Data processing agreement

Canadian edition dated 2026-10-31

Instructions, confidentiality, safeguards, assistance, recipients and international processing.

Scope and duration

ProCafe is operated by Serdar Kahraman, a sole trader. Postal address: Cleekim Drive, EH15 3QP Edinburgh, United Kingdom. Contact: support@procafe.app or the contact form at procafe.app/contact.

This agreement forms part of the service contract for the staff and operational information ProCafe processes for the cafe. Processing lasts while the business has an account, subject to closure, deletion and lawful retention. It covers storing and presenting staff identities, optional logins, shifts, time off, food-safety records and related team documents to run the business. Sickness absence classifications can reveal health information; private employee files may also contain health or other sensitive personal information. These records are processed on the business's documented instructions, subject to the requirements described in the privacy notice.

Additional staff data and instructions

Processing also covers attendance, actual breaks, corrections, approvals, captured base and overtime rates and reviewed payable minutes; private contact and emergency-contact details, right-to-work files and manual reviews, payslips, contract versions and signing or authentication receipts; and message text, participants, timestamps and read state. Data concerns staff and other contacts whose details they supply. Owner-enabled foreground venue checks add stored coordinates and accuracy; owner-enabled clock-in photos add image evidence. No background tracking, facial recognition or wage payment is implemented. Files can include supplied metadata.

The business chooses which optional policies to enable and determines necessary purposes, information, lawful authority, notices, any applicable consent and retention instructions. Device permission does not replace those responsibilities. Private and conversation records use the access boundaries described in the privacy notice.

Instructions and protection

ProCafe processes only on the business's documented instructions, including this agreement and its use of the product. We maintain confidentiality, bind personnel with access to confidentiality, and apply appropriate technical and organisational security. We assist with access and correction requests and with security and breach duties, and notify the business of a personal-data breach without undue delay.

At the end of service, data is returned or deleted subject to lawful retention and the published backup cycle. On reasonable request and notice, we provide information needed to demonstrate these obligations. The business determines the lawful purposes, necessary information, notices and consent for its staff and operational use.

Providers and transfers

The business authorizes the published sub-processors. Advance notice is given before a covered processor is added or changed; reasonable objections can be raised and, if unresolved under the agreement, lead to termination. A recipient's separate controller role is identified where applicable.

Hosting is in the EU; some listed providers process information in the US. Applicable UK/EEA transfer safeguards include adequacy arrangements or contractual clauses under the relevant provider terms. They do not replace a Canadian business's accountability or a Québec privacy impact assessment and written agreement where required. Contact us for the information needed to review the arrangement before submitting personal information.