DUMA

DUMA and GDPR

Last updated 31 October 2026

If you run a café, a shop or any business in the UK or Europe, the GDPR applies to the personal data you keep about your customers and staff. This page explains how DUMA fits in: what we do, what stays your responsibility, and the tools DUMA gives you. The legal terms are in the Data Processing Agreement.

Who is responsible for what

You decide what data to keep about your customers and staff and why, so your business is the controller. DUMA stores and processes that data only to run the service for you, so we are your processor. Our duties as processor are set out in the Data Processing Agreement, which is part of the Terms — you do not need to sign anything separately.

Where your data lives

  • Your workspace data is stored on a server in Manchester, United Kingdom.
  • A short list of providers helps us run the service — hosting, email, media storage, backups, analytics and AI. They are named in the Data Processing Agreement, and we give 30 days' notice before adding one.
  • You can keep website media in your own Cloudflare R2 or Vercel Blob storage instead of ours.

Tools DUMA gives you

  • Access requests — export a customer's data and their orders.
  • Erasure — erase a customer: their record is anonymised and their orders are kept without their identity, because you must keep financial records.
  • Former staff — anonymise an employee once their retention period has passed.
  • Marketing consent — recorded on each customer, so you only email the people who agreed.
  • Permissions — each member of staff sees only what their role allows; payroll and bank details stay with the people who need them.
  • Audit log — important actions are recorded with who took them and when.

How we protect it

  • Everything is encrypted in transit.
  • National Insurance numbers, bank details, payment and email credentials and connected-account tokens are also encrypted at rest.
  • The database has no public network route.
  • Card numbers never reach DUMA — your payment provider handles them.
  • We do not sell personal data or use it for advertising.

What stays with you

  • Telling your customers and staff how you use their data, in your own privacy notice.
  • Having a lawful basis for what you record, and a condition for health information such as allergies or fit notes.
  • Answering requests from your customers and staff — DUMA gives you the tools, and we will help if you ask.
  • Keeping data only as long as you need it.

What we are still improving

We would rather tell you than have you find out. Erasing a customer does not yet remove them from audit log entries or from copies of emails already sent. And some AI models behind the Ask DUMA assistant are offered free by their providers, who may retain prompts — so leave personal data out of an assistant request unless it is needed.

Questions

Write to [email protected]. For how we handle our own account holders' data, see the Privacy Policy.