures, in accordance with Andorran law and, where applicable, the GDPR.

8.2 Where the GDPR applies, the Customer is located in the EEA and a transfer to ebox3 itself requires them, the parties agree that the standard contractual clauses (Commission Implementing Decision (EU) 2021/914, Module 2 or 3 as applicable) are incorporated by reference, with the details of section 2 and Annex 1 as their annexes, the law of Andorra chosen to the extent permitted and otherwise the law and courts of Ireland. In case of conflict, those clauses prevail for that transfer.

9. Personal data breaches

9.1 ebox3 will notify the Customer without undue delay after becoming aware of a personal data breach affecting Customer Personal Data, and will aim to do so within 72 hours. The notice is sent to the account e-mail address and describes, as far as then known, the nature of the breach, the categories and approximate number of data subjects and records concerned, the likely consequences, and the measures taken or proposed. Information may be provided in phases.

9.2 ebox3 will take reasonable steps to contain and remedy the breach. The Customer is responsible for notifying authorities and data subjects where required. ebox3's notification is not an acknowledgement of fault or liability.

10. Assistance and data subject requests

10.1 Taking into account the nature of the processing, ebox3 will provide reasonable assistance to the Customer, mainly through the features of the Service (for example finding or deleting an End Customer's phone number in the back office), to respond to requests from data subjects exercising their rights, and with data protection impact assessments, prior consultations and the Customer's security obligations.

10.2 If ebox3 receives a request from an End Customer about Customer Personal Data, it will forward it to the Customer without undue delay and will not answer it itself unless legally required or authorised by the Customer. Assistance beyond the Service features may be charged at ebox3's then-current rates.

11. Audits

11.1 ebox3 will make available, on written request, the information reasonably necessary to demonstrate compliance with this DPA, primarily in the form of written answers, policies and documentation, and the certifications or audit reports published by its sub-processors (for example those Microsoft makes available for Azure).

11.2 If the Customer can show that this information is not sufficient, or if an audit is required by a supervisory authority, the Customer may carry out an audit no more than once a year, with at least 30 days' written notice, during business hours, remotely where possible, by an independent auditor bound by confidentiality and not a competitor of ebox3, without access to other customers' data, to security details that would put the Service at risk, or to sub-processors' facilities, and at the Customer's sole cost (including ebox3's reasonable time spent at its then-current rates). The audit report is ebox3's confidential information.

12. Deletion and return

After the end of the Agreement, the Customer may request an export of Customer Personal Data within 30 days as described in section 25 of the Terms of Service. ebox3 then deletes Customer Personal Data, unless storage is required by law. Backup copies are deleted in the normal backup cycle and remain protected until then. On request, ebox3 confirms deletion in writing. During the Agreement, the Customer can delete data through the features of the Service.

13. US state privacy laws

Where US state privacy laws apply, ebox3 acts as a "service provider" or "processor". ebox3 will not sell or share Customer Personal Data, will not retain, use or disclose it outside the direct business relationship with the Customer or for any purpose other than the business purposes specified in this DPA, will not combine it with personal information received from other sources except as permitted by law, will comply with the applicable obligations, will provide the same level of privacy protection as those laws require, and will notify the Customer if it can no longer meet them. The Customer may take reasonable and appropriate steps to stop and remediate unauthorised use. ebox3 certifies that it understands these restrictions.

14. Liability, term and precedence

14.1 Each party's liability arising out of or relating to this DPA, whether in contract, tort or otherwise, is subject to the exclusions and limitations of liability of the Terms of Service (section 21), and the aggregate liability under this DPA and the Agreement together does not exceed the cap stated there, to the extent permitted by Data Protection Law. This does not limit either party's liability to data subjects where Data Protection Law does not allow it. The Customer indemnifies ebox3 against claims and fines arising from the Customer's instructions, notices, consents or breach of Data Protection Law.

14.2 This DPA lasts as long as ebox3 processes Customer Personal Data. In case of conflict, this DPA prevails over the Terms of Service for the processing of Customer Personal Data only. Governing law and dispute resolution follow the Terms of Service, except where Data Protection Law requires otherwise. ebox3 may update this DPA under section 26 of the Terms of Service, provided the update does not reduce the overall protection of Customer Personal Data, unless required by law.

Annex 1: Technical and organisational measures

The following measures apply to the processing of Customer Personal Data. They are described in general terms so as not to weaken them; further details are available to the Customer under section 11.

• Encryption in transit: all connections between Kiosks, applications, browsers and the platform use encrypted HTTPS/TLS connections.
• Encryption at rest: databases and file storage are hosted on Microsoft Azure, which encrypts stored data at rest.
• Hosting: the platform runs on Microsoft Azure data centres (EU regions where available), whose physical security is managed by Microsoft.
• Access control: each customer's data is logically separated; access requires authentication; staff access to the back office and staff applications is controlled by the Customer through accounts, roles and PIN codes; administrative access by ebox3 is limited to authorised personnel on a need-to-know basis.
• Credentials: passwords and session tokens are stored only in hashed form; sign-in codes and links expire after a short time; repeated failed attempts with sign-in codes, recovery codes and password changes are limited.
• Payments: card data is entered only on the payment terminal or hosted payment page of the payment provider; ebox3 does not receive card numbers.
• Data minimisation: voice audio is not stored after transcription; Kiosks do not require personal data to order; only the data needed for the feature is sent to AI providers.
• Availability and backups: data is backed up by the hosting platform and can be restored after an incident.
• Logging and monitoring: security-relevant events and errors are logged and monitored, and alerts are sent to ebox3 for abnormal payment or system events.
• Secure development: software and dependencies are kept up to date, security fixes are applied with priority, and secrets are not stored in client applications.
• Confidentiality: persons authorised to process personal data are bound by confidentiality.
• Incident response: personal data breaches are handled and notified as described in section 9.

© EBOX3 · Apartat de correus 1033, AD500 Andorra · NIF L-714284-H. All rights reserved.