Data Processing Addendum
This Addendum applies when we process personal data on your behalf through Modlocus Menu and forms part of the Terms of Service. You are the controller and we are the processor (GDPR Art. 28).
1. Scope
Subject matter: hosting and operating your menu. Duration: while your account is active, plus the deletion period below. Nature: storage, display and transmission. Data: menu and business content you provide and any personal data it may contain (for example, staff or business contact names). Data subjects: your staff and business contacts.
2. Our commitments
- We process personal data only on your documented instructions (these Terms and your use of the Service), unless law requires otherwise.
- People with access are bound by confidentiality.
- We apply appropriate security measures (see section 4).
- We use sub-processors only under written terms with equivalent data-protection obligations (section 5) and give advance notice of changes.
- We help you respond to data-subject requests and to meet your security, breach-notification and impact-assessment duties, taking into account the nature of processing.
- On termination we delete or return personal data (section 6).
- We make available the information needed to show compliance and allow reasonable audits, by written questionnaire or documents unless law requires more.
- We tell you if we believe an instruction breaches data-protection law.
3. Personal-data breaches
We notify you without undue delay after becoming aware of a breach affecting your data, aiming for within 72 hours, with the information we have.
4. Security measures
- Encrypted connections (HTTPS) between users and the Service.
- Passwords stored only as salted hashes; account lockout after repeated failed sign-ins.
- Logical separation of each business's data; authenticated, role-checked access to the panel.
- HttpOnly, secure session cookies; protection against cross-site request forgery; content security policy.
- Regular backups of the database.
5. Sub-processors
You authorize the following categories of sub-processors. We will update this list and give notice of changes; you may object to a new sub-processor by emailing us before it takes effect.
| Category | Purpose | Location |
|---|---|---|
| Hosting and infrastructure provider | Application servers, database, file storage | European Union (to be confirmed at launch) |
| Email delivery provider | Account and notice emails | To be confirmed at launch |
our payment provider handles payments as merchant of record and is an independent controller of payment data, not our sub-processor.
6. Deletion and return
You can export your menu data on request. On your request (including after cancellation) we delete your account and menu data within 30 days; backups are overwritten on their normal cycle.
7. International transfers
Where personal data is transferred outside the EEA/UK to a country without an adequacy decision, the parties rely on the EU Standard Contractual Clauses, incorporated by reference.