Data Processing Agreement

Last updated: 28 October 2026

This agreement forms part of the Gofood Terms of Service between Gofood.uk Online Ltd, trading as Gofood, a company registered in England and Wales (company number 12702164), whose registered office is at 240 Southwell Road East, Rainworth, Mansfield, England, NG21 0EQ ("Gofood", the processor) and the restaurant using Gofood (the "Restaurant", the controller). It meets the requirements of Article 28 of the UK GDPR.

1. What is processed

• Subject matter: running the Restaurant's online ordering, menu, order management, customer records, marketing and related features.
• People concerned: the Restaurant's customers and website visitors, and the Restaurant's staff who use Gofood.
• Types of data: names, email addresses, phone numbers, delivery addresses, order history, notes on orders (which may mention allergies or dietary needs), marketing preferences, and payment status (never full card details).
• Duration: for as long as the Restaurant uses Gofood, plus the return and deletion period in section 8.

2. Instructions

Gofood processes personal data only on the Restaurant's documented instructions, which are these terms and the settings the Restaurant chooses in its dashboard, unless the law requires otherwise. Gofood will tell the Restaurant if it believes an instruction breaks data protection law.

3. Confidentiality and security

Gofood makes sure that everyone allowed to access the data is bound by confidentiality, and keeps appropriate technical and organisational measures in place, including:

• encryption in transit and at rest with our hosting providers;
• separation of each restaurant's data by database security rules;
• access limited to staff who need it, with two-step verification for administrators;
• audited, time-limited access when Gofood staff log in to a restaurant account for support;
• card data handled only by Stripe, in line with PCI DSS;
• regular backups and monitoring for faults and misuse.

4. Sub-processors

The Restaurant gives general permission for Gofood to use the sub-processors below. Gofood will give at least 14 days' notice by email before adding or replacing one, and the Restaurant may object on reasonable data protection grounds. Gofood puts equivalent data protection terms in place with each sub-processor and remains responsible for them.

• Supabase: database, logins and file storage.
• Vercel: website and app hosting.
• Stripe: card payments (on the restaurant's own Stripe account) and Gofood's billing.
• Resend: sending order and account emails.
• Google (Maps Platform): address lookup, maps and delivery zones.
• Twilio: sMS messages and phone lines, when the restaurant uses them.
• Sentry: error monitoring, when switched on.

Stripe acts as a separate controller for payment data under its own agreement with the Restaurant.

5. International transfers

Where data is transferred outside the UK, Gofood ensures it is protected by UK adequacy regulations or the UK International Data Transfer Agreement or Addendum.

6. Helping the Restaurant

Gofood will help the Restaurant, taking into account the nature of the processing, to:

• answer customers' requests to see, correct, export or delete their data (the dashboard includes tools for this);
• keep the data secure, carry out data protection impact assessments and consult the ICO where needed.

If a customer contacts Gofood directly about their data, Gofood will pass the request to the Restaurant without delay.

7. Personal data breaches

Gofood will tell the Restaurant without undue delay, and in any case within 48 hours of becoming aware, of a breach affecting the Restaurant's data, with the information the Restaurant needs to meet its own duty to report it to the ICO within 72 hours.

8. End of the service

When the Restaurant closes its account, Gofood keeps the data available to export for 30 days and then deletes it, including from backups within a further 35 days, unless the law requires it to be kept.

9. Audits

Gofood will make available the information needed to show it meets this agreement, and allow reasonable audits by the Restaurant or its auditor, at most once a year with 30 days' notice, unless a breach or the ICO requires otherwise.

10. The Restaurant's responsibilities

The Restaurant confirms that it has a lawful basis for the processing, gives its customers a privacy notice (Gofood provides a starting draft), and gets any consent needed for marketing.

Contact

For data protection questions, email support@gofood.uk.