How RTR processes customer personal information.

2. Definitions

• Customer personal information means personal information that RTR processes on the customer's behalf through the service, including information received from the customer's connected systems.
• Connected systems means third-party systems the customer authorizes RTR to read from, currently Clover, Auphan and 7shifts.
• Sub-processor means a third party RTR engages to process customer personal information on RTR's behalf.
• Incident means unauthorized access to, use, disclosure or loss of customer personal information, including a "breach of security safeguards" under PIPEDA.
• Applicable privacy law means PIPEDA and any other privacy law that applies to the processing.

3. Subject matter and duration

The subject matter of processing is the provision of RTR's restaurant operations software, principally nightly cashout and tip calculation, reconciliation of POS, card and labour records, access management, and related reporting, as described in the Terms of Service and the customer's order.

Processing lasts for the term of the customer's service arrangement, and then only for the return and deletion period in section 15. For information received through the RTR app on Clover, the processing of a merchant's Clover data ends when the app is uninstalled from that merchant, apart from the export and deletion steps in section 15.

4. Nature and purpose of processing

RTR processes customer personal information to provide the agreed service, carry out authorized instructions, support users, investigate service problems, and maintain security and reliability. This includes reading records from connected systems, storing them, calculating cashouts, tip shares and reconciliation views, showing them to the customer's authorized users, and, where the customer turns them on, running AI features over its records.

RTR will not use customer personal information for its own independent purposes, sell it, share it for cross-context behavioural advertising, or combine it with another customer's information.

5. Personal information and people concerned

The information processed depends on the features and connected systems the customer uses. Annex A lists it by source. It covers:

• Account and contact information for the customer's users (name, email address, verification status, account identifiers).
• Access and activity records (memberships, roles, the restaurants a person may see, access changes and who made them, timestamps).
• Workforce records (employee names and identifiers, roles, time punches and hours, cashouts, tip shares and adjustments).
• Payment and sales records (amounts, tips, tenders, card brand and last four digits, cheque and payment identifiers, the employee linked to a payment).
• Support correspondence and technical information (IP address, device and browser details, error reports).

The people concerned are the customer's employees and contractors (including staff who may be minors), the customer's users and contacts, and, to the limited extent card records identify them, the customer's guests.

6. Customer instructions and responsibilities

RTR will process customer personal information only on the customer's documented instructions. These include the Terms of Service, this addendum, the customer's order and configuration, and actions by the customer's authorized users in the service. If RTR believes an instruction would breach applicable privacy law, it will tell the customer before acting on it.

The customer is responsible for having the authority, notices and consents needed to connect its systems and provide customer personal information to RTR. That includes any notice or policy it owes its employees about the information RTR reads, such as time punches and the payments linked to each employee.

7. RTR personnel

RTR limits access to customer personal information to personnel who need it to provide, support or secure the service. They are bound by confidentiality obligations. RTR personnel access a customer's records only when a support case, incident or security task needs it, and only as far as that task needs.

8. Sub-processors

The customer authorizes RTR to use the sub-processors listed in the sub-processor list, which shows each provider's role and where it processes information. RTR will put a written agreement in place with each sub-processor that protects customer personal information at least as well as this addendum, limits its use to the services it provides to RTR, and requires it to return or delete the information when those services end.

RTR will give notice of a new or replacement sub-processor at least 30 days before it starts processing customer personal information, by updating the list and emailing the customer's account owner. A customer may object on reasonable privacy grounds within that period. The parties will discuss the concern in good faith; if it cannot be resolved, the customer may end the affected part of the service without an early-termination fee.

If a sub-processor must be replaced sooner to keep the service running or secure, RTR may make the change first and will email the customer's account owner within 5 business days. The customer's right to object then applies from that email.

RTR remains responsible for its sub-processors' performance of these obligations.

9. Where information is processed

RTR's primary database is in Montreal, Canada. Some sub-processors process customer personal information outside Canada, including in the United States; the sub-processor list states where. Information processed in another country is subject to that country's laws and may be accessible to its courts, law enforcement and national security authorities.

RTR protects information processed outside Canada by contract and by the measures in Annex B. On request, RTR will give the customer the information it needs to assess a transfer.

10. Security measures

RTR maintains the security measures in Annex B. It may change them only if the overall level of protection does not decrease.

11. Incidents

RTR will notify the customer without undue delay, and in any event within 72 hours, after confirming an incident affecting that customer's personal information.

The notice will include the following, and RTR will update it as it learns more:

• what happened, its cause, and the date or period of the incident;
• the personal information involved and the approximate number of people affected;
• the steps RTR has taken or will take to reduce the risk of harm, and steps affected people could take;
• a contact person at RTR.

The customer decides whether the incident creates a real risk of significant harm and makes any report to the Office of the Privacy Commissioner of Canada or to affected people. RTR will help with that assessment. It will not notify the customer's employees or regulators about the customer's information without the customer's agreement, unless the law requires it.

Where an incident involves information received from Clover, RTR will also notify Clover, as Clover's developer terms require.

RTR keeps a record of every incident affecting customer personal information for at least 5 years.

12. Individuals' requests

If RTR receives a request from a person to access, correct or delete personal information that the customer controls, it will forward it to the customer within 5 business days and will not respond to it directly unless the customer asks it to or the law requires it. RTR will help the customer respond within 30 days, including by exporting that person's records.

13. Privacy impact assessments

On request, RTR will give the customer the information about the service it needs for its own privacy impact assessments: the categories of information processed, sub-processors and their locations, and the security measures in Annex B.

14. Audit and verification

On reasonable written request, no more than once a year unless an incident or a regulator requires otherwise, RTR will make available the information reasonably needed to verify its compliance with this addendum. This may take the form of written answers, security documentation, or reports from sub-processors. Any review is subject to confidentiality and must not disrupt the service or expose other customers' information.

15. Return and deletion

End of the service. For 30 days after the customer's service ends, the customer may ask for an export of its records. RTR will then delete customer personal information from its production systems within a further 30 days. Copies in backups expire within 30 days after that and are not restored except to recover the service.

Uninstalling the RTR app on Clover. When a merchant uninstalls the app, RTR stops reading that merchant's Clover data and deletes its access. After an export period of 30 days, RTR permanently deletes the data it received from Clover for that merchant, and backup copies expire within a further 30 days. Cashout records the customer keeps in RTR under its written agreement with RTR are handled under that agreement. The data deletion page sets out the steps.

RTR may keep information only where a law requires it to. It will protect any such information under this addendum and use it only for the reason it was kept. RTR will confirm deletion in writing on request.

16. General

Liability under this addendum is subject to the limitations in the Terms of Service unless a written agreement says otherwise. Unless a separate written agreement says otherwise, this addendum is governed by the laws of Ontario and the federal laws of Canada applicable there, consistent with the Terms of Service.

To sign this addendum, or for questions about it, email support@rtrsystems.com.

Annex A. Processing details

Frequency: continuous for the term, with connected systems read at least nightly for the cashout. Duration: section 3. Sub-processors: section 8.

Annex B. Security measures

• Encryption in transit: the service is available only over HTTPS.
• Customer separation: every customer record carries its customer identifier, and the database refuses rows outside the signed-in person's customer and permitted restaurants. The application's database login cannot bypass that rule.
• Vendor credentials: Clover tokens and Auphan and 7shifts logins are stored encrypted in a key vault, separated per customer, and are never returned to a screen, log or API response.
• Identity: sign-in through a managed identity provider with short-lived session tokens; self sign-up is off, and people are added only by an authorized administrator.
• Least privilege: each person holds a role at a scope (organization, franchise group or restaurant); changes to access are logged with who made them, what changed and when.
• Change control: code changes are reviewed and tested, including automated tests that customers cannot read each other's data, before release; production releases require approval.
• Backups and recovery: the database is backed up with point-in-time recovery.
• Monitoring: error monitoring records errors only and is configured not to collect IP addresses, cookies or request contents.
• Card data: RTR does not receive or store full card numbers or security codes.