Privacy Policy

This "Privacy Policy" explains how MapleKiosk Inc. ("Company" or "we") collects, uses, discloses, and otherwise processes personal data on behalf of our customers – typically, merchants (any, a "Merchant") – in connection with our application, MapleKiosk, which runs on the Clover Point of Sale system ("Clover POS"). This Privacy Policy does not apply to Company's privacy practices in any other context.

Company's processing of personal data in connection with our application is governed by this Privacy Policy and our agreements with Merchants. In the event of any conflict between this Privacy Policy and a customer agreement, the customer agreement will control to the extent permitted by applicable law.

This Privacy Policy is not a substitute for any privacy policy that a Merchant may be required to provide to their customers, personnel, or other individuals.

Information we collect

Our application collects a limited set of information. The information we collect is primarily about the Merchant's own business and account, together with order and item data that does not identify individual consumers, and — only where a Merchant uses our booking features — limited contact details that a customer chooses to provide to make a booking or reservation. The specific information we receive may vary by Merchant.

Merchant business and account information

When a Merchant installs and uses our application, we collect information about the Merchant's business and account, which may include the business name, the owner's or a contact's name, email address, phone number, business or store address, and the Clover merchant identifier associated with the installation.

Order and item information

We collect information about orders and items processed through the Merchant's Clover POS, such as products, menu items, order totals, transaction amounts, and the date and time of a transaction. This information relates to the Merchant's operations and does not, by itself, identify the Merchant's customers. We do not receive or store payment card numbers, cardholder names, or other cardholder or payment-card data. Payment card information is handled by Clover and its payment processors, not by us.

Booking and reservation details a customer provides

Where a Merchant uses our booking or reservation features, we collect the contact details that a customer chooses to provide in order to request or confirm a booking — typically a name and an email address and/or phone number. We use these details only to facilitate the booking or reservation for the Merchant. We do not collect other consumer personal data through the application.

Information we do not collect

We do not collect information about a Merchant's personnel or employees (for example, we do not collect clock-in and clock-out times, tips earned, shifts, or wage information). We do not collect payment card or cardholder data, and we do not build consumer profiles or use consumer data for our own marketing.

How we use the information we collect

We use the information we collect to provide our services and the functionality of our application to Merchants: to set up and administer the Merchant's account, to manage the Merchant's product or menu catalog and orders, to facilitate appointments and reservations (including any booking or reservation contact details a customer provides), and to provide AI-assisted reception and booking services on the Merchant's behalf.

We may also use personal data for related internal purposes, including:

• To provide information about the application, such as important updates or changes to the application and security alerts
• To measure performance of and improve the application
• To respond to inquiries, complaints, and requests for customer support

In addition, Company may use personal data as we believe necessary or appropriate to (a) comply with applicable laws and lawful requests and legal processes, such as to respond to subpoenas or requests from government authorities; (b) enforce the terms and conditions that govern our application; (c) protect our rights, privacy, safety or property, and/or that of you or others; and (d) protect, investigate and deter against fraudulent, harmful, unauthorized, unethical or illegal activity.

How we share information

We do not sell your personal data, and we do not share or disclose it to third parties for our own or any third party's commercial purposes. We do not provide personal data to third-party advertisers, data brokers, or marketers. The only circumstances in which information is made available to others are:

• With the Merchant. We make available to the Merchant the information we hold for or about that Merchant, including any booking or reservation details a customer provided for that Merchant.
• The Clover platform. Because our application runs on the Clover POS, information processed through the application may reside on or pass through the Clover platform, which is operated by Clover subject to Clover's Privacy Notice, available at clover.com/privacy-policy.
• When required by law. We may disclose information to government or law enforcement officials or others where we believe it is necessary or appropriate to comply with applicable laws, lawful requests, and legal process, or to protect the rights, privacy, safety, or property of MapleKiosk, our Merchants, or others.

If Company is ever involved in a merger, acquisition, reorganization, sale of assets, or bankruptcy, information may be transferred as part of that transaction; in that event we will make reasonable efforts to require the recipient to honor this Privacy Policy.

Your rights and choices

Data subject rights

To the extent that applicable law provides individuals with rights pertaining to their personal information, such as to review and request changes to their personal information, individuals should contact the Merchant with any requests pertaining to the Merchant's use of our application. To the extent that Clover is responsible for responding to data subject rights requests under applicable law, individuals may contact Clover with applicable requests as explained in Clover's Privacy Notice, https://www.clover.com/privacy-policy. Company will assist a Merchant, or Clover, as applicable, in responding to such requests subject to our contract with a Merchant or Clover.

Complaints

If you have a complaint about our handling of personal data, you may contact us via the contact information provided below.

Updates

We reserve the right to modify this Privacy Policy at any time. We will notify you of updates by updating the date of this Privacy Policy.

Contact us

You may contact us with any questions, comments, or complaints, about this Privacy Policy or our privacy practices via: MapleKiosk Inc., dev [at] maplekiosk.ca. [Mailing address and phone number to be added before submission.]

Additional Information for Merchants Located in Europe

Controller and processor roles

For any personal data we process on a Merchant's behalf through the application — such as the booking or reservation contact details a customer provides — Company acts as a data processor and the Merchant is the controller. For the Merchant's own business-account and contact information that we use to provide and administer our services to the Merchant, Company acts as a controller. Clover is also a controller of personal data in some circumstances. Clover's Privacy Notice is available at https://www.clover.com/privacy-policy.

Legal basis for processing

Company processes personal data as directed or permitted by the Merchant that uses our application. The Merchant is responsible for establishing a legal basis for our processing of personal data for or on behalf of the Merchant.

Cross border data transfer

When we transfer personal data outside of Europe (or the UK) to countries not deemed by the European Commission to provide an adequate level of protection for personal data, we make the transfer pursuant to one of the following transfer mechanisms:

• A contract approved by the European Commission (sometimes called "Model Clauses" or "Standard Contractual Clauses");
• The recipient's Binding Corporate Rules;
• The consent of the individual to whom the personal data relates; or
• Other mechanisms or legal grounds as may be permitted under applicable European law.

You may contact us with questions about our transfer mechanism.

Data retention

Subject to our agreement with a Merchant, Company retains personal data for as long as necessary to (a) provide our products and services; (b) comply with legal obligations; (c) resolve disputes; and (d) enforce the terms of any agreement we may have with a Merchant. You may contact us for additional information about our data retention practices in connection with the application.

Data subject rights

Under certain circumstances, data subjects in Europe and the UK have certain rights relating to their personal data, which include the rights to request from the Controller (a) access to the data subject's personal data; (b) correction of incomplete or inaccurate personal data; (c) erasure of personal data; (d) restriction of processing concerning the data subject; and (e) that the controller provide a copy of the data subject's personal data that the data subject provided to the controller in a structured, commonly used and machine-readable format. Data subjects may also object to a controller's processing of personal data under certain circumstances. Where processing is based on a data subject's consent, the data subject has the right to withdraw consent at any time; however, the withdrawal of consent will not affect the lawfulness of processing based on consent before its withdrawal. Data subjects may also file a complaint with a supervisory authority. You may view contact information for supervisory authorities at edpb.europa.eu/about-edpb/board/members_en. Data subjects in Europe or the UK should direct any rights request to the appropriate Controller.

Your California privacy rights

As a California resident, you have the rights listed below. However, these rights are not absolute, and we may decline your request as permitted by the CCPA.

• Information. You can request the following information about how we have collected and used your Personal Information during the past 12 months: the categories of Personal Information that we have collected; the categories of sources from which we collected Personal Information; the business or commercial purpose for collecting and/or selling Personal Information; the categories of third parties with whom we share Personal Information; whether we have disclosed your Personal Information for a business purpose, and if so, the categories of Personal Information received by each category of recipient; and whether we've sold your Personal Information; and, if so, the categories of Personal Information received by each category of recipient.
• Access. You can request a copy of the Personal Information that we maintain about you.
• Deletion. You can ask us to delete the Personal Information that we maintain about you.
• Nondiscrimination. You are entitled to exercise the rights described above free from discrimination. This means that we will not penalize you for exercising your rights by taking actions such as by denying you goods or services, increasing the price/rate of goods or services, decreasing the service quality, or suggesting that we may penalize you as described above for exercising your rights. However, the CCPA allows us to charge you a different price or provide a different service quality if that difference is reasonably related to the value of the Personal Information we are unable to use.

How to exercise your rights

You can request to exercise your information, access and deletion rights in the following ways:

• Email us at dev [at] maplekiosk.ca, or call our toll-free number [toll-free number to be added before submission].
• Identity verification. The CCPA requires us to verify the identity of the individual submitting the request before providing a substantive response to the request. A request must be provided with sufficient detail to allow us to understand, evaluate and respond. The requester must provide sufficient information to allow us to reasonably verify that the individual is the person about whom we collected information. A request may also be made on behalf of your child under 13.
• Authorized agents. California residents can empower an "authorized agent" to submit requests on their behalf. We may require the authorized agent to have a written authorization confirming that authority.

Sale of personal information

We do not sell or share (as those terms are defined under the CCPA, including "sharing" for cross-context behavioral advertising) your Personal Information to or with third parties. In the preceding twelve (12) months, we have not sold or shared any personal information.

Personal information that we collect, use and share

The chart below summarizes our collection, use and sharing of Personal Information during the last 12 months before the effective date of this Privacy Policy. We describe the sources through which we collect your Personal Information in the section above titled Information we collect, and describe the purposes for which we collect, use and share this information in the sections above titled How we use the information we collect and How we share information.

Glossary

• Biometric Information. An individual's physiological, biological or behavioral characteristics, including DNA, that can be used to establish an individual's identity, such as imagery of the iris, retina, fingerprint, face, hand, palm, vein patterns, and voice recordings, as well as keystroke, gait, sleep, health, or exercise data that contain identifying information.
• Commercial Information / Transaction History. Products or services purchased, obtained, or considered, or other purchasing or consuming histories or tendencies.
• Financial Information. Bank account number, debit or credit card numbers, insurance policy number, and other financial information.
• Geolocation Data. Precise location, e.g., derived from GPS coordinates or telemetry data.
• Identifiers. Real name, alias, postal address, unique personal identifier, customer number, email address, account name and other similar identifiers.
• Internet or Network Information. Browsing history, search history, and information regarding a consumer's interaction with an Internet website, application, or advertisement.
• Online Identifiers. An online identifier or other persistent identifier that can be used to recognize a person, family or device over time and across different services, including device identifiers, IP addresses, cookies, beacons, pixel tags, mobile ad identifiers, or similar technology.
• Professional or Employment Information. Information relating to a person's current, past or prospective employment or professional experience, and educational background.
• Protected Classification Characteristics. Age (40 years or older), race, color, ancestry, national origin, citizenship, religion or creed, marital status, medical condition, physical or mental disability, sex (including gender, gender identity, gender expression, pregnancy or childbirth and related medical conditions), sexual orientation, veteran or military status, and genetic information.
• Sensory Information. Audio, electronic, visual, thermal, olfactory, or similar information.
• Medical Information. Personal information about an individual's health or healthcare, including health insurance information.