Data Processing Addendum

Version 2026-10-28 · Last updated: October 28, 2026. Part of the Terms of Service; the business accepts it when it signs up. It does not replace the official international transfer clauses that must be signed when they apply.

1. Parties and purpose

The business identified in its account acts as the controller of its customers' data. Click2Bite, which provides Click2Bite, acts as processor for the operations it carries out on the business's behalf. Processor contact: [email protected]. The business's privacy contact is the one it sets in its dashboard (business email).

The service covers hosting and organizing information, taking orders, passing on instructions and statuses, delivery features, support, loyalty and the lawful communications the business chooses, plus returning or deleting data as needed. It does not cover what Click2Bite does for its own purposes as a controller (accounts, billing of its plan, platform security and support), described in its Privacy notice.

2. Data and people

Customers and recipients, business staff and drivers: identification and contact, orders, delivery address and coordinates, payment references, rewards, communication preferences, assignments and delivery location when enabled. Collecting health documents or other sensitive data is not authorized without a specific assessment. The processing lasts as long as the service, plus the agreed return or deletion.

3. Instructions and limits

Click2Bite processes the data only under the business's documented instructions, these terms and the law. Valid settings and requests in the dashboard are instructions. If an instruction seems unlawful, Click2Bite will say so and may pause that operation until it's clarified.

Click2Bite does not sell or share the data for cross-context behavioral advertising, does not use it for purposes outside the services, and does not combine identifiable data from different businesses for its own incompatible purposes. Where California's service-provider rules apply, retaining, using or disclosing the data outside the specified business purposes is also prohibited. Click2Bite will tell the business if it can no longer meet these obligations and lets it take reasonable steps to stop and remedy unauthorized processing.

4. The business's obligations

The business must have a legal basis to provide and use the data, inform people, handle their rights and give lawful instructions; limit data to what's needed; manage its team's permissions; and decide justified retention periods. It must obtain and document the permissions needed for promotions, sensitive data and tracking. Click2Bite's notice does not replace the business's own notice, and a buyer accepting the terms is not permission for all of the business's campaigns.

5. Confidentiality and security

Access is limited to authorized people bound by confidentiality, with security measures suited to the risk: access controls and two-step verification for administrators, credential protection, logical separation between businesses, encrypted connections and backups. No certification or service level is promised unless it has been contracted and verified.

6. Subprocessors and countries

• Server and database hosting (cloud infrastructure provider used by Click2Bite).
• Cloudflare (United States and its global network): delivery and protection of the site.
• Email: the email service of the click2bite.com domain (Neubox, Mexico) for receipts, notices and support.
• Google (United States): Maps to locate addresses and, only with the owner's permission, Business Profile.
• Browser push services (Google, Apple, Mozilla): encrypted delivery of notifications, only if enabled.

Payment processors (Stripe and Mercado Pago) process payments for their own financial purposes too; they are not listed as subprocessors for those activities. Before adding or replacing a subprocessor, Click2Bite will notify the business at least 15 calendar days in advance by email so it can object on data-protection grounds; if the objection can't be resolved, the parties will agree on an alternative or end the affected service without forcing unlawful processing. Click2Bite imposes compatible protection obligations on its subprocessors and remains responsible for its part.

7. Rights and incidents

Click2Bite will promptly forward requests it receives on the business's behalf and help find, export, correct, restrict or delete data within the applicable deadlines. If it learns of an incident affecting the data, it will notify the business without undue delay with the information available (nature, categories, consequences, measures and contact) and update it as the investigation progresses, so the business can meet its own obligations.

8. Verification

Click2Bite will give the business the information reasonably needed to check these obligations and to answer valid requests from authorities, protecting the security, confidentiality and data of other businesses.

9. End of service and retention

When the service ends, the data is returned or deleted following the business's lawful instructions and the features of its plan. Under the current policy, after 90 days without a valid plan the account's operating information is deleted, and before that the owner can download its menu, orders and customers. Mandatory retention is limited to the necessary records (for example, tax records of orders and charges) with restricted access. Backups follow a documented cycle; if one is restored, pending deletions are applied again. Keeping an account open does not authorize keeping customer data indefinitely.

10. International transfers and local rules

The parties identify international transfers and their legal mechanism before they start. For data from Argentina sent to countries without adequate protection (Mexico and the United States are not on the AAIP's list), the model contractual clauses approved by the AAIP (Resolution 198/2023) for the controller–processor relationship, or another valid mechanism, will be signed; this addendum is not a reproduction or replacement of them. Mandatory local rules prevail over anything incompatible here.

11. Acceptance and records

Accepting at sign-up records the business, the version and date of this addendum and the service. You can always see the current version on this page; earlier versions are available on request at [email protected].