Data Processing Addendum

Version 1.0. Effective November 1, 2026

This addendum explains how Pulse handles your diners' personal information for you, and what each of us is responsible for. It is part of our Terms of Service and replaces section 7 of those terms. It is written to meet the requirements of PIPEDA, Quebec's Act respecting the protection of personal information in the private sector, and, where they apply, the EU and UK GDPR.

1. Who this applies to and when

This addendum is between Pulse POS Inc., 1810 Dundas St E, Mississauga, Ontario L4X 1L8 ("Pulse", "we") and the business that uses Pulse, including Pulse Cards ("you", "the restaurant").

1. New restaurants agree to it when they create a Pulse account on or after November 1, 2026.
2. Restaurants already using Pulse agree to it when they accept it in Pulse Dashboard, or 30 days after we tell you about it, if you keep using Pulse, as section 18 of the Terms of Service describes. If you don't agree, you can cancel before then.
3. It lasts as long as Pulse handles diner data for you, including after your account closes, until that data is deleted under section 11.

2. Words we use

• Diner data: personal information about the people who order from you, book a table, join your rewards, sign up for your offers or otherwise deal with you through Pulse. Annex 1 lists what it includes.
• Your staff data: personal information about your owners, managers and staff that Pulse handles for you, such as time-clock records.
• Data protection laws: the privacy laws that apply to the diner data, including PIPEDA, Quebec's private-sector privacy Act, and the EU and UK GDPR where they apply.
• Sub-processor: another company Pulse uses that handles diner data to provide the service. Annex 3 lists them.
• Security breach: a breach of Pulse's security that leads to diner data being lost, destroyed, changed, disclosed or accessed without permission. This includes a "breach of security safeguards" under PIPEDA and a "confidentiality incident" under Quebec law.
• Instructions: what you tell Pulse to do with diner data, through this addendum, the Terms of Service, the settings you choose in Pulse and anything else you ask of us in writing.

3. Roles and your instructions

You decide why diner data is collected and how it is used. Pulse handles it for you, only to provide the service.

1. You are responsible for diner data under the data protection laws. Pulse is your service provider.
2. Pulse acts only on your instructions. They are this addendum, the Terms of Service, the settings you choose in Pulse Dashboard (for example which offers, rewards, journeys and ad tools are on) and what you ask of us in writing. Apart from item 6, Pulse doesn't use diner data for its own purposes and never sells it.
3. If a law requires Pulse to do something else with diner data, such as a court order, we tell you first, unless the law forbids it.
4. If we think an instruction breaks a data protection law, we tell you, and we may hold off on that part until it is settled.
5. You confirm you have the right to give Pulse the diner data and to use each feature you switch on, including any consent the law requires for offers and ad tools, as section 6 of the Terms of Service says.
6. Data Pulse is responsible for itself. Pulse decides about, and answers for, the data it needs to run its own business and meet its own legal duties, as our Privacy Policy describes:
   • your owner and staff sign-in accounts, billing, payouts and support requests;
   • security, fraud prevention and service logs;
   • the shared list of phone numbers that replied STOP, kept across all restaurants so nobody who opted out is texted again.

4. Confidentiality

Only the Pulse staff and contractors who need diner data to run, support or secure the service can reach it, and each of them is required to keep it confidential.

• Pulse's team opens a restaurant's account or its customer records only to help that restaurant, to fix a problem or to keep the service secure.
• Every view and export of message records by Pulse's team is logged.
• Pulse reviews who on its team has access at least once a year.

5. Security

Pulse protects diner data with the measures in Annex 2, suited to the risk to diners.

• We keep these measures up to date and may change them, as long as a change doesn't lower the overall level of protection.
• We check our security regularly, with security reviews and automated tests that one restaurant's data never reaches another.
• You are responsible for the security of your own side: your staff's passwords and PINs, who you give access to, and the devices you use with Pulse.

6. Sub-processors

You agree that Pulse may use the sub-processors in Annex 3, which is also published at pulse-pos.com/legal/subprocessors.

1. Same protection. Each sub-processor is bound by data protection terms with Pulse. Pulse stays responsible to you for what they do with diner data.
2. Notice of changes. We update the list and tell you by email or in Pulse Dashboard at least 30 days before a new sub-processor starts handling diner data. If a provider fails and must be replaced at once, we tell you as soon as we can.
3. Your right to object. You can object by email within that notice period, with your reasons. We will try to address your concern, for example by not using the new sub-processor for your data.
4. If it can't be resolved, you can close your account before the change takes effect and get back any fees you paid in advance for the time left.
5. Services you connect yourself. When you switch on a service that has its own terms with you, such as your own POS provider or an advertising tool, you decide to share diner data with it. Annex 3 lists these separately; they aren't Pulse's sub-processors.

7. Helping with diners' requests

Pulse helps you answer diners who ask to see, correct, delete or move their data, or to stop offers, in time for the legal deadline (30 days in Canada).

1. Built-in tools. Diners can delete their own account from your ordering site or app. That also removes them from your rewards cards and deletes their saved payment details, and keeps your sales records without their name. Every offer email and text has an unsubscribe link or a STOP reply.
2. On request. When the tools don't cover a request, email info@pulse-pos.com. We export, correct or delete that diner's data within 10 business days.
3. Requests sent to Pulse. If a diner asks Pulse directly about data you're responsible for, we pass the request to you within 5 business days and don't answer for you unless you ask.

8. Security breaches

Pulse tells you without undue delay, and within 48 hours of becoming aware, of a security breach that affects your diner data, so you can meet your own duties.

1. What we tell you, as far as it is known then: what happened and when, the kinds of data and roughly how many diners are affected, the likely consequences, what Pulse has done and will do, and who to contact at Pulse. We send more details as we learn them.
2. What we do. We act at once to contain the breach and limit the harm, and help you assess whether it creates a real risk of significant harm to diners (PIPEDA) or a risk of serious injury (Quebec).
3. Who notifies. You decide whether to notify regulators and diners, and we help with the facts and the wording. Pulse notifies on your behalf only if you ask, or if a law requires Pulse to.
4. Records. Pulse keeps a record of every security breach affecting diner data for at least 24 months, and gives you the parts that concern you.
5. Not an admission. Telling you about a breach doesn't mean Pulse accepts fault or liability.

9. Assessments and regulators

Pulse gives you the information about its service that you need for a privacy impact assessment, for example the one Quebec law requires before personal information is sent outside Quebec: how each feature uses diner data, where it is stored, which sub-processors receive it and how it is protected. If a privacy regulator asks you or Pulse about the diner data, Pulse cooperates and tells you about any request it receives, unless the law forbids it.

10. Where diner data is stored

Diner data is stored on Pulse's servers in the United States (Boston, Massachusetts) and is handled by the sub-processors in Annex 3 where they operate. You agree to these transfers.

• Pulse protects data stored outside Canada through its contracts with its providers. Courts, law enforcement and national security authorities in those countries may still be able to reach it.
• For any data protected by the EU or UK GDPR, Pulse relies on a recognised transfer basis, such as a provider's certification under the EU-US Data Privacy Framework or the standard contractual clauses.
• We tell you before we move where diner data is stored to another country.

11. When your account closes

1. Your copy. For 90 days after your account closes, you can ask us for an export of your menu, customer list, orders, bookings and rewards in a common format (CSV or JSON).
2. Deletion. After those 90 days, Pulse deletes your restaurant's database, its files and the diner data held for you in Pulse's shared systems, such as message records and kitchen tickets. Backups that still hold it expire within 14 days after that.
3. Financial records. Before deleting, Pulse keeps an archive of your financial records (orders, payments, refunds, taxes, fees and payouts) with diners' names, contact details, addresses, notes and photos removed, so past payments can still be traced for tax, accounting and payment questions. The archive is encrypted, isn't copied into the nightly backups, and is deleted 7 years after your account closed.
4. What else Pulse keeps. Only what a law requires Pulse itself to keep, such as our own billing and payout records, and the STOP list in section 3. That data stays protected by this addendum for as long as it is kept.
5. Confirmation. On request, we confirm the deletion in writing.

12. Information and audits

1. On request, once a year: a copy of this addendum, the current Annex 2 and Annex 3, and answers to a reasonable security questionnaire.
2. Audits. If that information isn't enough, or a regulator requires it, you (or an independent auditor bound by confidentiality) may audit Pulse's handling of your diner data, with 30 days' written notice, during business hours, once a year unless after a security breach or at a regulator's request, and at your own cost.
3. An audit never gives access to other restaurants' data or to Pulse's security secrets.

13. Liability, changes and law

• Liability. The limits on liability in section 16 of the Terms of Service apply to this addendum, except where a data protection law doesn't allow them.
• Order of precedence. If this addendum and the Terms of Service disagree about diner data, this addendum wins.
• Changes. We may update this addendum as section 18 of the Terms of Service describes. A change a law requires can take effect sooner. Each version has a number and a date, and Pulse keeps a record of which version you accepted and when.
• Governing law. The laws of Ontario and the federal laws of Canada that apply there, as in section 19 of the Terms of Service, except where a data protection law requires otherwise.
• Contact. Privacy questions and notices under this addendum: info@pulse-pos.com, Pulse POS Inc., 1810 Dundas St E, Mississauga, Ontario L4X 1L8.

Annex 1: Details of the processing

Pulse stores, organises, displays, sends and deletes diner data to run your ordering site, apps, POS, bookings, rewards and messages, for as long as your account is open and then as section 11 describes.

• Whose data: your diners (including guests who book a table and kiosk guests), people who join your rewards cards, and your staff.
• Sensitive data: Pulse doesn't ask for it, but diners may type allergies or dietary needs in order and booking notes, which can be health information.

Annex 2: Security measures

Annex 3: Sub-processors

Pulse uses these companies to provide its service. We tell restaurants at least 30 days before a new company starts handling diner data. Last updated November 1, 2026.

Services you connect yourself (your own arrangement with them, not Pulse's sub-processors):