Data Processing Addendum

1. Purpose and scope

This Data Processing Addendum (“DPA”) forms part of the Merchant Agreement between ClickMeats (“we”, “us”) and each partner butcher shop (“you”, “Shop”). It governs the handling of personal data exchanged between us in the operation of the Platform.

For clarity, ClickMeats is a marketplace and the Shop is the seller of record for the goods sold on the Platform. This DPA covers only the data-protection aspects of that relationship. Commercial obligations (food quality, preparation, hygiene, allergens, stock availability, collection) are governed by the Merchant Agreement.

It covers two distinct relationships under UK GDPR:

• Joint controllership in respect of customer Order data (Article 26); and
• Processor / controller relationship in respect of Shop operational data the Platform stores on the Shop’s behalf (Article 28).

2. Definitions

“UK GDPR”, “controller”, “processor”, “personal data”, “data subject”, “processing”, “personal data breach” and “special category data” have the meanings given in the UK General Data Protection Regulation.

“Customer” means an end-user of the Platform. “Order Data” means personal data relating to a Customer’s Order. “Shop Data” means personal data belonging to the Shop or its staff that ClickMeats holds on the Shop’s behalf.

3. Joint controllership — Order Data

3.1 What Order Data covers

The following categories are shared between ClickMeats and the Shop each time a Customer places an Order:

• Customer name;
• Customer contact phone number;
• Order items, notes, and cut preferences;
• Chosen collection time;
• Order total and payment status.

Card details are not part of Order Data — those are handled directly by Stripe under Stripe’s own privacy notice.

3.2 Purposes of processing

Both parties process Order Data for the purpose of:

• Fulfilling the Order (contract with the Customer under Art. 6(1)(b));
• Communicating with the Customer about their Order;
• Meeting our respective legal, tax, and food-safety obligations.

3.3 Apportionment of duties (Art. 26 essence)

3.4 Customer contact point (Art. 26(3))

Data subjects may exercise their rights against either party. However, we designate admin@clickmeats.co.uk as the single point of contact. If a data subject contacts you directly, forward the request to that address within 5 working days.

4. Processor relationship — Shop Data

Where the Platform stores or handles personal data on the Shop’s behalf — for example the Shop’s own staff names in the business dashboard, or an uploaded halal certificate that carries a certifier’s name — ClickMeats acts as a processor and the Shop is the controller.

For that data:

• We only process it on the Shop’s documented instructions (including as set out in this DPA and the Merchant Agreement);
• We ensure people authorised to process the data are under confidentiality obligations;
• We implement appropriate technical and organisational measures (see §7);
• We only engage sub-processors in accordance with §6;
• We assist the Shop in responding to data subject requests where reasonably practicable;
• We delete or return Shop Data at the end of the Merchant Agreement, subject to any legal retention obligations.

5. Legal bases and Customer rights

Order Data is processed under the lawful bases set out in our Privacy Policy — principally contract (Art. 6(1)(b)) for order fulfilment, legal obligation (Art. 6(1)(c)) for tax and food-safety records, and legitimate interests (Art. 6(1)(f)) for fraud prevention.

Neither party may process Order Data for direct marketing to Customers unless the Customer has separately opted in through the Platform.

6. Sub-processors

We use the following sub-processors to deliver the Platform. The current list is published at /legal/privacy under “Who we share your data with”.

We may add or replace sub-processors from time to time. We’ll update the published list and, where the change is material, notify Shops in advance. Shops may object to a new sub-processor on reasonable data-protection grounds by writing to admin@clickmeats.co.uk within 30 days; if we can’t reasonably accommodate the objection either party may terminate the affected part of the Merchant Agreement.

7. Security measures

We maintain technical and organisational measures appropriate to the risk of processing, including:

• TLS 1.2+ encryption for all data in transit;
• AES-256 encryption at rest for our databases and backups;
• Access control with individually-authenticated accounts and role-based permissions for customer, shop-owner, and admin surfaces;
• Secrets stored in AWS Secrets Manager, never in application code or logs;
• Regular software updates for platform components;
• CloudWatch logging and application status history for key operational events, including order status transitions and Stripe webhook processing;
• Automated backups with Point-in-Time Recovery on the primary database;
• A documented incident response process (see §8).

You are responsible for keeping your dashboard password confidential, using a strong password, and reporting immediately if you suspect unauthorised use of your account.

8. Personal data breaches

If either party becomes aware of a personal data breach affecting Order Data or Shop Data, that party must:

1. Notify the other party without undue delay and in any event within 24 hours of becoming aware;
2. Provide a description of the breach, the categories of data and data subjects affected, and the likely consequences;
3. Cooperate on containment, investigation, and remediation;
4. Cooperate on any notification to the ICO or affected data subjects.

ClickMeats coordinates any regulator-facing communication unless the breach is confined to the Shop’s own systems.

9. International transfers

Personal data is stored primarily in the United Kingdom (AWS eu-west-2 region). Where a sub-processor is established outside the UK/EEA, the relevant UK transfer mechanism must be confirmed and retained before launch or continued use (UK adequacy position, UK Addendum to the EU SCCs, or UK International Data Transfer Agreement, as applicable).

10. Return and deletion of data

On termination of the Merchant Agreement, and unless a longer retention period is required by law, contract, dispute handling, food-safety evidence, tax, or fraud-prevention obligations:

• We will remove or disable the Shop’s active marketplace listing and stop accepting new Orders for that Shop;
• We will delete or archive active Shop operational data where no longer needed to operate the Platform;
• We may retain uploaded certificates, merchant onboarding documents, contract records, and related audit evidence for the applicable retention period;
• We will retain the minimum Order records required for tax, consumer-law, dispute, fraud-prevention, and payment compliance for the applicable statutory / operational retention period;
• We will not use the retained Order records for any purpose other than compliance with the applicable obligation.

11. Audits and information

We will provide the Shop with sufficient information to demonstrate compliance with this DPA on reasonable request. Where a more detailed audit is required (e.g. to satisfy the Shop’s own regulator), we will cooperate in good faith to arrange one, subject to reasonable notice and confidentiality undertakings, and with cost-sharing agreed in advance.

12. Liability

The liability provisions of the Merchant Agreement §13 apply to this DPA. Nothing in this DPA excludes any liability that cannot lawfully be excluded, including for a data protection fine imposed personally on either party by the ICO.

13. Governing law

This DPA is governed by the laws of England and Wales and subject to the same jurisdiction clause as the Merchant Agreement.

14. Contact

Data protection matters: admin@clickmeats.co.uk

General enquiries: admin@clickmeats.co.uk