Last updated: 15 October 2026
This Data Processing Agreement ("DPA") forms part of the Terms of Service between Toque Manager Ltd ("Toque Manager", "we", "us", "Processor") and the business that has created a Toque Manager account ("you", "your business", "Controller").
It applies wherever Toque Manager processes Personal Data on your behalf as your Processor.
If there is a conflict between this DPA and the Terms of Service concerning the processing of Personal Data, this DPA takes priority.
Terms not defined in this DPA have the meaning given to them in the UK GDPR and the Data Protection Act 2018.
This DPA applies only to Personal Data contained in Customer Data that Toque Manager processes on your behalf as Processor.
It does not apply to Personal Data that Toque Manager processes as an independent Controller, such as personal data relating to account administration, billing, customer support, security and our own business operations. Those processing activities are described in our Privacy Notice.
The subject matter, duration, nature and purposes of processing, categories of Personal Data and categories of Data Subjects are set out in Annex 1.
As between the parties, you are the Controller and Toque Manager is the Processor in respect of Personal Data processed within Customer Data.
You are responsible for:
Toque Manager will process Personal Data only in accordance with this DPA and your documented instructions, except where processing is required by applicable UK law.
Where applicable law requires us to process Personal Data otherwise than on your instructions, we will, where legally permitted, inform you of that requirement before carrying out the relevant processing.
Toque Manager will:
Toque Manager will limit access to Personal Data to employees, contractors and other authorised persons who require access to provide, maintain, secure or support the service.
Those persons will be subject to confidentiality obligations appropriate to the nature of the Personal Data and their role.
Toque Manager will implement appropriate technical and organisational measures designed to protect Personal Data against:
The current technical and organisational measures are described in Annex 2.
We may update or replace individual security measures as the service develops, provided that such changes do not materially reduce the overall level of protection afforded to Personal Data.
You provide general written authorisation for Toque Manager to engage Sub-processors to process Personal Data in connection with providing the service.
Our current authorised Sub-processors are listed in Annex 3.
Before appointing a Sub-processor, we will require that Sub-processor to enter into appropriate data protection obligations concerning the relevant processing.
Those obligations will provide a level of protection appropriate to the nature of the processing and, where applicable, require the Sub-processor to comply with obligations equivalent to those imposed on Toque Manager under this DPA.
Toque Manager remains responsible to you for the performance of its Sub-processors' data protection obligations to the extent required by applicable law.
We will notify you of any intended addition or replacement of a Sub-processor that will have material access to Personal Data by updating Annex 3 and, where reasonably practicable, by email or in-app notification at least 14 days before the change takes effect.
If you reasonably object to the appointment of a new Sub-processor on material data protection grounds, you must notify us promptly.
We will consider the objection in good faith and work with you to address it where reasonably practicable. Where the objection cannot reasonably be resolved, you may terminate the affected service on reasonable notice.
Some Sub-processors may process Personal Data outside the United Kingdom.
Where an International Transfer is subject to the UK GDPR transfer requirements, Toque Manager will ensure that an appropriate lawful transfer mechanism and safeguard is in place.
Depending on the circumstances, this may include:
Details of the relevant transfer mechanism for each authorised Sub-processor are set out in Annex 3 where known.
We will provide reasonable further information about a particular transfer mechanism on request, subject to confidentiality and security requirements.
If a Data Subject makes a request concerning Personal Data that Toque Manager processes on your behalf, Toque Manager will, where legally permitted, promptly inform you.
Toque Manager will not normally respond directly to the Data Subject except:
Taking into account the nature of the processing, we will provide reasonable technical and organisational assistance to enable you to respond to Data Subject requests.
Where available, we may provide tools that allow you to access, export, correct or delete relevant Customer Data directly.
Toque Manager will notify you without undue delay and, where reasonably practicable, within 48 hours after becoming aware of a Personal Data Breach affecting Personal Data processed on your behalf.
The notification will include, to the extent reasonably available at the time:
We will provide further relevant information as it becomes reasonably available.
We will reasonably cooperate with you in relation to any notification you are required to make to the ICO or affected Data Subjects.
The 48-hour notification period does not mean that Toque Manager is required to establish all facts before notifying you. Initial notification may be supplemented as the investigation develops.
Taking into account the nature of the processing and information available to us, Toque Manager will provide reasonable assistance to help you comply with your obligations under Articles 32 to 36 of the UK GDPR.
This may include reasonable assistance relating to:
Where assistance requires material additional work outside the ordinary operation of the service, we may charge reasonable costs, provided those costs are agreed with you in advance where practicable.
Toque Manager will make available information reasonably necessary to demonstrate compliance with this DPA.
You may request relevant documentation no more than once in any 12-month period, except where:
Relevant information may include:
Where the information provided is insufficient to demonstrate compliance, you may conduct, or appoint an independent third-party auditor to conduct, an audit — including an inspection — subject to that auditor first agreeing to our reasonable confidentiality requirements.
Audits will:
You will bear your own audit costs unless otherwise required by applicable law or agreed in writing.
During the subscription period, you remain responsible for maintaining appropriate copies or exports of Customer Data where required for your own business continuity purposes.
When your subscription ends, Customer Data is not automatically deleted — it remains stored, with access limited to read-only food-safety records, until you either resume an active subscription or request deletion of your Kitchen.
You may export your Customer Data at any time before requesting deletion, using the export tools available in the service — these remain available even while your subscription is lapsed.
Deleting a Kitchen is a separate, explicit action, confirmed via a link sent to the Owner's own email, that is immediate and cannot be undone once confirmed. Before confirming it, you should export any Customer Data you need.
If a Kitchen's subscription remains lapsed and is never resumed or deleted, we will email the Owner a 15-day notice after 6 months of continued inactivity, with a direct link to download all Customer Data — including an Excel workbook and your uploaded photos and documents — and will automatically delete the Kitchen and all its Customer Data if nothing has changed by the end of that notice period — on the same basis as an explicit deletion request, and for the same reason: UK GDPR's storage-limitation principle doesn't permit us to keep Personal Data indefinitely once there is no ongoing purpose for processing it.
Once deletion is confirmed or automatically triggered, we will complete it within a reasonable period, subject to:
Backups containing Personal Data will be retained and overwritten or deleted according to the backup retention period described in our Privacy Notice and Annex 2.
Where law requires us to retain particular Personal Data, we will continue to protect it and limit processing to the purposes required by law.
Separately from the self-service tools above, you may at any time give us written instructions to delete or return a copy of specified Customer Data we hold on your behalf, and we will comply within a reasonable period, subject to the same exceptions listed above.
Nothing in this DPA limits or excludes any liability that cannot lawfully be limited or excluded, including liability for death or personal injury caused by negligence, fraud or fraudulent misrepresentation.
Subject to the above, and to the extent permitted by law, each party's total aggregate liability arising out of or in connection with this DPA — including in respect of a Personal Data Breach or any other failure to comply with the UK GDPR — will not exceed the greater of (a) £10,000, or (b) twice the total subscription fees paid by the Controller to the Processor during the 12 months immediately preceding the event giving rise to the claim. This cap is separate from, and does not reduce, the cap in section 11 of the Terms of Service, which continues to apply to claims not arising from this DPA.
This DPA does not transfer responsibility for compliance with Data Protection Legislation from the Controller to the Processor.
Neither party may assign this DPA except as permitted under the Terms of Service or applicable law.
This DPA forms part of the Terms of Service and may be updated in accordance with the Terms' own change process (see the Terms of Service's Changes section) — except that a change which would reduce the Controller's rights, or the Processor's obligations, under Articles 28 to 36 of the UK GDPR will only take effect with the Controller's agreement, and a change adding or replacing a Sub-processor follows section 7's own notice process instead.
If any provision of this DPA is found to be unenforceable, the remaining provisions will remain in effect.
This DPA is governed by the laws of England and Wales.
The provision of Toque Manager's kitchen-management software and associated services.
Processing will continue for the duration of the Controller's subscription and for the period necessary to return or delete Customer Data following termination, subject to section 13.
Processing may include:
Processing is carried out to provide the features described in the Terms of Service.
Depending on how the Controller uses the service:
Depending on the Controller's use of the service:
The service does not require the Controller to enter special category data.
If the Controller chooses to enter special category data, the Controller remains responsible for ensuring that an appropriate Article 9 condition and any other applicable legal requirements are satisfied.
The security measures currently implemented by Toque Manager include, where applicable:
Access to Personal Data is restricted to authorised personnel who require access to provide, maintain, secure or support the service.
Toque Manager maintains procedures for identifying, assessing and responding to security incidents and Personal Data Breaches.
Security measures are reviewed periodically and updated as the service, infrastructure and threat environment develop.
Current limitations, stated plainly rather than left open:
We will update this Annex as these move from gaps to implemented measures.
The following providers are currently authorised Sub-processors, subject to confirmation of their contractual and transfer arrangements:
| Sub-processor | Purpose | Location / transfer mechanism |
|---|---|---|
| Supabase | Database, authentication and file storage | London, United Kingdom (eu-west-2) — EEA/UK hosted; no international transfer for this sub-processor. |
| Vercel | Application hosting | Vercel Inc. (United States). Transfers out of the UK are made under Vercel's Data Processing Addendum, which incorporates the UK Addendum to the EU Standard Contractual Clauses. |
| Stripe | Subscription billing and payment processing | Stripe Payments UK, Limited and Stripe Payments Europe, Limited (Ireland), with underlying infrastructure operated globally by Stripe, Inc. (United States). Transfers are made under Stripe's Data Processing Agreement, incorporating the UK Addendum to the EU Standard Contractual Clauses. |
| Anthropic | AI-assisted invoice, recipe and allergen processing | Anthropic, PBC (United States). Transfers are made under Anthropic's Data Processing Addendum, incorporating the UK Addendum to the EU Standard Contractual Clauses. |
| Resend | Account, invitation and password-reset emails; account-deletion confirmation and inactivity-warning emails | Plus Five Five, Inc. (Resend), San Francisco, United States — primary processing takes place in the United States. Transfers are made under Resend's Data Processing Agreement (EU Standard Contractual Clauses plus the UK Addendum); Resend also participates in the EU-U.S. Data Privacy Framework and its UK extension. |
Toque Manager will maintain this list and notify customers of material additions or replacements in accordance with section 7.
Where a provider processes Personal Data as an independent Controller rather than as a Sub-processor, that processing is outside the scope of this DPA and is described, where applicable, in the provider's own privacy documentation and our Privacy Notice.