Data Processing Explanation

Roles
The venue is the controller where it determines customer-processing purposes. MyBon hosts data and performs menu operations and technical support under the venue’s authority and instructions as a processor. MyBon can separately be a controller for its own offers, billing, business accounts and security. Roles follow the actual activity rather than labels alone.

Scope and access
Customer data may include member/contact fields, authentication records, preferences, favorites, permissions, visit/session measurements, recommendation answers and venue rewards. Authorized technical access may be necessary for maintenance, security, support, troubleshooting, abuse prevention and legal duties. Customer information is not used to build MyBon’s own advertising lists or for its independent marketing.

Responsibilities
The venue determines lawful purposes and bases, provides notices, obtains required permissions, limits staff access and handles individual requests. MyBon limits technical processing to service purposes and instructions, restricts access to authorized personnel, applies appropriate safeguards and provides necessary technical help with requests or investigations. This allocation does not remove statutory security responsibilities.

Providers and transfers
Hosting, email and AI services must be assessed by data, purpose, provider, destination and safeguard. Do not place unnecessary customer information in menu photos or free text. A general service agreement or consent statement is not, by itself, an adequate basis for international transfers.

Incidents, retention and exit
The parties should promptly inform each other of suspected incidents and cooperate on investigation, containment and required notifications. Return/deletion procedures, retention periods, backup cycles and provider conditions must be made concrete in the business’s data processing arrangement. This explanation is not a substitute for a detailed processing agreement or an international-transfer contract. At termination, instructions and mandatory retention duties must be considered together.