1. What these terms cover
These data processing terms are part of our terms of service. They apply when Primus Tech Services Limited ("Hutay") processes personal data for a restaurant ("you") under the UK GDPR, the EU GDPR and the Data Protection Act 2018.
You are the controller and Hutay is your processor.
2. The processing
| Subject matter | Running your online ordering, QR table ordering, till, kitchen screen, table bookings and customer accounts |
| Duration | For as long as you use Hutay, then until the data is deleted or returned |
| People | Your customers and the people who book tables with you |
| Data | Names, email addresses, phone numbers, delivery addresses and map positions, delivery notes, orders and payment status, booking details, and customer accounts at your restaurant |
| Special categories | None are asked for. Customers may write allergy or dietary needs in order or booking notes; we handle these only to pass them to you |
3. What Hutay promises
- We process the data only on your documented instructions, which are these terms and how you set up and use Hutay, unless the law requires otherwise, in which case we tell you first where we may.
- Everyone at Hutay who can reach the data is bound to keep it confidential.
- We keep appropriate security measures in place (section 4).
- We help you answer requests from people using their rights, and with security, breach notices, impact assessments and consultations with regulators, as far as we reasonably can.
- We tell you without undue delay, and within 48 hours of becoming aware, if there is a personal data breach affecting your data.
- When you leave, we delete your customers' data within 90 days, or hand it back first if you ask, unless the law requires us to keep it.
- We give you the information you need to show that these duties are met, and allow reasonable audits with 30 days' notice, no more than once a year unless a regulator requires it.
4. Security measures
- All connections are encrypted in transit.
- Passwords and staff PINs are stored only as one-way scrambled values; payment and email keys are stored encrypted.
- Every read and write is limited to your own restaurant, and this is tested on every change before it goes live.
- Access to the live database is limited to the people who run Hutay.
- Sign-ups and sign-ins are rate-limited against abuse.
5. Sub-processors
You agree that we may use these sub-processors:
| Sub-processor | Purpose | Location |
|---|---|---|
| Render Services | Servers | Frankfurt, Germany |
| MongoDB (Atlas) | Database | Frankfurt, Germany |
| Cloudflare | Website delivery, protection, photo storage | Cloudflare's network |
| Resend | Emails to your customers, when switched on | Ireland, run by a US company |
Card payments go through your own Stripe account under your contract with Stripe, so Stripe is not our sub-processor for them.
We give you at least 30 days' notice by email before adding or replacing a sub-processor. If you object on reasonable data protection grounds and we cannot resolve it, you may end the agreement. Each sub-processor is bound by data protection duties at least as strong as these, and we remain responsible to you for them.
6. Transfers outside the UK and EU
Where data goes outside the UK or EU, we protect it with the UK International Data Transfer Addendum and the EU Standard Contractual Clauses, or rely on the receiver's certification under the EU-US Data Privacy Framework and its UK extension.
7. What you promise
You make sure you have a lawful basis to collect your customers' data and that your own privacy notice tells them about it, including that Hutay runs your ordering.
8. If terms conflict
If these data processing terms and the terms of service ever disagree about personal data, these data processing terms win.