Data Processing Agreement

Version 1.0 · 23 September 2026 · Annex 1 to the Terms of Service.

Annex 1 to the Yasi Terms of Service — version 1.0. Between the Customer ("Controller") named in the account or order form, and yasi as, org. no. 938 261 350, Hjalmar Johansens gate 314, 9007 Tromsø, Norway ("Processor", "Yasi"). This DPA applies whenever Yasi processes personal data on the Customer's behalf and is required by GDPR art. 28. It prevails over the Terms on data-protection matters only.

1. Subject, duration, nature and purpose

Yasi processes personal data to provide the Service described in the Terms: taking and managing reservations and guest profiles, sending booking messages, operating the AI concierge and WhatsApp channel, guest marketing the Customer chooses to send, point of sale, staff scheduling and time registration, team messaging, kitchen coordination, compliance logs and operational reports. Processing lasts for the term of the Terms plus the deletion period in section 9. Operations: storage, retrieval, display, transmission, analysis and deletion.

2. Data subjects and data

Guests (name, email, phone, party size, dates, visit and spend history, notes and dietary information the guest volunteers, chat and message content, consent status). Employees (name, contact details, role, schedules, clock times, pay rate, messages, documents, compliance entries). Dashboard users (name, email, permissions, activity log). Dietary and allergy information may be special-category data (art. 9); it is processed only because the data subject volunteers it for their own booking (art. 9(2)(a)), used only for that booking and never for segmentation or marketing.

3. The Customer's instructions

The Service's features and the Customer's configuration and use of them are the Customer's complete documented instructions. Yasi processes only on those instructions unless EU/EEA or Norwegian law requires otherwise, in which case Yasi informs the Customer before processing where the law allows. Additional instructions that require changes to the Service are agreed in writing and may be charged.

4. Yasi's obligations

Yasi shall: (a) ensure people authorised to process the data are bound by confidentiality; (b) implement the technical and organisational measures in Annex A; (c) engage sub-processors only under section 7; (d) taking into account the nature of the processing, assist the Customer with data-subject requests by appropriate technical means (the Service's export, edit and delete functions) and, where those are insufficient, on request; (e) assist the Customer with art. 32 to 36 obligations, taking into account the information available to Yasi; (f) delete or return the data under section 9; (g) make available the information reasonably necessary to demonstrate compliance and allow audits under section 8; (h) inform the Customer if an instruction, in Yasi's opinion, infringes data-protection law.

5. The Customer's obligations

The Customer is responsible for the lawfulness of the processing, including having a legal basis, giving privacy notices to guests and employees (Yasi provides templates), obtaining consent before marketing, the accuracy and appropriateness of data its staff enter (free-text notes must be factual and service-relevant), configuring user permissions correctly, and responding to data subjects. The Customer indemnifies Yasi for claims arising from the Customer's breach of these obligations.

6. Confidentiality and personnel

Access to personal data within Yasi is limited to personnel who need it to operate, support or secure the Service, all under written confidentiality obligations.

7. Sub-processors

The Customer gives general authorisation for the sub-processors listed at getyasi.com/sub-processors (Annex B) as of signature. Yasi gives at least 30 days' notice on that page and by email before adding or replacing a sub-processor. The Customer may object in writing on reasonable, documented data-protection grounds within that period; if the objection cannot be resolved, the Customer may terminate the affected Service with a pro-rata refund of prepaid fees as its sole remedy. Yasi imposes data-protection obligations on each sub-processor equivalent to this DPA and remains liable for their performance. Transfers outside the EU/EEA rely on an adequacy decision (including the EU–US Data Privacy Framework) or Standard Contractual Clauses.

8. Audits

Yasi provides, on written request no more than once per 12 months, a description of its measures, the results of its most recent security audits and answers to a reasonable security questionnaire within 30 days. Where this does not reasonably satisfy the Customer's legal obligations, the Customer or an independent auditor bound by confidentiality may audit Yasi's relevant systems: once per 12 months (or after a confirmed breach), with 30 days' notice, during business hours, limited in scope to this DPA, at the Customer's cost, and without access to other customers' data or to sub-processors' premises (their own certifications and reports apply).

9. Deletion and return

During the term the Customer can export its data from the Service. On termination the Customer has 30 days to export; Yasi then deletes the personal data within 90 days, except data Yasi must keep by law (for example invoices) and encrypted backups, which expire on their rotation schedule of at most 30 further days. Yasi confirms deletion in writing on request.

10. Personal data breach

Yasi notifies the Customer without undue delay, and at the latest 48 hours after confirming a personal data breach affecting the Customer's data, with the information available at that time (nature, categories and approximate numbers, likely consequences, measures taken), and supplements it as more becomes known. Notification is not an admission of fault. The Customer is responsible for notifying authorities and data subjects.

11. Records, data protection officer

Yasi keeps the records required by art. 30(2). Yasi has not appointed a DPO; the privacy contact is privacy@getyasi.com.

12. Liability, law and venue

Liability under this DPA is subject to the limitations and exclusions in the Terms (section 13), which apply to the parties' combined liability under the Terms and this DPA. Each party is liable for administrative fines imposed on it. Norwegian law applies; venue is Oslo tingrett.

13. Term

This DPA applies from the Customer's acceptance of the Terms and ends when all personal data has been deleted under section 9.

Annex A — Technical and organisational measures

Encryption in transit (TLS 1.2+) and at rest; production data hosted in the EU (Frankfurt); tenant isolation: every record carries a venue identifier and every request is checked against it, covered by an automated test suite run on each deployment; role-based access (owner, per-area dashboard permissions, per-person staff codes, device tokens for shared screens) with sensitive pay data behind a separate grant; owner authentication by a dedicated identity provider with two-factor available; staff and device tokens are signed, bound to the code that issued them and revocable; secrets kept in environment configuration, never in code; rate limiting and abuse controls on public endpoints; security headers on all web properties; health monitoring with alerting; independent code security audits (July, August and September 2026) with findings remediated; automated encrypted backups with point-in-time recovery; audit log of privileged actions retained 90 days; sub-processors selected for SOC 2 / ISO 27001 certification or equivalent.

Annex B — Sub-processors

The list at getyasi.com/sub-processors, as updated under section 7.