Data Processing Agreement

This Data Processing Agreement (“DPA”) is between:

• Flex Software Pty Ltd trading as Flex Catering (ABN 28 612 668 587), an Australian company (“Processor”), and
  
  
• Any client using Flex Catering’s platform who controls personal data under UK and EU GDPR (“Client” or “Controller”).

This DPA sets out the rules for how we handle personal data on your behalf, in line with Article 28 of the UK and EU General Data Protection Regulation (UK GDPR and EU GDPR).

1. Who Does What

• You are the Data Controller — this means you decide:
  • What personal data you collect,
  • Why you collect it, and
  • How you want it used.
    
• We are the Data Processor — this means we only handle your data:
  • Carried out by you,
  • To provide you with our platform and services.

2. Client Responsibilities

• The Client confirms that it is the Data Controller of the personal data processed using the Flex Catering platform.
• The Client is responsible for ensuring that all personal data provided to Flex Catering has been collected, stored, and processed lawfully, including obtaining any necessary consents from data subjects.
• The Client is responsible for managing data subject rights, such as handling requests for access, correction, or deletion of personal data.
• The Client agrees to use the Flex Catering platform and services only for lawful purposes and in compliance with applicable data protection laws.

2A. Assistance with Data Subject Rights
Where reasonably practicable and taking into account the nature of the processing, Flex Catering will assist the Client in responding to requests from data subjects to exercise their rights under applicable data protection laws (such as access, correction, or deletion requests). Flex reserves the right to recover any reasonable costs incurred in meeting these requirements.

3. What Data We Handle

We may process the following types of personal data on your behalf:

• Names
• Contact details like emails and phone numbers
• Delivery addresses
• Order details and history

The people whose data we handle are your customers or end users.

4. How We Protect Your Data

We commit to:

• Processing personal data only as carried out by you through the use of our platform and services.
• Keeping your data secure using appropriate technical and organisational measures.
• Ensuring that anyone on our team who accesses your data is bound by confidentiality.
• Notifying you promptly of any data breaches affecting your personal data.
• Implementing industry-standard technical and organizational security measures such as encryption, and regular security reviews.

5. Using Sub-Processors

• We may use trusted third-party service providers (“sub-processors”) to help deliver our services, such as hosting, communication, or analytics.
• We keep a list of these sub-processors available upon request.
• We ensure that all sub-processors follow data protection obligations no less strict than those in this agreement.

6. Data Transfers Outside the UK

We use sub-processors located in Australia and the United States. As a result, your personal data may be processed in these countries. We implement appropriate legal safeguards, including UK-approved Standard Contractual Clauses, to ensure your data is protected during international transfers.

7. Audits and Compliance

You may request information to verify our compliance. Audits may be conducted no more than once per year, with at least 30 days’ notice, remotely where possible. You will bear any costs associated with the audit, including those incurred by us to assist.

8. When This Agreement Ends

• This DPA stays in effect as long as you use our services.
• When you stop using our services, we will securely delete your personal data unless we are legally required to retain it.

9. Liability and Indemnity

9.1 Limitation of Liability
To the maximum extent permitted by law, Flex Catering’s liability under or in connection with this DPA is limited to direct damages up to the fees paid by the Client in the 3 months preceding the claim. Flex Catering is not liable for indirect, incidental, consequential, or punitive damages.

9.2 Indemnity
The Client agrees to indemnify and hold harmless Flex Catering against losses arising from the Client’s breach of this agreement or violation of data protection laws.

9.3 No Warranty
Flex Catering provides its services “as is” with respect to data processing and makes no warranties about data accuracy or outcomes, and does not guarantee uninterrupted or error-free service.

9.4 Force Majeure
Neither party is liable for failure to perform due to events beyond reasonable control.

10. Changes to this Agreement

We may update this Data Processing Agreement from time to time. The latest version will be published on our website. We may also notify clients of any material changes through our newsletter. It is your responsibility to review this page regularly to stay informed of any changes. Continued use of our services after updates constitutes your acceptance of the revised terms.

11. Governing Law

This agreement is governed by the laws of Queensland, Australia.

Last updated: 20 June 2025