Draft. This document is being reviewed and is not yet in force.

Spotless Data Processing Agreement

Version: 0.1 · Effective: with the Customer's Terms of Service

1. Roles

The Customer is the Data Fiduciary for the personal data it puts into Spotless about its staff and guests. LEMONBYTE LLP (LLPIN ACM-5045), 259, Damodar Niwas, Gudi Paroda, Margao, St. Jose De Areal, Quepem, Salcete, South Goa- 403709, Goa, India, is its Data Processor, and processes that data only to provide, secure and support Spotless under the Terms and this Agreement, and on the Customer's documented instructions (the Terms, the Order, the Customer's settings in Spotless, and written requests). Terms section 4 separately allows use of properly anonymised and aggregated data.

If LEMONBYTE LLP believes an instruction breaks the law, it will say so and need not follow it.

2. What is processed

Annex 1 lists the people concerned, the kinds of data, the purposes and how long data is kept.

3. LEMONBYTE LLP's obligations

LEMONBYTE LLP will:

process personal data only as set out in section 1;
ensure everyone who can reach it is bound by confidentiality, and limit access to the staff who need it to run and support Spotless;
keep the security measures in Annex 2, and not reduce them materially;
use only the sub-processors in Annex 3, under written terms at least as protective as this Agreement, and stay responsible for them;
help the Customer answer requests from people exercising their rights (access, correction, erasure, nomination, grievance), mainly through Spotless itself (correcting or removing a person, exporting their record), and pass on any request it receives directly within 7 working days;
tell the Customer of a personal data breach affecting Customer data without undue delay and in any case within 48 hours of becoming aware, with what is known (what happened, the data and people affected, likely consequences, what is being done) and updates as more is learned, so the Customer can inform the Data Protection Board and affected people as the DPDP Rules require;
help the Customer with any assessment or audit the law requires of it, as far as it concerns Spotless;
at the end of the agreement, let the Customer export its data for 30 days from the end date, then delete it within 60 days after that export period, except what the law requires LEMONBYTE LLP to keep. Backup copies expire within 30 days after the data is deleted from live systems. LEMONBYTE LLP will confirm deletion in writing on request.

4. Sub-processors

Annex 3 lists the current sub-processors. LEMONBYTE LLP will give the Customer at least 7 days' notice of a new or replacement sub-processor (by email and on spotlessplatform.com/subprocessors), or less where it is urgently needed for security or to meet the law, in which case it will tell the Customer as soon as it can. The Customer may object on reasonable data protection grounds; the parties will discuss it in good faith, and if it cannot be resolved the Customer may end the affected part of the Service and receive a refund of fees paid for the time after it ends.

5. Transfers outside India

LEMONBYTE LLP and its sub-processors may process data outside India, except to any country the Government of India restricts under section 16 of the DPDP Act. Annex 3 says where each sub-processor works. LEMONBYTE LLP will ensure that any further transfer by a sub-processor is covered by terms at least as protective as this Agreement.

6. Spotless access to Customer data

LEMONBYTE LLP staff may see Customer data in three ways:

Support access to a Customer's account: only to provide support, when one of the Customer's owners allows it, read-only and for a limited time. Every such access is shown to the Customer's owners in Spotless.
Problem reports: what a person chooses to send through the problem-report function, including any screenshot, is seen by LEMONBYTE LLP operators to fix the problem.
Technical diagnostics, as described in the Privacy Policy and Annex 2.

7. Audits

On reasonable notice, no more than once a year (or after a breach), LEMONBYTE LLP will answer the Customer's written questions about its compliance with this Agreement and provide reasonable evidence.

8. The Customer's obligations

The Customer will have a valid ground under the DPDP Act (consent or a legitimate use) and give the notices the law requires for the personal data it puts into Spotless (LEMONBYTE LLP provides notice templates for staff and for guests), use the Service in line with the acceptable use rules (including not photographing people), and keep its own Users' access up to date.

9. Liability and term

Liability under this Agreement is governed by the Terms of Service. This Agreement lasts as long as LEMONBYTE LLP processes Customer personal data, including during any Pilot.

Annex 1: Processing details


People concerned	The Customer's staff, supervisors, managers, owners and auditors who use Spotless; guests who report a problem or order through a Spotless code
Staff data	Name, role, property, staff code, mobile number, work email (website users), PIN and password hashes; optional birthday (day and month), start date, languages and emergency contact if the Customer records them; checks, answers, notes, issues and requests they create; photos of surfaces, equipment and stock; location when a check is submitted (approximate or more accurate, depending on the device); location or scanned code at attendance check-in (Attendance add-on); push token, device model, operating system and app version; messaging channel and chat or phone identifier if they turn messages on
Guest data	Problem category, what they write, an optional photo, optional contact details; Dining orders and the room or table
Sensitive data	None intended. Spotless is designed never to photograph people and collects no biometric data
Purposes	Showing each person their work; recording and proving checks; raising and tracking issues; notifications and messages; reports and exports; security, support and fixing problems
Retention	As set out in the Privacy Policy, section 11 (including the periods the Customer can choose for photos); deletion at the end of the agreement under section 3(8)

Annex 2: Security measures

Encryption in transit (HTTPS/TLS) for every connection, and at rest for the database, photo storage and backups.
Each Customer's data kept apart by row-level security in the database; the application connects with a role that cannot bypass it.
Photos in private storage, never publicly addressable, opened only through links that expire within minutes.
Passwords and PINs stored only as one-way hashes (Argon2id or the sign-in provider's equivalent); optional second sign-in step; enforced for LEMONBYTE LLP's own operator accounts.
Database reachable only from the application server; firewall allowing only web traffic and SSH; deploy keys pinned to the server.
Saved checks never edited; an audit trail of changes and of LEMONBYTE LLP support access, visible to the Customer's owners.
Nightly database backups kept with a different provider from the database, and a backup before every update.
Diagnostics that never record request contents, names, phone numbers, PINs, passwords or photos. During a Pilot, when LEMONBYTE LLP asks and one of the Customer's owners confirms access, a more detailed log of screens opened and actions sent may be kept, under the same limits.
People who leave are signed out at once and their identity erased after a grace period, keeping only an anonymous link to the work they did.

Annex 3: Sub-processors

See subprocessors.md (published at spotlessplatform.com/subprocessors).