Certain words and phrases in this DPA have specific definitions when they start with capital letters. Where a defined term is used, it either has the meaning set out in annex 1 below (Definitions) or the meaning given to it in the relevant clause of this DPA. ”Data controller”, “data subject”, “personal data”, “process”, “processing”, “data processor” “data subject request”, “personal data breach”, “subprocessors” and “supervisory authority” shall have the meaning given to it in the Data Protection Legislation.

2.3 The Merchant understands and acknowledges that personal data in the scope of this clause 2 shall be processed by Sunday in accordance with:

(i) our User Privacy Policy accessible at https://sundayapp.com/privacy-policy/, and (ii) our Privacy Policy for Merchants accessible at https://sundayapp.com/privacy-policy-waiters-personnel/.

2.4 The Merchant shall ensure that it has all necessary appropriate consents and notices in place to enable lawful transfer of the personal data related to its personnel to Sunday for the duration and purposes of this DPA.

3.6 Sunday shall notify the Merchant without undue delay upon becoming aware of and confirming any accidental, unauthorized, or unlawful processing of, disclosure of, or access to the personal data.

3.7 In order to provide the Sunday Services to the Merchant, Sunday will only access and process personal data from (i) countries in the EEA, (ii) countries or territories formally recognised by the European Commission as providing an adequate level of data protection (“Adequate Countries”) and (iii) third countries or territories provided Sunday and the relevant subprocessor have put a Valid Transfer Mechanism in place.

3.8 Sunday shall at the written direction of the Merchant, delete or return personal data and copies thereof to the Merchant on termination of this DPA unless required by Data Protection Laws or other applicable laws to store personal data.

3.9 Sunday shall implement, and at all times during this DPA maintain technical and organizational safeguards to protect personal data from unauthorized or unlawful processing or accidental loss or damage: (i) ensuring in each case a level of security appropriate to the risk; and (ii) maintaining PCI DSS level 1 service provider certification; and (iii) in addition maintaining controls in line with accepted industry practices including the International Organization for Standardization's standards: Requirements of the National Institute of Standards and Technology (NIST) Cybersecurity Framework.

3.10 At a minimum, Sunday’s safeguards for the protection of personal data shall include: (i) securing, cloud systems, backup systems, and computing equipment, including, but not limited to, all endpoint devices and other equipment with information storage capability; (ii) implementing network, application, database, and platform security; (iii) securing information transmission, storage, and disposal; (iv) implementing authentication and access controls within media, applications, operating systems, and equipment; (v) encrypting personal data at rest where possible; (vi) encrypting personal data transmitted over transit in network; (vii) strictly segregating Merchant data from information of Sunday or its other customers so that Merchant Data is not commingled with any other types of information; (viii) conducting risk assessments, and vulnerability scans and promptly implementing, at Sunday’s sole cost and expense, a corrective action plan to correct any issues that are reported as a result of the testing; (ix) implementing appropriate personnel security and integrity procedures and practices; and (x) providing appropriate information security awareness training to Sunday employees.

a data transfer mechanism permitted by the Data Protection Laws as a lawful basis for transferring personal data to a recipient located in a third country in the meaning of GDPR and the Data Protection Act 2018.

The term of the Agreement plus the period from the end of the term until deletion of all personal data by Sunday in accordance with its obligations under this DPA.