Data processing agreement

Canadian edition dated 2026-09-13

Instructions, confidentiality, safeguards, assistance, recipients and international processing.

Scope and duration

ProCafe is operated by Serdar K. Postal address: Cleekim Drive, EH15 3QP, Edinburgh, UK. Contact: support@procafe.app.

This agreement forms part of the service contract for the staff and operational information ProCafe processes for the cafe. Processing lasts while the business has an account, subject to closure, deletion and lawful retention. It covers storing and presenting staff identities, optional logins, shifts, time off, food-safety records and related team documents to run the business. Sensitive personal information is not requested.

Instructions and protection

ProCafe processes only on the business's documented instructions, including this agreement and its use of the product. We maintain confidentiality, bind personnel with access to confidentiality, and apply appropriate technical and organisational security. We assist with access and correction requests and with security and breach duties, and notify the business of a personal-data breach without undue delay.

At the end of service, data is returned or deleted subject to lawful retention and the published backup cycle. On reasonable request and notice, we provide information needed to demonstrate these obligations. The business determines the lawful purposes, necessary information, notices and consent for its staff and operational use.

Providers and transfers

The business authorizes the published sub-processors. Advance notice is given before a covered processor is added or changed; reasonable objections can be raised and, if unresolved under the agreement, lead to termination. A recipient's separate controller role is identified where applicable.

Hosting is in the EU; some listed providers process information in the US. Applicable UK/EEA transfer safeguards include adequacy arrangements or contractual clauses under the relevant provider terms. They do not replace a Canadian business's accountability or a Québec privacy impact assessment and written agreement where required. Contact us for the information needed to review the arrangement before submitting personal information.