Data Processing Addendum (Summary)
This is a plain-English summary of the Data Processing Addendum (“DPA”) that forms part of the agreement between LoweCo LLC (RIGN) and each customer. The signed DPA controls. To request a copy for signature, email legal@getrign.com.
1. Roles
The customer (the restaurant or bar) is the controller and the “business” under the CCPA for personal information in its Customer Data. RIGN is its processor and “service provider”, and processes that personal information only to provide the Service.
2. What's processed
| People | Types of data |
|---|---|
| Employees and contractors | Name, contact details, role, PIN (hashed), schedules, time punches, breaks, wage rates, tips and tip-outs, sales and void activity, staff chat messages, payroll export data |
| Guests | Name, phone or email given for an order, order and check details, delivery address and notes from online ordering, table and party details |
| Customer's managers and owners | Name, email, role, sign-in and activity records |
The purpose is to run the customer's point of sale, kitchen, scheduling, time clock, tips, reporting, online ordering, staff chat and venue equipment control, and to support and secure the Service. Processing lasts for the subscription and the export and deletion period after it.
3. RIGN's commitments
- Process personal information only on the customer's documented instructions (the agreement and the customer's use of the Service) and tell the customer if we believe an instruction breaks the law.
- Not sell or share it, not use it for our own purposes outside the business relationship, and not combine it with other data except as the CCPA allows.
- Make sure staff with access are bound by confidentiality.
- Maintain reasonable security measures (Section 5).
- Help the customer respond to privacy requests from its employees and guests, and with assessments the law requires, taking into account the nature of the processing.
- Notify the customer without undue delay, and within 72 hours, after confirming a security incident affecting its personal information, and share what we know to help the customer meet its obligations.
- Return or delete personal information at the end of the subscription as described in the Terms.
- Make information available to show compliance, and allow reasonable audits, no more than once a year with notice, primarily through written questionnaires and documentation.
- Notify the customer if we can no longer meet our CCPA obligations, and allow the customer to take reasonable steps to stop unauthorized use.
4. Subprocessors
The customer authorizes RIGN to use subprocessors bound by written terms that protect data at least as well as the DPA. RIGN remains responsible for them. We'll give 30 days' notice of a new subprocessor, and the customer may object on reasonable data-protection grounds.
| Subprocessor | Purpose |
|---|---|
| Render | Cloud hosting for RIGN services and database |
| Cloudflare | DNS, content delivery, secure connections between locations and the cloud, access protection |
We'll update this list, with notice, before adding a new subprocessor. Integrations a customer turns on (payment processors, delivery marketplaces, payroll and payout providers, website platforms) act under the customer's own agreements with them and aren't RIGN subprocessors.
5. Security measures
- Encryption of data in transit (HTTPS/TLS).
- Role-based permissions in the product, with separate roles for owners, managers, servers, bartenders, kitchen and support.
- Two-step verification for owner sign-in; passwords and PINs stored only as salted hashes.
- Automatic sign-out of shared registers after inactivity, configurable per role.
- Audit records of sensitive actions such as voids, item removals and schedule changes.
- Restricted, logged administrative access to production systems.
- Backups and the ability for on-site equipment to keep working during internet outages.
RIGN does not currently claim any third-party security certification or attestation.
6. Location
Data is stored and processed in the United States and on RIGN equipment at the customer's own locations.