Data Processing Addendum

This Data Processing Addendum is designed to be attached to, and incorporated into, the Vinari Operator Terms of Service. Where this DPA and the Terms conflict on data protection, this DPA prevails.

1. Parties and purpose

This Data Processing Addendum (“DPA”) forms part of the Operator Terms of Service (“Terms”) between Lee Kok Yang, trading as Vinari (“Processor”, “Vinari”), and the Operator (“Controller”, “you”).

It governs Vinari’s processing of personal data of your Guests carried out on your behalf in providing the Service. Where this DPA and the Terms conflict on data protection, this DPA prevails.

In this DPA, “personal data”, “data subject”, “controller”, “processor”, and “processing” have the meanings given under the Malaysian Personal Data Protection Act 2010 (as amended) (“PDPA”) and, where applicable to your Guests, the GDPR.

2. Roles

You are the controller of your Guests’ personal data. Vinari is your processor. You are responsible for the lawful basis, notices, and consents required to collect and use your Guests’ data through the Service. You confirm that your instructions to Vinari, and your use of the Service, comply with applicable data protection law.

3. Vinari’s obligations as processor

Vinari will:

3.1 Process only on your instructions. Process Guest personal data only to provide the Service and as otherwise documented in the Terms and this DPA, unless required by law (in which case we will inform you where permitted).

3.2 Keep data venue-scoped. Make a Guest’s data available only to your venue. Vinari will not combine your Guests’ data with that of any other Operator, will not disclose it to any other venue, and — for any returning Guest who visits a different venue — will ensure the AI starts fresh with no carry-over of profile, history, or identity from your venue.

3.3 Not use data for our own purposes. Vinari will not sell Guest personal data and will not use it for its own commercial purposes. Vinari may process limited data as a controller only to operate, secure, and prevent abuse of the platform, and never to profile Guests across venues.

3.4 Confidentiality. Ensure that persons authorised to process the data are bound by confidentiality.

3.5 Security. Implement reasonable technical and organisational measures appropriate to the risk, including access controls and encryption in transit.

3.6 Assist with Guest requests. Provide reasonable assistance to help you respond to Guest requests to access, correct, delete, withdraw consent, or port their data.

3.7 Assist with breaches. Notify you without undue delay after becoming aware of a personal data breach affecting your Guests’ data, and provide reasonable assistance so you can meet your PDPA obligations — including notifying the Commissioner as soon as practicable (within 72 hours) and affected Guests where the breach is likely to cause significant harm.

3.8 Assist with assessments. Provide reasonable assistance with any data protection impact assessment or consultation with the regulator that you are required to carry out.

3.9 Deletion or return. On termination, delete or return your Guests’ personal data within a reasonable period (target: 30 days), except where retention is required by law.

3.10 Records and information. Make available information reasonably necessary to demonstrate compliance with this DPA, and allow for reasonable audits (which may be satisfied by Vinari providing relevant documentation), subject to reasonable confidentiality and notice.

4. Sub-processors

4.1 You authorise Vinari to engage the sub-processors listed in Annex B to process Guest data.

4.2 Vinari will impose data protection obligations on each sub-processor that are no less protective than those in this DPA, and remains responsible for their performance.

4.3 Vinari will give you reasonable notice of any intended change of sub-processor. If you reasonably object on data protection grounds, we will work with you in good faith to address the concern; if we cannot, you may terminate the affected Service.

5. International transfers

Where Vinari (or a sub-processor) processes Guest data outside Malaysia, it will do so only in line with the PDPA’s cross-border transfer requirements (transferring only where the destination offers substantially similar or adequate protection, or under another permitted condition) and, for data subject to the GDPR, under appropriate safeguards such as Standard Contractual Clauses.

6. Liability

The liability of each party under or in connection with this DPA is subject to the limitations and exclusions of liability set out in the Terms.

7. Governing law

This DPA is governed by the laws of Malaysia, consistent with the Terms.

Annex A — Details of processing

• Subject matter: provision of the Vinari AI wine-recommendation Service.
• Duration: for the term of the Operator’s subscription, plus the deletion period in clause 3.9.
• Nature and purpose: recognising returning Guests at the venue, generating wine recommendations via AI, relaying orders to the venue, and maintaining the venue’s record of Guest preferences and orders.
• Types of personal data: mobile phone number; name; gender; age group; wine/taste preferences; chat inputs; order selections and history at the venue.
• Categories of data subjects: Guests (diners) of the Operator’s venue.
• Special category data: none intended. Guests are asked not to submit sensitive data.

Annex B — Approved sub-processors

GoDaddy is the domain registrar only and does not process personal data, so it is not listed as a sub-processor. Re-issue this Annex when you migrate your AI model. Note: because these providers are US-based, cross-border transfer relies on Guest consent and the providers’ contractual safeguards (see clause 5).