DUMA

Data Processing Agreement

Last updated 1 November 2026

This agreement forms part of the Terms of Service between Marian Dudych, trading as DUMA, a self-employed sole trader of 67B Harringay Road, London, N15 3HU, United Kingdom (“DUMA”, “we”), and the business that holds a DUMA workspace (“the business”, “you”). It applies whenever we process personal data on your behalf, and sets out the terms required by Article 28 of the UK GDPR and the EU GDPR. Using a workspace means accepting it; no signature is needed.

1. Roles

For the personal data you put into your workspace, you are the controller and DUMA is your processor. For our own account holders' sign-in details and our service emails, DUMA is the controller, as described in the Privacy Policy.

2. What we process

  • Subject matter and duration — providing the DUMA service, for as long as your workspace exists, and then until the data is returned or deleted under section 9.
  • Nature and purpose — storing, organising, displaying and transmitting data so that you can take orders and payments, run the kitchen, manage stock, staff, customers and content, and report on them.
  • Data subjects — your staff, your customers, guests who order by QR code or book a table, people who submit your forms, and people named in your notes and content.
  • Personal data — contact details, dates of birth and addresses; order, loyalty and booking history; marketing consent; staff records such as shifts, timesheets, leave, pay rate, tax code, National Insurance number, bank details and employment documents; and anything you write into notes or content.
  • Special category data — only what you choose to record, such as allergies and dietary needs or fit notes, which can reveal health information. You are responsible for having a condition for processing it.

3. Your instructions

We process personal data only on your documented instructions. This agreement, the Terms and the way you configure and use your workspace are those instructions. If we are required by law to process it otherwise, we will tell you first unless the law forbids it. If we believe an instruction breaks data protection law, we will tell you.

4. Confidentiality

Anyone at DUMA who can access your personal data is bound by confidentiality, and accesses it only to provide, support or secure the service.

5. Security

We take appropriate technical and organisational measures, including:

  • Encryption of all data in transit.
  • Encryption at rest of National Insurance numbers, bank account details, payment provider credentials, email server passwords and connected-account tokens.
  • A database with no public network route, on a server hosted in the United Kingdom.
  • Access inside a workspace limited by the permissions you assign to each member of staff.
  • An audit log of important actions, with who took them and when.
  • Passwords stored only as a one-way hash.

6. Subprocessors

You authorise us to use the subprocessors below. Each is bound by written terms that protect personal data to the same standard as this agreement, and we remain responsible to you for their work.

  • Hostinger — the server and database that run DUMA, in Manchester, United Kingdom; and the email service that sends account emails such as password resets.
  • Vercel — hosts the web app, and stores images added to notes and email templates.
  • Cloudflare — stores media for website content, unless you connect your own storage.
  • GitHub — stores encrypted database backups.
  • PostHog (EU region) — product analytics on how the app is used. Session recording is off and on-screen text is masked; it receives the signed-in user's name and email, not your customers' data.
  • Google (Gemini) and OpenRouter — AI models for the Ask DUMA assistant and content tools. They receive only the request a user makes and the data needed to answer it.

Services you connect yourself — payment providers such as Stripe, SumUp or Square, your own email server, your own storage bucket, or a user's Google Drive — act on your instructions under your own agreement with them, not as our subprocessors.

We will tell you at least 30 days before adding or replacing a subprocessor, by email to the workspace owner and on this page. You may object on reasonable data protection grounds; if we cannot address the objection, you may close your workspace before the change takes effect.

7. International transfers

Your workspace data is stored in the United Kingdom. Some subprocessors process data outside the UK and EEA; where they do, we rely on adequacy decisions, or on the UK International Data Transfer Addendum and the EU standard contractual clauses.

8. Helping you meet your obligations

  • Requests from individuals — DUMA lets you export customer data and orders, correct records, handle access and erasure requests, and anonymise former employees after their retention period. If a request reaches us directly, we will pass it to you without undue delay and not answer it ourselves.
  • Personal data breaches — we will notify you without undue delay after becoming aware of a breach affecting your data, with what we know about its nature, likely consequences and the measures taken, and keep you updated as we learn more.
  • Impact assessments — we will give you the information we reasonably can for a data protection impact assessment or a consultation with a supervisory authority.

When a customer is erased, their record is anonymised and their orders are kept without their identity, because financial records must be retained. Audit log entries and copies of sent emails are not yet removed by erasure; we are working to close that gap.

9. When the service ends

You can export your data while your workspace is open. When it closes, we will delete or return the personal data we process for you, at your choice, unless the law requires us to keep it. Encrypted backups expire on their normal cycle.

10. Information and audits

We will make available the information reasonably needed to show that we meet this agreement, and answer your written questions about it. Where that is not enough, we will allow and contribute to an audit by you or an auditor you appoint who is bound by confidentiality, on reasonable notice, during working hours, and no more than once a year unless a supervisory authority requires it or a breach has occurred.

11. Liability and order of precedence

Each party's liability under this agreement is subject to the limits in the Terms. If this agreement and the Terms conflict on the protection of personal data, this agreement wins.

Contact

Questions about this agreement, or to object to a subprocessor: [email protected]. See also DUMA and GDPR.