1. Definitions
Terms such as "personal data," "processing," and "data subject" have the meanings given under applicable U.S. state privacy laws (e.g., CCPA/CPRA and comparable state statutes) to the extent applicable to Anubhu's processing activities.
2. Scope
This DPA applies to personal data of the Business's customers ("Consumer Data") that Anubhu processes solely to provide the Anubhu platform to the Business.
3. Roles of the parties
For Consumer Data processed through the Business's feedback experience, the Business acts as the business/controller and Anubhu acts as the service provider/processor, processing Consumer Data only for the purposes described in this DPA and the Business Terms.
4. Documented instructions
Anubhu will process Consumer Data only on the Business's documented instructions, as reflected in the Business Terms, this DPA, and the Business's configuration of the platform, unless otherwise required by law.
5. Processing purposes
Providing the Anubhu service to the Business, including feedback collection, customer-service follow-up, loyalty/rewards administration, fraud/security prevention, and analytics.
6. Confidentiality
Anubhu limits access to Consumer Data to personnel who need it to perform the service and who are subject to confidentiality obligations.
7. Security
Anubhu maintains administrative, technical, and organizational measures designed to protect Consumer Data appropriate to the nature of the data processed. [SECURITY MEASURES DETAIL — PLACEHOLDER]
8. Subprocessors
Anubhu may engage subprocessors to provide the platform, as listed in our Subprocessor list, which we will keep reasonably current.
9. Assistance with consumer/data-subject rights
Anubhu will provide reasonable assistance to the Business in responding to verified consumer requests to access, correct, delete, or opt out of the sale/sharing of Consumer Data, to the extent required by applicable law.
10. Deletion or return of data
Upon termination of the Business Terms, Anubhu will delete or return Consumer Data as instructed by the Business, except where retention is required by law. [RETENTION/DELETION TIMELINE — PLACEHOLDER]
11. Breach notification
Anubhu will notify the Business without undue delay after becoming aware of a security incident affecting Consumer Data. [NOTIFICATION TIMEFRAME — PLACEHOLDER FOR COUNSEL REVIEW]
12. International transfers
Where Consumer Data is processed or stored outside the Business's home jurisdiction, Anubhu will take steps intended to provide an adequate level of protection consistent with applicable law.
13. Audit and cooperation
Anubhu will reasonably cooperate with information requests from the Business necessary to demonstrate compliance with this DPA. [AUDIT RIGHTS DETAIL — PLACEHOLDER]
14. Applicable U.S. state privacy-law provisions
To the extent applicable state privacy laws (e.g., CCPA/CPRA and comparable statutes) impose specific service-provider/processor contract terms, those terms are incorporated by reference and will be finalized with counsel input.
15. Schedule: categories of data and processing
| Category | Detail |
|---|---|
| Data subjects | Restaurant customers / consumers |
| Personal data | Name, email, phone, feedback text, ratings, restaurant/location, technical identifiers (IP, device), loyalty data, coupon/reward data, receipt data (if applicable) |
| Processing purpose | Providing the Anubhu service to the Business |
16. Version
DPA version 2026-09-v1. Contact: [ANUBHU PRIVACY EMAIL]