Data Processing Agreement (DPA)

1. Parties and role

This Data Processing Agreement (“DPA”) is entered into between Taptop Tech SARL, operating the Menukits service (“Menukits” or “Processor”), and the customer that has entered into an agreement for the Menukits service (“Customer” or “Controller”), to the extent Menukits processes personal data on behalf of Customer.

Capitalised terms not defined in this DPA have the meaning given in the GDPR or the applicable Menukits Terms of Service.

2. Scope and precedence

This DPA applies to processing of personal data by Menukits on documented instructions from Customer in connection with the Service. If this DPA conflicts with the main service agreement regarding personal-data processing, this DPA prevails for that subject matter. Mandatory data-protection law always prevails.

3. Customer instructions

Menukits shall process personal data only on documented instructions from Customer, including instructions contained in the service agreement, Customer’s configuration and authorised use of the Service, unless processing is required by EU or Member State law. In that case Menukits shall inform Customer of the legal requirement before processing unless the law prohibits such information on important grounds of public interest.

4. Confidentiality

Menukits shall ensure that persons authorised to process Customer personal data have committed themselves to confidentiality or are under an appropriate statutory obligation of confidentiality and receive relevant data-protection and security instructions.

5. Security of processing

Taking into account the state of the art, implementation costs, and the nature, scope, context and purposes of processing as well as the risks to individuals, Menukits shall implement appropriate technical and organisational measures in accordance with Article 32 GDPR.

• role-based or need-to-know access controls;
• authentication and account-security controls;
• encryption in transit and, where appropriate, encryption or equivalent protections at rest;
• logging and monitoring appropriate to the Service;
• backup and recovery arrangements appropriate to the hosted service;
• vulnerability, patch and change-management practices;
• incident-response procedures;
• supplier and subprocessor risk controls;
• periodic review of the effectiveness of relevant security measures.

6. Subprocessors

Customer gives Menukits general authorisation to engage subprocessors that are necessary for the provision of the Service. Menukits shall ensure that each subprocessor is subject to data-protection obligations providing a level of protection for Customer personal data materially equivalent to the obligations applicable to Menukits under this DPA, as required by Article 28 GDPR.

Menukits shall maintain an up-to-date list of material subprocessors in Annex III or in a customer-accessible compliance location referenced by Menukits. Where required, Menukits will provide reasonable notice of intended additions or replacements, enabling Customer to raise a reasoned objection based on legitimate data-protection concerns. If the parties cannot resolve a legitimate objection, they may discuss a commercially reasonable alternative, including termination of the affected Service where no reasonable alternative exists.

7. Data-subject rights

Taking into account the nature of the processing, Menukits shall assist Customer by appropriate technical and organisational measures, insofar as possible, to fulfil Customer’s obligations to respond to requests for exercising data-subject rights under Chapter III GDPR. If Menukits receives a request relating to Customer-controlled data, Menukits may direct the requester to Customer unless legally required to respond directly.

8. Assistance with compliance

Taking into account the nature of processing and information available to Menukits, Menukits shall provide reasonable assistance to Customer with security obligations, personal-data-breach obligations, data-protection impact assessments and prior consultations under Articles 32 to 36 GDPR, to the extent the requested assistance relates to processing performed by Menukits for Customer.

9. Personal data breaches

Menukits shall notify Customer without undue delay after becoming aware of a personal data breach affecting Customer personal data. The notice will include information reasonably available to Menukits that Customer needs to meet its own notification obligations. Menukits may provide information in phases where not all details are available at the same time. Notification is not an admission of fault or liability.

10. International transfers

Menukits shall ensure that transfers of Customer personal data outside the EEA are made in accordance with Chapter V GDPR. Where required, Menukits or the relevant subprocessor will rely on an adequacy decision, Standard Contractual Clauses or another recognised transfer mechanism and implement supplementary measures where appropriate.

11. Return and deletion

At the end of the Services involving processing, Menukits shall, at Customer’s choice and subject to the Service’s available functionality, delete or return Customer personal data and delete existing copies unless EU or Member State law requires continued storage. Routine backup copies may persist for a limited period under Menukits’ normal backup cycle; during that period they remain protected, access-restricted and are not used for any new purpose. Data that must be retained for legal, accounting, security or dispute-resolution purposes will be retained only for as long as necessary for those purposes and then deleted or anonymised.

12. Audit and information rights

Menukits shall make available information reasonably necessary to demonstrate compliance with Article 28 GDPR and this DPA. Customer may request relevant security or compliance documentation. Where additional audit is reasonably necessary, the parties shall agree scope, timing, confidentiality and measures to minimise disruption. On-site audits should normally be reserved for situations where available documentation is insufficient or where required by a competent authority or mandatory law.

13. Customer responsibilities

Customer is responsible for ensuring that it has a lawful basis and has provided required notices for personal data submitted to the Service, that its instructions comply with applicable law, and that it uses appropriate account permissions and security settings. Customer shall not instruct Menukits to process data in a manner that would violate applicable data-protection law.

14. Liability

Liability arising under this DPA is subject to the liability framework in the applicable service agreement, except to the extent such limitation is prohibited by data-protection law. Nothing in this DPA limits statutory rights of data subjects or powers of supervisory authorities.

15. Term

This DPA takes effect when Menukits processes personal data on behalf of Customer and remains in force for as long as such processing continues, including any limited period during which retained backup copies remain protected under this DPA.

Annex I — Details of Processing

Annex II — Technical and Organisational Measures

The following sets out the baseline categories of technical and organisational measures applied by Menukits. Menukits maintains more detailed internal security procedures and reviews these measures as the Service and architecture evolve.

• Access control and identity management appropriate to staff and customer roles.
• Secure software-development and change-management practices.
• Encryption for data in transit using current industry-standard transport security.
• Protected cloud/database access and network controls.
• Backups and restoration procedures proportionate to service criticality.
• Logging, monitoring and incident-response processes.
• Data minimisation and environment separation where appropriate.
• Vendor due diligence and contractual processor/subprocessor controls.
• Procedures for data-subject requests, deletion and security incidents.
• Staff confidentiality and security awareness.

Annex III — Approved Subprocessors

The following subprocessors are currently approved for processing Customer personal data on behalf of Menukits where relevant to the Service. Menukits may update this list in accordance with Section 6 of this DPA.

Stripe is used by Menukits for subscription billing and payment processing. Its role is described in the Menukits Privacy & Cookie Policy and is not listed here as a Customer-data subprocessor unless and to the extent Stripe processes personal data on behalf of Menukits in that capacity.