This Data Processing Addendum (the “DPA”) forms part of the Terms of Service between Online Marketing Solutions Ltd, trading as Octopus Menu, a company registered in England and Wales (company number 11903083) (“Octopus Menu”, “we”, “us”) and the business that holds an account on the platform (the “Customer”, “you”). It applies automatically when you accept the Terms, without needing a signature, and lasts for as long as we process Customer Personal Data.
1. Definitions
Words defined in the Terms have the same meaning here. In addition: “UK GDPR” and “EU GDPR” have their usual meanings; “Data Protection Law” has the meaning in the Terms; “controller”, “processor”, “data subject”, “personal data”, “processing” and “personal data breach” have the meanings given in the UK GDPR; “Customer Personal Data” means personal data we process on your behalf in providing the Service, as described in Annex 1; and “Sub-processor” means a third party we engage to process Customer Personal Data.
2. Roles
2.1 You are the controller of Customer Personal Data, and we process it as your processor. Where you act as a processor for another controller, you confirm that you have that controller’s authority for our processing, and you remain our only point of contact.
2.2 We are a controller, not a processor, of the personal data of your users and account contacts, billing records, and visitors to our own websites, and of information we process to secure the Service and prevent abuse. Our Privacy Policy covers that processing.
3. Your obligations as controller
3.1 You are responsible for your compliance with Data Protection Law as controller. In particular you will:
- have a lawful basis for all Customer Personal Data you collect through the Service and for each purpose you use it for;
- give Diners the information Data Protection Law requires. We provide a standard diner privacy notice, shown with your business name and contact details on your menu, which you may adopt; you are responsible for checking that it is accurate and complete for your business, and for adding to it where you use Diner Data in other ways;
- obtain any consent required, including for marketing emails to the Diners on your email list and for any analytics or advertising tags you add to your menu, and use contact details only for the purpose they were given for (for example, contact details left with feedback only to reply to that feedback);
- respond to requests from Diners exercising their rights, and to complaints and enquiries from Diners and regulators;
- make sure that the people you give access to your Account are authorised, trained and bound by confidentiality, and that they use Diner Data only for your lawful purposes;
- be responsible for every communication you send to Diners and for anything you do with Diner Data outside the Service, including data you export;
- not ask Diners for special category data (such as health information) or data about children through the Service, and not put Customer Personal Data into the Service that it was not designed for; and
- carry out any data protection impact assessment, keep any records and make any notifications to regulators or Diners that Data Protection Law requires of a controller.
3.2 Your instructions to us must comply with Data Protection Law. You confirm that our processing in accordance with your instructions will not breach Data Protection Law or anyone’s rights.
4. Our obligations as processor
4.1 Instructions. We will process Customer Personal Data only on your documented instructions, unless UK law (or, where the EU GDPR applies, EU or Member State law) requires otherwise, in which case we will tell you first unless that law forbids it. Your instructions are the Terms and this DPA, your configuration and use of the Service, and any other written instructions we agree. We will tell you promptly if, in our opinion, an instruction infringes Data Protection Law, but we are not obliged to review your instructions for legal compliance.
4.2 Confidentiality. We will make sure that people we authorise to process Customer Personal Data are bound by a duty of confidentiality.
4.3 Security. We will implement and maintain appropriate technical and organisational measures to protect Customer Personal Data, including those in Annex 2. We may update them as long as the overall level of protection does not fall.
4.4 Assistance with Diners’ rights. The Service gives you tools to meet Diners’ requests: you can see and export your email subscribers and loyalty card members and delete a loyalty card member; Diners can delete their own loyalty card; and feedback contact details are cleared automatically (Annex 1). To remove an email subscriber or to answer a request the tools do not cover, contact support@octopusmenu.com and we will help. Where the tools are not enough, we will give you reasonable help with requests from Diners and any other data subjects, taking into account the nature of the processing. If a data subject contacts us about Customer Personal Data, we will promptly forward the request to you or direct them to you, and will not otherwise respond unless the law requires us to.
4.5 Other assistance. Taking into account the nature of the processing and the information available to us, we will give you reasonable help with your security obligations, your obligations to notify personal data breaches, data protection impact assessments and prior consultation with a regulator, in each case relating to our processing (Articles 32 to 36 of the UK GDPR). We may charge for help that goes beyond providing the Service and the information in this DPA.
5. Sub-processors
5.1 You give us general written authorisation to engage Sub-processors. The current list, with what each one does, what data it processes and where, is on our sub-processors page.
5.2 We will update the sub-processors page at least 14 days before a new Sub-processor starts processing Customer Personal Data. You can object to a new Sub-processor on reasonable data protection grounds by emailing legal@octopusmenu.com within that period. We will then discuss your concerns in good faith; if we cannot resolve them, your sole remedy is to close your Account (or stop using the feature concerned) before the change takes effect, and we will refund any Fees prepaid for the period after closure.
5.3 We will put in place a written contract with each Sub-processor that imposes data protection obligations that give an equivalent level of protection to this DPA, to the extent applicable to the service it provides. We remain responsible to you for our Sub-processors’ performance of those obligations, as Data Protection Law requires and subject to section 10.
6. Personal data breaches
6.1 We will notify you without undue delay after becoming aware of a personal data breach affecting Customer Personal Data. We aim to do so within 72 hours of becoming aware of it. We will send the notice to the account owner’s email address.
6.2 The notice will describe, as far as we then know, the nature of the breach, the categories and approximate numbers of Diners and records concerned, its likely consequences and the measures taken or proposed. Where we cannot give all of this at once, we will give it in stages as it becomes available. We will take reasonable steps to contain the breach and reduce its effects.
6.3 As controller, you are responsible for deciding whether to notify a regulator or affected Diners and for doing so. Our notice of a breach is not an admission of fault or liability.
7. International transfers
7.1 We host the Service in the United Kingdom (application servers in London) and store its database in the European Union (Ireland). Some Sub-processors process data in other countries, including the United States, as shown on the sub-processors page.
7.2 We will make a transfer of Customer Personal Data out of the UK (or, where the EU GDPR applies to you, out of the European Economic Area) only where it is permitted by Data Protection Law, for example to a country with an adequacy decision or adequacy regulations, to a recipient certified under the UK Extension to the EU-US Data Privacy Framework, or under the International Data Transfer Agreement or the International Data Transfer Addendum to the EU Standard Contractual Clauses issued by the UK Information Commissioner, or the EU Standard Contractual Clauses, as applicable. You authorise us to enter into those safeguards with Sub-processors on your behalf where needed.
8. Audits and information
8.1 We will make available to you the information reasonably necessary to demonstrate our compliance with Article 28 of the UK GDPR (and, where it applies, the EU GDPR), including this DPA, our sub-processors page, a description of our security measures and reasonable answers to a written security questionnaire, no more than once in any 12-month period unless a regulator requires otherwise.
8.2 If that information is not enough to demonstrate our compliance, we will allow and contribute to an audit or inspection by you or an independent auditor you appoint who is bound by confidentiality. A routine audit needs at least 30 days’ written notice, takes place during normal business hours, no more than once in any 12-month period, and is at your cost. The notice and frequency limits do not apply after a personal data breach affecting Customer Personal Data, where you have reasonable evidence of our material non-compliance, or where a regulator requires the audit. Every audit is carried out so as to minimise disruption to the Service and to protect other customers’ data.
9. When processing ends
9.1 While your Account is open you can export Customer Personal Data using the tools in section 4.4, and if you ask us before your Account closes we will give you a copy of the rest of it in a commonly used format. When your Account closes, we will delete Customer Personal Data within 30 days, unless UK law (or, where it applies, EU or Member State law) requires us to keep it, or we need it to establish, exercise or defend legal claims, in which case we keep only what is needed, restrict access to it and delete it when the need ends. This deletion is your instruction to us. Copies in backups are protected, are not used in the ordinary course, and are deleted as those backups expire.
10. Liability
10.1 Each party’s liability arising out of or in connection with this DPA is subject to the exclusions and limits of liability in the Terms, and our liability under this DPA counts towards the overall limit in the Terms. This does not limit either party’s liability to Diners under Data Protection Law. Your indemnity in the Terms covers claims arising from your breach of this DPA or of Data Protection Law as controller.
11. General
11.1 This DPA is governed by the law, and subject to the jurisdiction of the courts, set out in the Terms, except where Data Protection Law or a transfer safeguard requires otherwise. We may update this DPA as described in the Terms, including to reflect changes in Data Protection Law or guidance. Questions: privacy@octopusmenu.com.
Annex 1: Details of the processing
- Subject matter and duration: providing the Service to you, for as long as your Account is open and until Customer Personal Data is deleted under section 9.
- Nature of the processing: collecting, recording, storing, organising, displaying, sending, exporting, erasing and otherwise processing data as needed to run the Service, including sending emails you or Diners trigger.
- Purpose: to provide the Service’s Diner-facing features on your behalf: your menu, your feedback form, your loyalty card, your email list and your menu analytics.
- Data subjects: Diners who use your menu and its features; your staff named in data you enter (for example, the team member behind a loyalty correction).
| Data | What it is | How long it is kept |
|---|---|---|
| Private feedback | The rating and comment a Diner leaves on your feedback form, the menu they were reading, your team’s notes on it, and, if the Diner chooses to give them, their name, email address and phone number. If the menu was opened from a table’s QR code, the table number. | Name, email, phone and table number are cleared 90 days after the feedback is sent. The rating, comment and notes are kept while your Account is open. |
| Loyalty card members | The first name and email address a Diner gives to join your loyalty card, and the card’s history of stamps added or removed and rewards used, with dates. | First name and email are erased after 12 months without a stamp, when the Diner or you delete the card, or when your Account closes. The history is kept without them. |
| Email subscribers | The email address of a Diner who signs up for your news and offers, and when they did so. | Until the Diner unsubscribes or your Account closes, whichever is first. |
| Visit and table data | The table a Diner’s visit started from (in a cookie on their phone), and a random identifier that recognises a return visit to your menu (in a cookie on their phone). | The table: 4 hours. The return-visit identifier: 30 days. Neither is stored on our servers. |
| Menu analytics | Only with the Diner’s consent: scans, menu and dish views and language changes, with the browser’s user agent, an approximate country and a random visit identifier. It is not linked to a named Diner. | Free plan: 7 days. Essential: 90 days. Growth: while the account is open. |
| Technical data | IP address and browser details sent with each request, used to deliver pages, prevent abuse and keep the Service secure. | Kept only as long as needed for those purposes. |
| Review text for reply drafts | Text of a public review, which may include the reviewer’s name, that you paste into the reply helper to get a draft reply. | Not stored by us: sent to the model provider to produce the draft. |
| Content sent to other AI Features | Menu files and photos you upload for AI menu import, menu text sent for translation, and dish details used to generate images. They are not meant to contain personal data, but may incidentally (for example, a name on a photographed menu). | Sent to the model provider listed on the sub-processors page to produce the result; what you keep becomes part of your menu. |
Special categories: the Service is not designed to collect special category data, and you must not ask Diners for it. A Diner may choose to mention, for example, an allergy or a health condition in free-text feedback. That text is processed only as part of the feedback; as controller you are responsible for having a lawful basis and condition for keeping it, or for deleting it, and we will help you delete it on request.
Annex 2: Security measures
- All connections to the Service are encrypted in transit with HTTPS (TLS); plain HTTP is redirected.
- The database and file storage are encrypted at rest by our hosting providers.
- Each customer’s data is separated at the database level by row-level security, so a request on behalf of one account cannot read or change another account’s data.
- Passwords are handled by our authentication provider and are never stored by us in readable form. Sign-in cookies cannot be read by page scripts.
- Staff access to the administration console requires multi-factor authentication, and administrative access to customer accounts is logged and time-limited.
- Sign-in, feedback, loyalty and similar public endpoints are rate-limited to resist automated abuse.
- Loyalty staff codes are stored encrypted, and loyalty card links are signed and can be revoked.
- Personal data is deleted or anonymised automatically when its retention period ends (Annex 1), and data subject to a legal hold is preserved until the hold is released.
- Access to production systems is limited to the people who need it to run and support the Service.
Annex 3: Sub-processors
See the sub-processors page, which forms part of this DPA.