Data Processing Agreement

This Data Processing Agreement ("DPA") is part of the Terms of Service (the "Agreement") between ExtraGM LLC ("ExtraGM," "we," "us") and the business that has an ExtraGM account (the "Customer"). It applies whenever ExtraGM processes personal data on the Customer's behalf and a data protection law listed below applies to that processing. Customers agree to it by accepting the Agreement; no signature is needed. If you need a signed copy, write to support@extragm.com.

1. Definitions

"Data Protection Laws" means every law on privacy and personal data that applies to the processing under the Agreement, including the EU General Data Protection Regulation 2016/679 ("GDPR"), the GDPR as it forms part of UK law and the UK Data Protection Act 2018 ("UK GDPR"), the Swiss Federal Act on Data Protection ("FADP"), and United States state privacy laws such as the California Consumer Privacy Act ("CCPA").

"Customer Personal Data" means personal data that the Customer, its owners, managers or staff put into the Services, or that the Services create about them, and that ExtraGM processes on the Customer's behalf.

"Sub-processor" means a company ExtraGM engages to process Customer Personal Data.

"SCCs" means the standard contractual clauses approved by the European Commission in Implementing Decision (EU) 2021/914. "UK Addendum" means the International Data Transfer Addendum to the SCCs issued by the UK Information Commissioner (version B1.0, in force 21 March 2022).

"Controller," "processor," "data subject," "personal data," "personal data breach," "processing" and "supervisory authority" have the meanings given in the GDPR. "Services" has the meaning given in the Agreement.

2. Roles

For Customer Personal Data, the Customer is the controller and ExtraGM is the processor. If the Customer itself acts as a processor for another controller, ExtraGM is its sub-processor and the Customer is responsible for passing on the instructions of that controller.

ExtraGM is a controller, not a processor, for the personal data it needs to run its own business: account and sign-in details of the Customer's account owner, billing and payment records, support conversations, website visits and marketing. Our Privacy Policy covers that data.

The Customer is responsible for having a lawful basis for the data it puts into the Services, for telling its staff how their data is used, and for the accuracy of that data. The Customer should not put special categories of personal data (such as health information) into the Services except where its own law allows it and only as far as needed, for example in a time-off note.

3. Processing on the Customer's instructions

ExtraGM processes Customer Personal Data only on the Customer's documented instructions. The Agreement, this DPA and the Customer's use and settings of the Services are those instructions. ExtraGM will not process Customer Personal Data for any other purpose, unless a law it is subject to requires it; in that case we will tell the Customer first, unless that law forbids it. We will tell the Customer if we believe an instruction breaks Data Protection Laws.

Annex I describes the processing: its subject matter, nature, purpose and duration, and the types of personal data and data subjects.

4. Confidentiality

ExtraGM gives access to Customer Personal Data only to people who need it to provide, support or secure the Services, and only after they have committed to confidentiality or are under a legal duty of confidentiality.

5. Security

ExtraGM takes the technical and organizational measures in Annex II to protect Customer Personal Data against accidental or unlawful destruction, loss, alteration, unauthorized disclosure or access. We may update these measures over time, as long as the overall level of protection does not go down.

6. Sub-processors

The Customer gives ExtraGM general authorization to engage Sub-processors. The current Sub-processors are listed in Annex III.

ExtraGM will tell the Customer at least 30 days before a new Sub-processor starts processing Customer Personal Data, by email to the account owner and by updating Annex III. The Customer may object on reasonable data protection grounds within that period by writing to support@extragm.com. We will then try in good faith to find a solution. If we cannot, the Customer may end the Agreement and we will refund any fees paid in advance for the period after the end.

ExtraGM imposes on each Sub-processor, by written contract, data protection obligations that protect Customer Personal Data at least as well as this DPA. ExtraGM remains responsible to the Customer for the work of its Sub-processors. Apple Inc. is the exception: Apple offers the Apple Push Notification service only under its standard Apple Developer Program License Agreement, not under a separate data processing agreement. Under those terms, Apple may access or disclose the content of a notification only in limited cases, such as to comply with legal process or to enforce those terms.

7. Requests from data subjects

Most requests can be handled in the Services themselves: owners and managers can view, correct and remove staff information, and staff can delete their own account. Taking into account the nature of the processing, ExtraGM will help the Customer respond to requests from data subjects to exercise their rights. If a data subject contacts ExtraGM directly about Customer Personal Data, we will pass the request on to the Customer and will not answer it ourselves unless the Customer asks us to or the law requires it.

8. Personal data breaches

ExtraGM will notify the Customer without undue delay, and in any case within 48 hours, after becoming aware of a personal data breach affecting Customer Personal Data. The notice will describe, as far as we know at the time, what happened, the data and people concerned, the likely consequences and the steps taken or proposed. We will add information as it becomes available, take reasonable steps to contain the breach, and help the Customer meet its own duties to notify authorities and data subjects. Notifying a breach is not an admission of fault.

9. Impact assessments and consultations

Taking into account the nature of the processing and the information available to us, ExtraGM will give the Customer reasonable help with data protection impact assessments and with prior consultations of supervisory authorities that concern the Services.

10. Return and deletion

While the account is open, the Customer can view its data in the Services, download the exports the Services offer, or ask us for a copy. When the Customer deletes its account, or asks us to close it or to delete its data, ExtraGM deletes Customer Personal Data within 30 days. If a trial or subscription ends without that, the account is paused and the data is kept, still protected by this DPA, until the Customer deletes the account or asks us to delete the data. Copies in backups are overwritten in the normal backup cycle and are not used in the meantime. This does not apply where a law requires us to keep the data; any data kept for that reason stays protected by this DPA.

11. Information and audits

ExtraGM will make available the information reasonably needed to show compliance with this DPA, including answers to security questionnaires and, where available, the security reports and certifications of our Sub-processors. If that is not enough, or if a supervisory authority requires it, the Customer may audit ExtraGM's compliance once a year, with at least 30 days' written notice, during business hours, without disrupting the Services, at its own cost, and through an auditor bound by confidentiality who is not a competitor of ExtraGM.

12. International transfers

ExtraGM is based in the United States and stores Customer Personal Data in the United States. Some Sub-processors may process it in other countries, as shown in Annex III.

EU and EEA

Where Customer Personal Data is transferred from the European Economic Area to ExtraGM in a country without an adequacy decision, the SCCs apply and are incorporated into this DPA by reference, as follows: Module Two (controller to processor) applies, and Module Three (processor to processor) applies where the Customer is a processor; the Customer is the data exporter and ExtraGM the data importer; the optional docking clause in Clause 7 applies; under Clause 9, Option 2 (general written authorization) applies, with the notice period in section 6 of this DPA; the optional language in Clause 11 does not apply; under Clause 13, the supervisory authority is the one determined by that clause; under Clauses 17 and 18, the SCCs are governed by the law of Ireland and disputes go to the courts of Ireland; and Annexes I, II and III of this DPA are the annexes of the SCCs. The Customer's acceptance of the Agreement counts as signature of the SCCs.

United Kingdom

Where Customer Personal Data is transferred from the United Kingdom, the UK Addendum applies and is incorporated by reference, as follows: Table 1 is completed with the parties' details in Annex I; Table 2 refers to the SCCs as selected above; Table 3 is completed with Annexes I, II and III of this DPA; and in Table 4, either party may end the UK Addendum as allowed by its Section 19.

Switzerland

Where Customer Personal Data is transferred from Switzerland, the SCCs apply as described above, with these changes: the Swiss Federal Data Protection and Information Commissioner is the competent supervisory authority as far as the transfer is governed by the FADP; references to the GDPR are read as references to the FADP; and "Member State" includes Switzerland, so that data subjects in Switzerland can bring claims where they habitually live.

If the authority that approved a transfer mechanism replaces or changes it, ExtraGM may switch to the replacement by updating this DPA.

13. United States privacy laws

Where the CCPA or a similar state law applies, ExtraGM acts as the Customer's service provider or processor. ExtraGM will not sell or share Customer Personal Data; will not keep, use or disclose it for any purpose other than providing the Services, or outside its direct business relationship with the Customer; will not combine it with personal data it receives from others, except as those laws allow; and will tell the Customer if it can no longer meet these obligations.

14. General terms

If there is a conflict, the SCCs and the UK Addendum take precedence over this DPA, and this DPA takes precedence over the rest of the Agreement. Each party's liability under this DPA is subject to the limits in the Agreement, except where Data Protection Laws or the SCCs do not allow that. This DPA lasts as long as ExtraGM processes Customer Personal Data. ExtraGM may update this DPA by publishing a new version on this page and telling the Customer by email; updates will not reduce the protection of Customer Personal Data, unless a law or a supervisory authority requires the change. This English version governs; translations are provided for convenience.

Annex I: Description of the processing

A. Parties

Data exporter (controller, or processor under Module Three): the Customer, with the name, address and contact person given in its ExtraGM account. Activities: using ExtraGM to schedule, train and communicate with its restaurant team. Signature and date: by accepting the Agreement.

Data importer (processor): ExtraGM LLC, 9722 Groffs Mill Dr, PMB 30011, Owings Mills, MD 21117, USA. Contact: support@extragm.com. Activities: providing the Services under the Agreement. Signature and date: by publishing this DPA and providing the Services.

B. Description of the transfer

• Data subjects: the Customer's owners, managers and employees, and other people the Customer invites to its account.
• Personal data: names and short names; work email addresses; roles, positions and locations; availability, time-off requests and their notes; schedules, shifts, shift swaps and hours worked, including clock-in and clock-out times, breaks and, where the Customer turns on the location check, the device's location at that moment (compared with the restaurant's address, not stored) and the result; pay rates and labor costs (shown only to owners and authorized managers); team chat messages, reactions and announcements; training documents and their read status; app language, time zone, notification settings and device push tokens; and sign-in data such as hashed passwords and session records.
• Special categories: none are intended. Any that the Customer chooses to enter, for example in a time-off note, are protected by the measures in Annex II, including access limited by role.
• Frequency: continuous, for as long as the Customer uses the Services.
• Nature of the processing: hosting, storage, organizing, displaying, sending notifications and emails, generating drafts with AI (such as schedules and training documents) when a user asks for it, translating messages on request, backup and deletion.
• Purpose: to provide, support and secure the Services for the Customer.
• Duration and retention: for the term of the Agreement, then until deletion under section 10.
• Transfers to Sub-processors: the subject matter, nature and duration described above, limited to the service each Sub-processor provides (Annex III).

C. Competent supervisory authority

The supervisory authority determined under Clause 13 of the SCCs: the authority where the Customer is established in the EEA or, if it is not established in the EEA, where its representative is established or where the affected data subjects are. For the UK, the Information Commissioner's Office. For Switzerland, the Federal Data Protection and Information Commissioner.

Annex II: Technical and organizational security measures

• Encryption: all traffic to and from the Services uses TLS. Databases, files and backups are encrypted at rest (AES-256) by our hosting providers.
• Separating customers: every database query is limited by row-level security rules, so each Customer's data can only be read by that Customer's own users.
• Access by role: owners, managers and employees see different data. Pay rates and labor costs are never shown to employees. Team chats are private to their members, and managers cannot read chats they are not part of.
• Accounts: passwords are stored only as salted hashes. Links in emails (invites, password resets, downloads) use single-purpose tokens that expire.
• ExtraGM staff access: limited to the few people who need it, through accounts protected by multi-factor authentication, and used only to support, maintain or secure the Services.
• Data minimization: we do not collect staff phone numbers. Precise location is read only if the Customer turns on the time clock's location check, and only at the moment someone clocks in or out; it is compared with the restaurant's address and not stored, and only the result is kept. Error reports exclude user details, IP addresses, cookies and the secret tokens in links.
• AI features: only the information needed for the task the user asked for is sent to the AI provider, which does not use it to train its models.
• Resilience: daily encrypted backups, and hosting providers with redundant infrastructure.
• Development: changes are reviewed and automatically tested before release; dependencies are kept up to date; secrets are kept out of the code.
• Monitoring and incidents: errors are monitored, and we follow an incident response process that includes the notice in section 8.
• Suppliers: we choose Sub-processors for their security, and each one is bound by a data processing agreement, except Apple, whose terms are described in section 6.

Annex III: Sub-processors

ExtraGM uses these Sub-processors to provide the Services. This list was last updated on the date at the top of this page.

Sub-processor	What it does for ExtraGM	Customer Personal Data involved	Location
Supabase Pte. Ltd.	Database, sign-in, file storage and live updates	All Customer Personal Data	United States (AWS, us-east-1)
Vercel Inc.	Hosting of the website and apps	All Customer Personal Data, in transit	United States and the region closest to the user
Anthropic, PBC	AI features, such as schedule drafts, training documents and message translation	Only what is needed for the task the user asked for, such as names, roles and availability	United States
Resend (Plus Five Five, Inc.)	Sending emails, such as invites and password resets	Names, email addresses and email content	United States
Google LLC (Firebase Cloud Messaging)	Push notifications to the Android and iPhone apps	Device push tokens and notification content	United States
Apple Inc. (Apple Push Notification service)	Push notifications to iPhones	Device push tokens and notification content	United States
Functional Software, Inc. (Sentry)	Error monitoring	Technical error details, without user details	United States
Upstash, Inc.	Shared rate-limit counters that protect sign-in and other features from abuse	Short-lived counters stored under hashed keys derived from IP addresses, email addresses or user IDs	United States

Google LLC provides address suggestions through Google Maps Platform when an owner types the restaurant's address. Google acts as a separate controller under its own data protection terms and receives only the address text typed, so it is not a Sub-processor.

Stripe processes payments for ExtraGM as a separate controller and is not a Sub-processor of Customer Personal Data.

Web browsers deliver push notifications through their makers' own push services (such as Google, Mozilla, Apple and Microsoft). ExtraGM does not choose these services and has no contract with them. They receive only a push subscription address and encrypted content they cannot read, so they are not Sub-processors.