Terms & Conditions
Last updated: 16 July 2026
B2B Terms for Cash Register / POS (MealReveal)
Last updated: 16 July 2026
This website / platform is owned and operated by Reveal Labs ΟΜΟΡΡΥΘΜΗ ΕΤΑΙΡΕΙΑ (Reveal Labs General Partnership), G.E.MI. No. 193857001000, VAT / Tax ID 803287942 (tax office ΚΕΦΟΔΕ ΑΤΤΙΚΗΣ), with registered address at Πιπινου 5, Αγιος Δημήτριος, Ελλάδα, and contact email [email protected] (the “Company” or “Reveal Labs”). The product and services are offered under the brand name MealReveal.
These Terms (the “B2B Terms” or “Terms”) govern the sale / licence of the MealReveal cloud cash register / POS and related services between Reveal Labs and businesses (hospitality, food service, retail, catering or related activities — the “Customer” or “you”). They do not govern mere browsing of the public marketing website, which is covered by the Website Terms of Use.
By accepting an offer, ordering equipment, creating an account, completing a subscription checkout, installing the system or making payment, you represent that you are authorised to bind your business and unconditionally accept these Terms, together with any specific offer, price list, order or SLA agreed in writing. In case of conflict, specifically agreed documents prevail unless mandatory law provides otherwise.
1. Definitions
- “Cash register” / “POS”: the MealReveal point-of-sale system provided to the Customer (cloud till software, counter / handheld apps, receipt printing or sending where supported, and related equipment where sold or supplied).
- “Platform” / “MealReveal”: the POS software, admin environments, APIs, technical infrastructure and related technology Reveal Labs provides to operate the cash register.
- “Services”: provision of the Cash register / POS and related services in Section 2, including software subscription, equipment, installation and support where agreed.
- “Equipment”: hardware sold or delivered to the Customer (e.g. till tablet / stand, handheld POS, receipt / kitchen printer, scanners) as set out in the offer.
- “Customer Content”: any content, data, images, menus, pricing, logos, text, settings or other materials you upload, enter or manage via the Platform.
- “Guest Data”: personal data of your end customers / guests processed by Reveal Labs on your behalf in connection with the Services.
- “PSP” / “Payment Service Provider”: a licensed third-party payment provider. For POS / till and guest payments we work with Viva Wallet (Viva Payments). B2B subscription payments to Reveal Labs may use another PSP (e.g. Revolut).
- “Subscription”: the period and plan of access to the Services as set out in the offer, checkout or agreement.
- “Confidential Information”: any non-public technical, commercial, financial or business information disclosed by one party to the other.
2. Subject matter — cash register / POS sold to the Customer
The agreement’s subject matter is providing the Customer with the MealReveal Cash register / POS for use in its business, according to the selected plan / offer, including without limitation:
- cloud cash register / point of sale (orders, till payments, receipts where supported),
- handheld POS / tableside ordering and payment, where included in the plan,
- receipt and kitchen printers, stands and other Equipment, where sold or agreed,
- digital menu, QR and product catalogue, to the extent included,
- dine-in, takeaway, delivery, table service and table / zone management,
- kitchen / service / KDS features to the extent supported,
- POS payment integrations via PSP, in particular Viva Wallet, and, where agreed, delivery channels,
- onboarding, installation, technical support and software updates.
The Services are provided as a professional till / POS system (software and, where agreed, Equipment). Reveal Labs is not a licensed credit institution, payment institution or financial institution and does not provide financial, tax or legal advice. Card payments at the POS / to guests are processed via Viva Wallet. B2B subscription payments to Reveal Labs are processed via another PSP (e.g. Revolut), under the applicable provider’s terms.
Reveal Labs may develop, modify or discontinue features provided this does not materially downgrade core Services of the active plan, except where required by law, security or technical necessity, with reasonable notice where practicable.
2A. Fiscal documents, receipts and tax authorities
The Cash register / POS is a tool for the Customer’s business. The Customer remains the taxable person / trader responsible for issuing, content, accuracy and transmission of fiscal documents (retail receipts, invoices, notes, myDATA / AADE or equivalent filings), including VAT rates, classifications and business details.
Reveal Labs does not replace the Customer as taxpayer, accountant or tax authority and does not give tax advice. Unless expressly agreed in writing and required by applicable law (e.g. certified e-invoicing / fiscal-device provider status), the Services do not by themselves constitute a lawful mechanism that relieves the Customer of its own receipt-issuing and filing duties.
The Customer must in particular:
- configure on the POS its VAT ID, tax office, legal name, VAT rates, document types and any AADE or third-party provider credentials,
- check that a receipt / document is correct before issuing it to a consumer,
- keep lawful copies and accounting records outside the Platform where required,
- not issue documents via the Platform if it knows the function is offline, incorrect or unavailable, without a lawful alternative process.
A software fault, outage, Customer misconfiguration or third-party failure (tax authority, provider, PSP, printer) does not shift tax liability to Reveal Labs. Claims for fines, surcharges, lost profits or business interruption arising from fiscal documents are governed by Sections 17, 18 and 19, subject to mandatory law (in particular fraud / gross negligence).
3. Contract formation and offers
The agreement is formed upon acceptance of these Terms and (a) completion of registration / account creation, (b) acceptance of a written or electronic offer, (c) completion of subscription checkout or (d) first payment, whichever occurs first.
Each offer, price list, confirmation email, order or checkout forms part of the agreement to the extent it specifies plan, term, prices, discounts, payment terms or special settings. Where unclear, the default initial subscription term is twelve (12) months unless otherwise agreed in writing.
4. Accounts, access and security
The Customer must:
- provide accurate, complete and up-to-date business, contact, VAT and legal representative details,
- keep access credentials secure and limit access to authorised personnel,
- remain responsible for all activity under its account, including actions of authorised users,
- promptly notify Reveal Labs of any suspected unauthorised use or security breach,
- follow security guidance and best practices communicated by Reveal Labs.
Reveal Labs may suspend or restrict access in case of security risk, non-payment, breach of Terms or legal obligation, with reasonable notice where permitted.
5. Customer obligations
The Customer warrants and undertakes to:
- use the Cash register / POS only for lawful business purposes and in compliance with applicable law (tax, employment, health, consumer protection, GDPR, etc.),
- remain solely responsible for correct issuance of receipts and other fiscal documents as in Section 2A,
- keep Customer Content accurate, especially prices, availability, allergens and product descriptions,
- have all necessary rights in Customer Content and not infringe third-party rights,
- inform guests / consumers as required by law, especially regarding orders, payments and personal data,
- not use the Services for spam, fraud, unlawful content, malware or resource abuse,
- not reverse engineer, scrape, gain unauthorised access or interfere with the Platform,
- cooperate reasonably with onboarding, testing, support and incident resolution.
6. Customer Content and intellectual property
The Customer retains ownership of Customer Content. By providing Customer Content, the Customer grants Reveal Labs a non-exclusive, worldwide, royalty-free licence to host, store, reproduce, adapt (e.g. formatting / rendering), display and make available Customer Content solely to provide the Services and operate the Platform technically.
Reveal Labs may remove or block Customer Content that violates law, third-party rights or these Terms, without prior liability, with notice where practicable.
Platform intellectual property
Software, design, APIs, codebase, trademarks, the MealReveal brand and all Platform technology are exclusive property of Reveal Labs or its licensors. The Customer receives only a limited, non-transferable, non-sublicensable licence to use the Services during the active Subscription for internal business purposes.
7. Data protection
For Guest Data (e.g. order details, preferences, visit-related technical identifiers within your venue), the Customer is the Controller and Reveal Labs acts as Processor under GDPR and applicable Greek law, to the extent it processes data on the Customer’s behalf.
For Customer account data, billing, contractual communications, platform security, product analytics (where permitted) and B2B marketing, Reveal Labs acts as an independent Controller, as described in the Privacy Policy.
The Customer must provide lawful bases, inform guests, maintain required notices / consents and cooperate on data subject requests to the extent relating to Guest Data.
Processing of Guest Data is governed by the Data Processing Agreement (DPA) in Annex A, which forms an integral part of these Terms under GDPR Article 28 (subject matter and duration, types of data, categories of data subjects, documented instructions, sub-processors, confidentiality, security, assistance, return / deletion and audits).
8. Subscriptions, term and auto-renewal
The initial Subscription term is set out in the offer or checkout. If not expressly agreed, the initial term is twelve (12) months.
After the initial period, the Subscription renews automatically for a further period equal to the billing cycle (monthly or annual) unless the Customer cancels under Section 11. Reveal Labs provides renewal notice where required by law or the offer.
9. Fees, invoicing and price changes
Charges are determined by the accepted offer, price list, plan or checkout. Prices are stated net or inclusive of VAT as indicated. Invoices are issued under Greek tax legislation.
Reveal Labs may change standard prices or plans for future billing periods with fifteen (15) calendar days’ notice before they take effect, by email or in-platform notice. Continued use after new prices take effect constitutes acceptance unless the Customer cancels under Section 11 before the next charge or mandatory law requires otherwise.
10. Payments, payment failure and suspension
B2B subscription payments to Reveal Labs are processed via a third-party PSP (e.g. Revolut) and are separate from card payments at the POS. Reveal Labs is not itself a licensed PSP; card / wallet processing is performed by the relevant PSP under its terms and security standards (PCI DSS, etc.). Reveal Labs does not store full card payment details.
In case of payment failure or delay, Reveal Labs may, cumulatively or alternatively:
- retry charging or request updated payment details,
- charge interest / collection costs to the extent permitted by law and the offer,
- temporarily suspend access to the Services,
- terminate for material breach after a reasonable cure period where required.
11. Refunds and cancellation
- 14-day period for new subscriptions / new sign-ups: The Customer may request a refund within fourteen (14) calendar days of first activation / payment of a new subscription or new sign-up by emailing [email protected], unless material use excludes the right under law or the offer.
- After the 14-day period / mid-cycle cancellation: The Customer may cancel the Subscription at any time; cancellation applies to the next billing period unless otherwise agreed. No refund of prepaid fees is provided for the remainder of the current period, except where mandatory law requires or Reveal Labs materially breaches and fails to cure reasonably.
- Equipment returns: Equipment (e.g. tablets, printers, POS terminals, stands, QR displays) may be returned only if it is unopened, in its original sealed packaging, in perfect condition, with no damage, signs of use or missing parts, and is returned within the 14-day period of this section. Opened equipment may also be returned if it was defective on delivery, under the statutory warranty. The Customer pays return shipping unless the equipment is defective. Reveal Labs may refuse a return, or withhold a proportionate amount, for equipment that does not meet these conditions. Custom-made or personalised items (e.g. printed QR materials) are non-returnable.
12. POS / guest payments (Viva Wallet), marketplace, settlement and chargebacks
At the POS / till, card, wallet and similar payments to the Customer are processed through a licensed payment service provider, in particular Viva Wallet (Viva Payments) (the “PSP”). Reveal Labs provides technical connectivity between the Cash register and the PSP.
Marketplace — Reveal Labs is not a payment institution
Where consumer payment-acceptance is offered at the POS, Reveal Labs acts as operator of a technical platform / marketplace under the regulatory cover of the licensed PSP. Reveal Labs is not a licensed payment institution and does not itself provide payment services. Acceptance, clearing, holding and payout of funds are performed via the PSP under its terms. The seller of products or services to the guest is solely the Customer. Reveal Labs is not a party to the sale contract and is not responsible for order fulfilment, quality, price or tax treatment of the Customer’s products.
Payment flow and settlement
When a guest payment completes: (a) the full amount is received by the PSP (Viva), (b) the PSP’s agreed fees and any Reveal Labs commissions / charges set out in the offer are deducted, (c) the remainder is paid out to the Customer via the PSP, according to Viva’s settlement times and terms and any special terms with the Customer. Reveal Labs does not warrant payout timing, which depends on the PSP and banks.
Set-off against payouts
Reveal Labs may set off commissions, subscriptions, overdue fees and any other amounts the Customer owes against sums that would otherwise be paid out to the Customer, and may request / instruct the PSP to apply that set-off at settlement, to the extent permitted by law and Viva’s terms.
Reversals, disputes and chargebacks
Refunds, chargebacks, cancellations or payment reversals are borne by the Customer as seller of the transaction. Reveal Labs may, without the Customer’s prior approval where law and PSP terms allow, cooperate with Viva to withhold, not pay out, set off or recover from future settlements, or invoice those amounts directly to the Customer.
AML / KYC and holds
The PSP may impose temporary holds, suspend settlement or run compliance checks (AML/KYC, sanctions) under its terms and applicable law, without liability of Reveal Labs. The Customer must cooperate and provide required information.
Viva / PSP terms, policies and activity restrictions also apply. If they conflict with these Terms on payment matters, the PSP’s terms prevail. Failure, delay or restriction by Viva is not by itself a breach by Reveal Labs, except where Reveal Labs is at fault.
13. Availability (SLA) and support
Reveal Labs targets at least 99% monthly availability of the Cash register / POS core, calculated per calendar month, subject to standard exclusions:
- scheduled maintenance (with notice where practicable),
- emergency security interventions,
- failures of third-party networks, DNS, CDN, cloud hosting,
- force majeure events,
- outages caused by the Customer, third parties or PSPs.
Support response targets (business days, 09:00–18:00 EET/EEST, excluding public holidays):
- Critical incidents (complete inability to take orders / payments): target response within four (4) business hours.
- Functional incidents (significant impairment without full outage): target within one (1) business day.
- Configuration / setup requests: target within three (3) business days.
The SLA is a performance target, not a warranty, unless otherwise agreed in a dedicated SLA document. Support: [email protected] and channels indicated on the Platform.
14. Acceptable use and suspension
You may not use the Services for unlawful purposes, security breaches, abusive data traffic, malware, harassment, consumer deception or infringement of third-party rights. Reveal Labs may suspend or restrict access for serious or repeated breach, security risk or legal obligation.
15. Third-party providers
The Services may rely on third parties (cloud hosting, PSP, analytics, email, CDN, etc.). Reveal Labs is not liable for third-party outages or changes to the extent permitted by law and may replace providers with relevant notice.
16. Confidentiality
Each party must keep the other’s Confidential Information confidential and use it only to perform the agreement. The confidentiality obligation lasts for five (5) years from disclosure, except where information:
- is or becomes public without breach,
- was lawfully known before disclosure,
- is disclosed under legal obligation or court order,
- is independently developed without use of Confidential Information.
17. Warranties and disclaimers
The Services are provided “as is” and “as available” to the fullest extent permitted by law. Reveal Labs does not warrant uninterrupted operation, absolute security or that the Services will meet every business need. The Customer remains responsible for business decisions, compliance and consumer relationships.
18. Limitation of liability
To the fullest extent permitted by law, Reveal Labs is not liable to the Customer or any third party for any consequential, incidental, indirect, special, punitive or other damages, even if Reveal Labs has been advised of the possibility of such damages, including without limitation:
- loss of profits, revenue, turnover or business opportunity,
- interruption or delay of business operations,
- failure of computers, devices, networks or systems of the Customer or third parties,
- loss, corruption, alteration or unavailability of data, business information, Customer Content or Guest Data,
- loss of reputation or goodwill,
- cost of substitute services or re-processing,
- damages arising from use of, or inability to use, the Services.
Subject to mandatory law, Reveal Labs’ aggregate liability arising from or in connection with the agreement, whether in contract, tort (including negligence), statute or otherwise, and regardless of the number of claims, is limited to the amount paid by the Customer for the specific Services giving rise to the claim in the twelve (12) months preceding the event giving rise to the claim. If no fees were paid in that period, the cap equals the then current monthly equivalent of the applicable plan.
Nothing in these Terms limits or excludes liability that cannot be limited by law (including fraud, gross negligence, death / personal injury).
19. Indemnification
The Customer shall indemnify and hold harmless Reveal Labs, its members, partners and representatives from third-party claims, fines, damages and costs (including reasonable legal fees) arising from:
- Customer Content or infringement of third-party rights,
- breach of law or these Terms by the Customer,
- guest transactions, chargebacks and tax / consumer disputes,
- unlawful processing of Guest Data by the Customer.
20. Term, termination and notice
The agreement runs for the initial Subscription and renews under Section 8 unless terminated earlier. Either party may terminate for material breach if not cured within a reasonable period (typically fifteen (15) days) of written notice, unless the breach is incapable of cure.
Reveal Labs may terminate or suspend immediately for non-payment, unlawful use, security risk or legal obligation. Upon termination, the licence ends; the Customer must pay fees due through the termination date.
21. Data export and retention
Upon termination, the Customer may request export of Guest Data and core settings in a reasonable format (e.g. CSV / Platform export) within thirty (30) calendar days. After that period, Reveal Labs may delete or archive data per its retention policy.
Typical retention (subject to legal obligations):
- active account data: up to 60 days after termination,
- backup / log archive: up to one (1) year,
- invoices and tax / accounting records: as required by tax / accounting law.
22. Force majeure
Neither party is liable for delay or failure due to force majeure (e.g. natural disasters, war, terrorism, strikes, government acts, extended Internet / power / cloud outages). If the event continues for more than sixty (60) days, either party may terminate with written notice without further payment obligation for periods when Services were not provided, except amounts accrued before termination.
23. Assignment
The Customer may not assign the agreement or its rights without Reveal Labs’ prior written consent. Reveal Labs may assign to an affiliate or in connection with merger, acquisition or sale of business, with notice to the Customer.
24. Changes to Terms
Reveal Labs may amend these Terms. Material changes are notified with thirty (30) calendar days’ notice before they take effect (email or in-platform notice). Continued use after the effective date constitutes acceptance unless mandatory law requires otherwise or the Customer terminates before the effective date. Non-material changes (corrections, clarity) may take effect immediately upon publication.
25. Notices
Notices to Reveal Labs must be sent to [email protected]. Notices to the Customer are sent to the account admin email or registered address. Electronic delivery is deemed received on the next business day unless delivery failure is proven.
26. Entire agreement, severability, survival
These Terms, together with the offer / checkout, Privacy Policy and Annex A (DPA), constitute the entire agreement between the parties and supersede prior oral or written understandings. If any provision is invalid, the remainder stays in effect. Provisions that by nature survive (confidentiality, liability, indemnity, intellectual property, governing law, DPA) survive termination.
27. Governing law and jurisdiction
These Terms are governed by Greek law. The courts of Athens have exclusive jurisdiction, subject to mandatory consumer protection rules that do not apply to B2B contracts between businesses.
28. Contact
For questions, cancellation, refunds or support:
Legal name: Reveal Labs ΟΜΟΡΡΥΘΜΗ ΕΤΑΙΡΕΙΑ (Reveal Labs General Partnership)
Address: Πιπινου 5, Αγιος Δημήτριος, Ελλάδα
VAT / Tax ID: 803287942 — ΚΕΦΟΔΕ ΑΤΤΙΚΗΣ
Γ.Ε.ΜΗ. / G.E.MI.: 193857001000
Email: [email protected]
Annex A — Data Processing Agreement (DPA)
Last updated: 16 July 2026
This website / platform is owned and operated by Reveal Labs ΟΜΟΡΡΥΘΜΗ ΕΤΑΙΡΕΙΑ (Reveal Labs General Partnership), G.E.MI. No. 193857001000, VAT / Tax ID 803287942 (tax office ΚΕΦΟΔΕ ΑΤΤΙΚΗΣ), with registered address at Πιπινου 5, Αγιος Δημήτριος, Ελλάδα, and contact email [email protected] (the “Company” or “Reveal Labs”). The product and services are offered under the brand name MealReveal.
This Annex A is a data processing agreement under Article 28 of Regulation (EU) 2016/679 (GDPR) and forms an integral part of the B2B Terms of Service. It applies where Reveal Labs processes Guest Data on the Customer’s behalf.
If this Annex conflicts with the other B2B Terms on the processing of Guest Data, this Annex prevails.
A1. Parties and roles
- Controller: the Customer (hospitality / food-service business).
- Processor: Reveal Labs, for Guest Data processed in connection with the MealReveal Services.
This Annex does not apply where Reveal Labs acts as an independent controller (Customer account, billing, platform security, B2B communications), as described in the Privacy Policy.
A2. Subject matter, nature, purpose and duration
Subject matter: providing the MealReveal Cash register / POS as a professional point-of-sale system (orders, till, receipts where supported, digital menu, tables / zones, POS / kitchen / service features, notifications where enabled).
Nature of processing: collection, recording, organisation, storage, retrieval, transmission, display, backup and deletion, to the extent required to operate the Services.
Purpose: processing solely to provide the Services to the Customer and in accordance with the Customer’s documented instructions, so the Customer can serve guests / orders at its venue.
Duration: for the term of the B2B agreement and, after termination, for the period in Section A10 (return / deletion) and the B2B Terms on export and retention.
A3. Categories of data subjects
- guests / consumers of the Customer’s business who use the digital menu, QR, ordering or related features,
- persons whose details are entered by the Customer or by a guest on their behalf (e.g. order notes, contact details where collected).
A4. Types of personal data
Depending on features the Customer enables, processing may include:
- order details (items, quantities, prices, time, status, notes),
- table / zone / visit identifiers,
- preferences or statements entered by the guest (including allergens where declared),
- guest contact details (name, phone, email) if the Customer collects them via the Platform,
- device / browsing technical data (e.g. IP address, device type, language, session identifiers),
- push subscription details (endpoint / keys) where the guest enables notifications,
- payment status references (not full card numbers; card processing is performed by a licensed PSP).
The Customer must not enter special-category data (GDPR Article 9) via the Platform unless a lawful basis exists and this has been agreed in writing. Allergen statements entered for order fulfilment are the Customer’s responsibility as to lawful basis if they constitute health data.
A5. Documented instructions
Reveal Labs processes Guest Data only on the Customer’s documented instructions, including:
- the B2B Terms and this Annex,
- the Customer’s settings, configuration and actions on the Platform,
- written instructions via [email protected] or another agreed support channel.
Reveal Labs shall immediately inform the Customer if, in its opinion, an instruction infringes the GDPR or other Union or Member State data-protection provisions. Reveal Labs may pause such an instruction pending clarification.
Reveal Labs may process data where required by Union or Member State law; in that case it informs the Customer before processing unless the law prohibits such information on important grounds of public interest.
A6. Confidentiality
Reveal Labs ensures that persons authorised to process Guest Data have committed themselves to confidentiality or are under an appropriate statutory obligation of confidentiality, and have access only on a need-to-know basis.
A7. Security (GDPR Article 32)
Reveal Labs implements appropriate technical and organisational measures, taking into account the state of the art, implementation costs, the nature, scope, context and purposes of processing, and the risks to the rights and freedoms of natural persons. These include, without limitation:
- encryption in transit (TLS) and account access controls,
- least-privilege access, separate environments where applicable, and logging of administrative actions,
- backups and resilience / recovery measures,
- reasonable vulnerability assessment and mitigation for a SaaS service.
The Customer remains responsible for the security of its own credentials, devices and Platform settings, and for informing guests.
A8. Sub-processors
The Customer gives a general written authorisation for Reveal Labs to engage other processors (sub-processors) to provide the Services, in accordance with GDPR Articles 28(2) and 28(4).
Sub-processors used as of the date of this Annex (for Guest Data, where applicable):
- Back4App / Parse: backend hosting, database and application operation.
- Mailgun and/or Resend: transactional email (e.g. notifications) where the Customer enables related features.
- Cloud / CDN infrastructure used by the above hosting provider to operate the Platform.
Licensed payment providers (for the POS, in particular Viva Wallet) process payment data as independent controllers under their own terms, except to the extent they act as Reveal Labs’ sub-processors.
Reveal Labs will inform the Customer of intended additions or replacements of sub-processors (email or in-platform notice) at least fifteen (15) calendar days before processing starts, so the Customer may object on reasonable data-protection grounds. If the objection cannot be accommodated without material impairment of the Services, either party may terminate under the B2B Terms.
Where a sub-processor is engaged, Reveal Labs imposes on it by contract the same data-protection obligations as in this Annex, in particular sufficient guarantees to implement appropriate technical and organisational measures. If the sub-processor fails to fulfil its obligations, Reveal Labs remains fully liable to the Customer for the performance of that sub-processor’s obligations, to the extent required by GDPR Article 28(4).
A9. Assistance to the Controller
Data-subject rights (GDPR Article 28(3)(e))
Taking into account the nature of the processing, Reveal Labs assists the Customer by appropriate technical and organisational measures, insofar as possible, for the fulfilment of the Customer’s obligation to respond to requests for exercising the data subject’s rights. Requests Reveal Labs receives that relate to Guest Data are forwarded to the Customer without undue delay; the Customer remains responsible for responding.
GDPR Articles 32 to 36 (Article 28(3)(f))
Reveal Labs assists the Customer in ensuring compliance with obligations regarding security, notification of a personal data breach to the supervisory authority and to data subjects, data-protection impact assessments and prior consultation, taking into account the nature of processing and the information available to Reveal Labs.
In the event of a personal data breach affecting Guest Data, Reveal Labs notifies the Customer without undue delay after becoming aware of it, with the information available that the Customer needs to meet GDPR Article 33 (and, where applicable, Article 34).
A10. Return and deletion
After the end of the provision of processing services, Reveal Labs, at the choice of the Customer, deletes or returns all Guest Data and deletes existing copies unless Union or Member State law requires storage.
The Customer may request export in a reasonable format within thirty (30) calendar days of termination, as set out in the B2B Terms. Absent a different written instruction within that period, Reveal Labs may delete Guest Data from live systems; backups / archives may be retained for a limited period under the retention policy and then deleted or rendered inaccessible.
A11. Information and audits
Reveal Labs makes available to the Customer all information necessary to demonstrate compliance with the obligations in GDPR Article 28 and allows for and contributes to audits, including inspections, conducted by the Customer or another auditor mandated by the Customer, with reasonable notice, during business hours, without undue disruption of the Services, and subject to confidentiality and the security of other customers.
To avoid disproportionate burden, Reveal Labs may satisfy audit requests through recent third-party reports / certifications (e.g. of the hosting provider), security questionnaires and documentation of measures, unless the Customer has a reasonable basis to require an on-site or broader audit.
A12. Transfers outside the EEA
If Guest Data is transferred outside the European Economic Area, Reveal Labs ensures a Chapter V GDPR mechanism is in place (e.g. an adequacy decision or the European Commission’s Standard Contractual Clauses, plus supplementary measures where required).
A13. Customer obligations as Controller
The Customer warrants that:
- a lawful basis exists for the processing and its instructions comply with the GDPR,
- it informs data subjects as required (GDPR Articles 13 / 14) and handles rights requests,
- it will not instruct Reveal Labs to carry out unlawful processing,
- it will promptly provide information Reveal Labs needs to perform this Annex.
A14. Contact
For instructions, breach notices, sub-processor objections or DPA requests: [email protected].
