Data Processing Agreement

Last updated: June 2026

This Data Processing Agreement ("DPA") forms part of the agreement between HeyCarta ("Processor") and the restaurant or organization using the Service ("Controller"). It applies when HeyCarta processes personal data on the Controller's behalf under PIPEDA, Quebec Law 25, and comparable laws.

1. Roles

The Controller determines why and how guest and staff personal data is processed. HeyCarta processes that data only on documented instructions from the Controller, as configured in the admin dashboard and these Terms.

2. Subject matter and duration

Processing covers menu publication, guest analytics, optional AI chat, multilingual translation, and related support for the duration of the subscription plus any retention period described in our Privacy Policy.

3. Categories of data and data subjects

  • Restaurant staff and account holders (operators)
  • Guests browsing published menus or using the AI assistant
  • Contact form submitters interacting with HeyCarta directly

4. Processor obligations

  • Process personal data only on Controller instructions, unless required by law
  • Ensure personnel with access are bound by confidentiality
  • Implement appropriate technical and organizational security measures
  • Assist the Controller with access, correction, and deletion requests where feasible
  • Notify the Controller without undue delay after becoming aware of a personal data breach
  • Delete or return personal data upon termination, subject to legal retention requirements

5. Subprocessors

The Controller authorizes HeyCarta to engage trusted subprocessors as needed to deliver the Service. HeyCarta remains responsible for subprocessors' performance of data protection obligations.

6. International transfers

The Controller acknowledges that subprocessors may process data outside Canada. HeyCarta uses contractual and organizational measures designed to protect transferred data.

7. Audits

Upon reasonable written request, HeyCarta will provide information necessary to demonstrate compliance with this DPA, subject to confidentiality and security constraints.

8. Contact

Data protection inquiries: contact form.