Draft. This document is being reviewed and is not yet in force.
Spotless Data Processing Agreement
Version: 0.1 (draft) · Effective: with the Customer's Terms of Service
1. Roles
The Customer is the Data Fiduciary for the personal data it puts into Spotless about its staff and guests. LemonByte is its Data Processor, and processes that data only to provide Spotless under the Terms and this Agreement, and on the Customer's documented instructions (the Terms, the Order, the Customer's settings in Spotless, and written requests).
If LemonByte believes an instruction breaks the law, it will say so and need not follow it.
2. What is processed
Annex 1 lists the people concerned, the kinds of data, the purposes and how long data is kept.
3. LemonByte's obligations
LemonByte will:
- process personal data only as set out in section 1;
- ensure everyone who can reach it is bound by confidentiality, and limit access to the staff who need it to run and support Spotless;
- keep the security measures in Annex 2, and not reduce them materially;
- use only the sub-processors in Annex 3, under written terms at least as protective as this Agreement, and stay responsible for them;
- help the Customer answer requests from people exercising their rights (access, correction, erasure, nomination, grievance), mainly through Spotless itself (correcting or removing a person, exporting their record), and pass on any request it receives directly within [[5 working days]];
- tell the Customer of a personal data breach affecting Customer data without undue delay and in any case within [[24 hours]] of becoming aware, with what is known (what happened, the data and people affected, likely consequences, what is being done) and updates as more is learned, so the Customer can inform the Data Protection Board and affected people as the DPDP Rules require; [[Advisor: align with the Rules' timelines.]]
- help the Customer with any assessment or audit the law requires of it, as far as it concerns Spotless;
- at the end of the agreement, let the Customer export its data for [[30]] days, then delete it within [[60]] days, except what the law requires LemonByte to keep, with backup copies expiring within 30 days; and confirm deletion in writing on request.
4. Sub-processors
Annex 3 lists the current sub-processors. LemonByte will give the Customer at least [[30]] days' notice of a new or replacement sub-processor (by email and on [[spotlessplatform.com/subprocessors]]). The Customer may object on reasonable data protection grounds; the parties will discuss it in good faith, and if it cannot be resolved the Customer may end the affected part of the Service and receive a refund of fees paid for the time after it ends.
5. Transfers outside India
LemonByte and its sub-processors may process data outside India, except to any country the Government of India restricts under section 16 of the DPDP Act. Annex 3 says where each sub-processor works.
6. Spotless support access
LemonByte staff see a Customer's account only to provide support when one of the Customer's owners allows it, read-only and for a limited time, and every such access is shown to the Customer's owners in Spotless. LemonByte operators also see technical diagnostics and problem reports as described in the Privacy Policy.
7. Audits
On reasonable notice, no more than once a year (or after a breach), LemonByte will answer the Customer's written questions about its compliance with this Agreement and provide reasonable evidence. [[Advisor: decide whether to allow on-site or third-party audits, and at whose cost.]]
8. The Customer's obligations
The Customer will have a lawful basis and give the notices the law requires for the personal data it puts into Spotless (LemonByte provides a staff notice template), use the Service in line with the acceptable use rules (including not photographing people), and keep its own Users' access up to date.
9. Liability and term
Liability under this Agreement is governed by the Terms of Service. This Agreement lasts as long as LemonByte processes Customer personal data.
Annex 1: Processing details
| People concerned | The Customer's staff, supervisors, managers, owners and auditors who use Spotless; guests who report a problem or order through a Spotless code |
| Staff data | Name, role, property, staff code, mobile number, work email (website users), PIN and password hashes; optional birthday (day and month), start date, languages and emergency contact if the Customer records them; checks, answers, notes, issues and requests they create; photos of surfaces, equipment and stock; approximate location when a check is submitted; location or scanned code at attendance check-in (Attendance add-on); push token, device model, operating system and app version; messaging channel and chat or phone identifier if they turn messages on |
| Guest data | Problem category, what they write, an optional photo, optional contact details; Dining orders and the room or table |
| Special categories | None intended. Spotless is designed never to photograph people and collects no biometric data |
| Purposes | Showing each person their work; recording and proving checks; raising and tracking issues; notifications and messages; reports and exports; security, support and fixing problems |
| Retention | As set out in the Privacy Policy, section 11; deletion at the end of the agreement under section 3(8) |
Annex 2: Security measures
- Encryption in transit (HTTPS/TLS) for every connection, and at rest for the database, photo storage and backups.
- Each Customer's data kept apart by row-level security in the database; the application connects with a role that cannot bypass it.
- Photos in private storage, never publicly addressable, opened only through links that expire within minutes.
- Passwords and PINs stored only as one-way hashes (Argon2id or the sign-in provider's equivalent); optional second sign-in step; enforced for LemonByte's own operator accounts [[confirm]].
- Database reachable only from the application server; firewall allowing only web traffic and SSH; deploy keys pinned to the server.
- Saved checks never edited; an audit trail of changes and of LemonByte support access, visible to the Customer's owners.
- Nightly database backups kept with a different provider from the database, and a backup before every update.
- Diagnostics that never record request contents, names, phone numbers, PINs, passwords or photos.
- People who leave are signed out at once and their identity erased after a grace period, keeping only an anonymous link to the work they did.
Annex 3: Sub-processors
See subprocessors.md (to be published at [[spotlessplatform.com/subprocessors]]).