This Data Processing Agreement (“DPA”) forms part of the agreement between:
- The applicable member of the Flex Catering group identified as the service provider in the Proposal (“Flex” or “Processor”); and
- The entity or individual agreeing to the Terms of Service and using the Flex Catering platform (“Client”).
If the Proposal does not identify the applicable member of the Flex Catering group, the Processor will be Flex Software Pty Ltd trading as Flex Catering Software (ABN 28 612 668 587).
This DPA sets out how Flex processes personal data on the Client’s behalf. Where the UK GDPR or EU GDPR applies, this DPA is intended to meet the requirements of Article 28.
1. Roles and Instructions
The Client acts as the Data Controller or, where it processes personal data on behalf of another Data Controller, as a Data Processor. Flex acts as the Data Processor or sub-processor, as applicable, and processes personal data on the Client’s behalf.
Flex will process personal data only on the Client’s documented instructions, including as necessary to provide the Software and Services under the Terms of Service, the Proposal, the Client’s account configuration and the Client’s use of the platform, unless otherwise required by applicable law.
If the Client processes personal data on behalf of another Data Controller, the Client confirms that it is authorised to appoint Flex as a sub-processor, and the relevant provisions of this DPA will apply accordingly.
2. Client Responsibilities
The Client is responsible for:
- Ensuring that personal data provided to or processed through Flex Catering is collected and processed lawfully.
- Providing all required privacy notices and obtaining any necessary consents or other lawful basis.
- Ensuring that its instructions to Flex comply with applicable data-protection laws.
- Responding to requests from data subjects to exercise their rights
- Using the Software and Services only for lawful purposes.
- Having the necessary authority to instruct Flex to process personal data, including where the Client acts on behalf of another Data Controller.
2.1. Assistance with Data Subject Rights
Where reasonably practicable and taking into account the nature of the processing, Flex Catering will assist the Client in responding to requests from data subjects to exercise their rights under applicable data protection laws (such as access, correction, or deletion requests). Flex reserves the right to recover any reasonable costs incurred in meeting these requirements.
3. Processing Details
Purpose: Flex processes personal data to provide, operate, maintain, support, secure and improve the Software and Services in accordance with the Client’s instructions.
Duration: Personal data is processed for the duration of the Agreement. Following account suspension or termination, its retention and deletion will be handled in accordance with the Terms of Service, unless a longer period is required by law.
Data subjects may include:
- The Client’s employees, contractors and authorised users
- The Client’s customers, prospective customers and contacts
- Event attendees, delivery recipients, suppliers and other individuals whose information is entered into the platform
Personal data may include:
- Names, contact details and delivery addresses
- Login, account and user-access information
- Customer, order, event, delivery and venue information
- Billing and transaction information
- Communications, documents, images and uploaded content
- Account settings, operational information and reporting data
- AI prompts, messages, chat history and AI-generated responses
- Dietary, allergy or other sensitive information that the Client chooses to enter
- Any other personal data entered, uploaded or processed through the Service by or on behalf of the Client
Processing activities may include collecting, recording, organising, storing, accessing, retrieving, using, transmitting, displaying, supporting, securing and deleting personal data as necessary to provide the Software and Services.
Where the Client uses AI Features, processing may include retaining and using AI interactions and relevant operational information to provide, maintain, evaluate, improve and train FlexInsight in accordance with the Terms of Service and Privacy Policy.
4. Data Protection and Security
Flex will:
- Process personal data only in accordance with this DPA and the Client’s documented instructions, unless otherwise required by applicable law
- Notify the Client if Flex reasonably believes that an instruction violates applicable data-protection law, unless prohibited from doing so by law
- Ensure that personnel authorised to access personal data are subject to appropriate confidentiality obligations
- Maintain appropriate technical and organisational safeguards based on the nature of the processing and the risks involved, including access controls, TLS encryption in transit, backup and recovery measures, and regular security reviews
- Notify the Client without undue delay after becoming aware of a personal data breach affecting personal data processed on the Client’s behalf
- Provide reasonable assistance with security, breach-notification and data-protection impact-assessment obligations where required by applicable data-protection law
5. Sub-Processors
The Client provides general authorisation for Flex to engage third-party service providers and other members of the Flex Catering group as sub-processors where necessary to provide the Software and Services, including hosting, communications, analytics, payment-support and artificial-intelligence service providers.
Flex will:
- Maintain a list of its sub-processors and make it available to the Client upon request
- Require sub-processors to comply with data-protection obligations appropriate to the services they provide
- Remain responsible for its sub-processors’ compliance with the applicable obligations of this DPA
- Provide reasonable notice of any material new or replacement sub-processor where required by applicable data-protection law
The Client may raise a reasonable objection to a new sub-processor on legitimate data-protection grounds. The parties will work in good faith to address the concern.
6. International Data Transfers
Personal data may be stored, accessed or processed outside the country in which the Client or data subject is located, including in countries where Flex, its infrastructure, personnel, affiliated entities or sub-processors operate.
Flex will ensure that international transfers of personal data are made using a lawful transfer mechanism where required by applicable data-protection law.
Where the EU GDPR applies, this may include the European Commission’s Standard Contractual Clauses. Where the UK GDPR applies, this may include the UK International Data Transfer Agreement or the UK Addendum to the European Commission’s Standard Contractual Clauses.
7. Audits and Compliance
Upon reasonable written request, Flex will provide information reasonably necessary to demonstrate compliance with this DPA.
The Client may conduct an audit no more than once per year by providing at least thirty (30) days’ written notice. Audits must be conducted remotely where reasonably possible, during normal business hours, subject to appropriate confidentiality obligations, and without unreasonably disrupting Flex’s operations.
The Client is responsible for its audit costs and any reasonable costs incurred by Flex in assisting with the audit. Flex may satisfy an audit request by providing relevant policies, security documentation or independent assessment results where reasonably sufficient.
The frequency and notice restrictions do not apply where an audit is required by applicable law or a competent supervisory authority.
8. Termination and Data Deletion
This DPA remains in effect for as long as Flex processes personal data on the Client’s behalf.
Before account deactivation, the Client is responsible for exporting its personal data through the supported features of the Software. This export functionality provides the Client with the opportunity to retrieve its personal data before processing ends.
Following account suspension or termination, access to stored data and its subsequent retention and deletion will be handled in accordance with the Terms of Service. At the end of the applicable retention period, Flex will delete the personal data unless a longer period is required by law. Flex is not required to restore or provide access to data after account deactivation, except where required by applicable law.
9. Liability
Each party’s liability arising out of or in connection with this DPA is subject to the exclusions, limitations and liability cap set out in the Terms of Service.
This DPA does not create a separate or additional liability cap. Nothing in this DPA limits or excludes liability that cannot lawfully be limited or excluded.
10. Changes to this DPA
Flex may update this DPA in accordance with the amendment and notice provisions set out in the Terms of Service. Where required by applicable data-protection law, Flex will provide additional notice of any material change affecting the processing of personal data.
11. Governing Law
Except where applicable data-protection law or a binding international data-transfer mechanism requires otherwise, this DPA is governed by the governing-law and dispute-resolution provisions set out in the Terms of Service.
Last updated: September 2026
