Data processing terms

1. What these terms cover

1.1 These terms apply when Café QR processes personal data on behalf of a café ("you") to provide the Café QR service. They form part of your agreement with CAFÉ QR LTD ("Café QR", "we").

1.2 You are the controller of personal data about your guests, your staff and your own customers that you or they put into Café QR. We are your processor. We are a controller only for our own purposes described in our privacy notice (for example, your account administration, billing and our website).

1.3 "UK GDPR", "personal data", "processing", "controller", "processor", "data subject" and "personal data breach" have the meanings given in the UK GDPR and the Data Protection Act 2018 ("Data Protection Law").

1.4 Annex 1 describes the processing. Annex 2 lists our security measures. Annex 3 lists our sub-processors.

2. Your instructions

2.1 We process your personal data only on your documented instructions. Your instructions are: these terms, your agreement with us, and how you configure and use the service. We may process it otherwise only where the law requires; if so, we'll tell you first unless the law forbids it.

2.2 We'll tell you promptly if we think an instruction breaks Data Protection Law.

2.3 We don't sell your personal data, use it to train AI models, or use it for our own marketing.

3. Your responsibilities

3.1 You're responsible for having a lawful basis for the processing, for giving people the privacy information they need (including your staff, where you use staff features such as sickness records), and for the accuracy of the data you enter.

3.2 Where you use features that hold special category data (for example staff sickness and fitness-to-work records), you're responsible for having a condition for processing it and any appropriate policy document the law requires. We'll provide templates with the feature, but they aren't legal advice.

4. Confidentiality

4.1 Everyone at Café QR who can access your personal data is bound by a duty of confidentiality and accesses it only as described in our support access policy (Annex 2, item 9).

5. Security

5.1 We use appropriate technical and organisational measures to protect your personal data, including those in Annex 2. We may update them as long as the overall level of protection doesn't fall.

6. Sub-processors

6.1 You give us general authorisation to use the sub-processors in Annex 3 and new ones under this clause.

6.2 We'll give you at least 30 days' notice of a new or replacement sub-processor by updating cafeqr.app/subprocessors and emailing the account owner. In an emergency (to keep the service secure or running), we'll tell you as soon as we can.

6.3 You may object on reasonable data protection grounds within those 30 days. We'll discuss it in good faith. If we can't resolve it, you may end the affected part of the service, and we'll refund any fees paid in advance for it.

6.4 We impose data protection terms on each sub-processor that give at least the protection in these terms, and we stay responsible to you for their work.

7. International transfers

7.1 Our database and server functions run in London. Food safety photos and documents are stored in London; menu and marketing photos are stored in the USA. Some sub-processors are based in, or can access data from, outside the UK. Where that's a restricted transfer, we rely on UK adequacy regulations (including the UK Extension to the EU–US Data Privacy Framework) or the ICO's International Data Transfer Agreement or Addendum, as shown in Annex 3.

8. Helping you

8.1 People's rights: taking into account the nature of the processing, we'll help you respond to requests from people exercising their rights (access, correction, erasure and so on), mainly through the service's own tools. If a request comes to us directly, we'll pass it to you and won't answer it ourselves unless you ask.

8.2 Security, impact assessments and the ICO: we'll give you reasonable help with your security duties, data protection impact assessments and any prior consultation with the ICO. We'll give you a DPIA for our staff sickness records feature that you can adopt.

9. Personal data breaches

9.1 We'll tell you, by email to the account owner, about a personal data breach affecting your personal data without undue delay, and in any event within 48 hours of becoming aware of it, so you can meet your 72-hour deadline to tell the ICO where that applies.

9.2 We'll tell you what we know at the time (what happened, the kinds and rough number of people and records, likely consequences, and what we're doing about it), and update you as we learn more.

9.3 We'll take reasonable steps to contain the breach and reduce its effects, and keep a record of it.

9.4 Telling you about a breach isn't an admission of fault.

10. When the service ends

10.1 Before your account closes, you can export your data using the service's export tools, or ask us for help.

10.2 Within 30 days of your account closing, we'll delete your personal data from the live service, unless the law requires us to keep it. Deleted data stays in our encrypted backups until they're overwritten, up to a further 30 days, and is never restored or used in that time.

11. Information and audits

11.1 We'll make available the information reasonably needed to show we meet these terms, including our policies and our sub-processors' security certifications where they publish them.

11.2 If that isn't enough, you (or an independent auditor bound by confidentiality) may audit our compliance once a year on 30 days' notice, during business hours, at your cost, in a way that doesn't put other customers' data at risk. You may audit more often after a personal data breach or if the ICO requires it.

12. General

12.1 If these terms conflict with the rest of your agreement with us on data protection, these terms win.

12.2 Our liability under these terms is subject to the limits in your agreement with us, except where the law doesn't allow it to be limited.

12.3 We may update these terms to reflect changes in the law, the service or our sub-processors. We'll give you 30 days' notice of any change that reduces your protection.

12.4 These terms are governed by the law of England and Wales, and the courts of England and Wales have exclusive jurisdiction.

---

Annex 1: Description of the processing

Annex 2: Security measures

1. Hosting: database and server functions in London (Neon and Vercel); food safety photos and documents in London, menu and marketing photos in the USA (Vercel); encrypted in transit (TLS) and at rest by our providers
2. Backups: encrypted, kept for up to 30 days; after any restore, automatic deletion runs again straight away so expired records don't come back
3. Separation between cafés: every query on café data is limited to that café, and every action checks the user's access; covered by automated tests
4. Access inside your account: each staff member has their own login or PIN and a role set by you; PINs are stored hashed, locked after repeated wrong tries
5. Extra protection for staff health data: sickness records are visible only to owners and managers you allow, never shown on tills or staff phones, never sent in texts, emails or live updates, and deleted automatically 1 year after the record closes
6. Payments: card details are entered into Stripe's own forms or readers and never stored by Café QR
7. Logging: server logs blank names, emails, phone numbers and other sensitive fields, and are kept for 1 to 3 days
8. Analytics: website analytics run only on the public website, never on dashboard, staff or guest ordering pages
9. Café QR staff access: only named Café QR staff, only when you ask for support or to deal with an incident, recorded in a support log (support access policy)
10. Incidents: a written personal data breach plan, with notice to you as in clause 9
11. Suppliers: chosen for their security, bound by data processing terms (Annex 3)

Annex 3: Sub-processors

The current list of sub-processors, with what each does, where it processes data and the transfer safeguard, is published at cafeqr.app/subprocessors.