Data Processing Agreement

This DPA applies for as long as KinMol processes personal data for the business, and continues to apply to any remaining processing, such as backups awaiting deletion, until that data is deleted under section 10.

KinMol processes personal data only to provide the features the business has switched on: selling and invoicing, the books, bookings, table ordering, staff and payroll, customers, membership and dues, websites and business email, and NEX where used.

• The business's staff
• The business's customers and members
• Guests who order from a table
• People who receive email from the business

As described in our Privacy Policy, including identity and contact details, purchase and payment history, dues, attendance and payroll, and messages sent or received through the Service.

• The business decides what personal data it enters into KinMol, and is responsible for having a lawful basis and, where required, consent, including consent before sending marketing messages
• The business is responsible for the accuracy of the data, and for managing who in the business has access
• The business responds to requests it receives from its staff and customers, with our reasonable help under section 7

• KinMol processes personal data only on the business's documented instructions, as given through the Service's settings and features
• Everyone at KinMol authorised to process the data is bound by confidentiality
• KinMol keeps appropriate technical and organisational security measures, as described in our Privacy Policy
• KinMol tells the business without undue delay after becoming aware of a personal data breach affecting its data

KinMol gives reasonable technical help so the business can answer requests to access, correct, delete or move personal data, using the Service’s own export and deletion tools.

• Supabase: database and sign-in
• Google: application hosting (Google Cloud), and Google sign-in where a user chooses it
• Amazon Web Services: email delivery (Amazon SES) and file storage (Amazon S3)
• Anthropic: the AI models behind NEX. Text and images are processed to produce the requested answer, and are not used to train models
• NVIDIA: making menu photos when a user asks NEX to; only the dish name and description are processed, for that purpose only
• eSewa, Khalti and Fonepay: payment gateways, using the business's own merchant account; KinMol receives the payment reference and status only

KinMol remains responsible for its sub-processors meeting data protection obligations equivalent to this DPA, and will give reasonable notice of a change in sub-processors that materially affects how a business’s data is processed.

Where personal data is processed by infrastructure outside Nepal, KinMol relies on its sub-processors’ security and compliance safeguards and takes reasonable steps to keep an equivalent level of protection.

When a business stops using KinMol, its data is available to export for a reasonable period. KinMol then deletes or anonymises the remaining personal data under our Account Deletion page, except where the law requires it to be kept, such as tax invoices and the books.

KinMol makes available the information reasonably needed to show compliance with this DPA, and allows audits by the business or an auditor it appoints, with reasonable notice and confidentiality.

For DPA requests, including a signed copy, write to hello@kinmol.com.