Legal
Data Processing Agreement
Last updated: 3 October 2026
This is Schedule 1 of the Grubify Terms of Service. It sets out the terms required by Article 28 of the UK GDPR. You are the controller of Customer Data; Grubify is the processor. Terms defined in the Terms of Service have the same meaning here.
1. Details of processing
| Subject matter | Providing the Services under the Terms |
|---|---|
| Duration | The term of the agreement, plus 30 days for data export |
| Nature and purpose | Taking, processing and fulfilling End Customer orders; sending order updates; loyalty and marketing tools you choose to use |
| Data subjects | End Customers |
| Personal data | Names, email addresses, phone numbers, delivery addresses, order history, marketing preferences |
| Special category data | None intended. Do not use free-text fields to collect health data |
2. Grubify's obligations
Grubify will:
- 1.
Process Customer Data only on your documented instructions (these Terms and your use of the Services), unless the law requires otherwise, in which case we will tell you first where legally allowed.
- 2.
Make sure anyone authorised to process Customer Data is bound by confidentiality.
- 3.
Take appropriate technical and organisational security measures, including encryption in transit, access controls and regular backups.
- 4.
Only use sub-processors in the categories listed in Annex 1, each under a written contract giving equivalent protection. A current list of named sub-processors is provided to you at onboarding and is available on request. We will give you 30 days' notice of any new or replacement sub-processor, and you may object on reasonable data protection grounds.
- 5.
Help you respond to End Customers exercising their data rights (access, deletion, correction), taking into account the nature of the processing.
- 6.
Help you meet your obligations on security, breach notification and data protection impact assessments.
- 7.
Tell you without undue delay, and within 48 hours, after becoming aware of a personal data breach affecting Customer Data.
- 8.
At the end of the agreement, delete or return Customer Data at your choice, unless the law requires us to keep it.
- 9.
Make available the information needed to show compliance with this Schedule, and allow reasonable audits on 30 days' notice, no more than once a year.
3. International transfers
Customer Data is stored in the UK/EEA. If any sub-processor transfers it outside the UK, we will make sure an appropriate safeguard is in place, such as UK adequacy regulations or the UK International Data Transfer Addendum.
4. Your obligations
You confirm you have a lawful basis for the processing, provide End Customers with a privacy notice, and only instruct us to process Customer Data lawfully.
Annex 1: Sub-processor categories
| Category | Purpose | Location |
|---|---|---|
| Cloud hosting provider | Hosting the platform and databases | UK/EEA |
| Payment processor | Processing card payments | UK/EEA |
| Email and SMS provider | Sending order confirmations and updates | UK/EEA |
| Courier delivery partner | Delivering orders, when you use courier delivery | UK |
Named sub-processors are listed in the sub-processor schedule provided with your Order Form.