Data Processing Agreement

This DPA forms part of the agreement between the cafe (the controller) and ProCafe (the processor) for the staff and operational data ProCafe processes on the controller’s behalf.

Subject-matter & duration

ProCafe processes the controller’s data for as long as the controller has an account, to provide the ProCafe service.

Nature & purpose

Storing and presenting rotas, time-off requests, food-safety and operational records, and related team data, so the controller can run their cafe.

Types of data & people

Staff names, optional logins, shifts and time-off, and operational records — about the controller’s staff. Special-category data is not requested; see the Privacy Policy.

Processor obligations

• Process only on the controller’s documented instructions (this DPA and the product’s use).
• Keep the data confidential and ensure staff with access are under confidentiality.
• Apply appropriate technical and organisational security measures — see the Security page.
• Assist the controller with data-subject requests and with security/breach duties.
• Notify the controller of a personal-data breach without undue delay.
• Delete or return the data at the end of the service, subject to any legal retention.
• Make available the information needed to show compliance with these obligations.

Sub-processors

The controller authorises the sub-processors on the Sub-processor List — including Stripe, our payment processor (card details are handled by Stripe; ProCafe does not store card numbers). We give advance notice before adding or changing a sub-processor, and where this DPA provides it, the controller may object and, failing resolution, terminate.

International transfers

Where a sub-processor is outside the UK/EEA, an appropriate transfer safeguard is used (for example a UK adequacy decision or the UK International Data Transfer Agreement / Standard Contractual Clauses). We prefer UK/EEA-based sub-processors where practical.

Audit

On reasonable request and notice, ProCafe provides information to demonstrate compliance.