Legal · Last updated 29 October 2026
Data Processing Agreement
How PrepHub handles personal data on behalf of the kitchens that sell on it, under Article 28 of the UK GDPR.
It forms part of the Partner Agreement. Data protection questions: privacy@prephubuk.co.uk.
1. Roles
PrepHub is the Partner's processor for the Partner's business records, and an independent controller for Customer accounts and running the Platform. This DPA's processor terms cover only the first column.
| PrepHub processes for the Partner (processor) | PrepHub's own data (controller) | The Partner's own data (controller) |
|---|---|---|
| The Partner's order, meal and payment records | Customer accounts, sign-in and security | Order details and allergies it uses to prepare and hand over meals |
| Staff accounts and access the Partner grants | Allergy and dietary data in Customer accounts | Copies it keeps outside the Platform (labels, prep sheets, its own records) |
| Internal notes and comments on Customers and Orders | Messages and reviews, as Platform records | Its marketing to its Customers |
| Customer invites and imports the Partner uploads | Email delivery records, fraud prevention, Platform improvement | Its tax and accounting records |
Where both are controllers of the same Customer data, each is responsible for its own compliance, and they will help each other with rights requests and breaches (Partner Agreement clause 6).
2. Processing details
| Item | Detail |
|---|---|
| Subject matter | Hosting and running the Partner's storefront, orders, payments records, staff access and customer notes on the Platform |
| Duration | The term of the Partner Agreement, plus the deletion period in clause 8 |
| Purposes | Taking and tracking Orders, recording payments, preparing labels and prep sheets, Customer messaging, reports and support |
| Nature | Collection, storage, organisation, retrieval, display, transmission by email, and deletion |
| Data subjects | The Partner's Customers, the Partner's staff, and people the Partner invites or imports |
| Personal data | Names, email addresses, phone numbers, delivery addresses, order history, payment amounts and status (no card numbers), messages and notes, staff sign-in records |
| Special category data | Allergies and dietary needs (health data), held only with the Customer's explicit consent |
The Partner must not upload other special category data, or data about children under 16, to the Platform.
3. PrepHub's duties as processor
When acting as processor, PrepHub will:
3.1 process the data only on the Partner's documented instructions, which are the Partner Agreement, this DPA and the Partner's use of the kitchen admin, unless the law requires otherwise (and then tell the Partner first where allowed);
3.2 tell the Partner if it believes an instruction breaks data protection law;
3.3 make sure everyone with access is bound by confidentiality, and limit access to PrepHub staff who need it for support, security or maintenance;
3.4 take the security measures in clause 5;
3.5 use sub-processors only as clause 4 allows;
3.6 help the Partner, taking into account what PrepHub can reasonably do, to answer data subject requests (access, correction, deletion, portability and objection), forwarding any request it receives about Partner data within 5 working days;
3.7 help the Partner with breach notices, data protection impact assessments and consultations with the ICO where they concern the Platform;
3.8 delete or return data at the end as clause 8 sets out; and
3.9 make available the information needed to show it meets these duties (clause 9).
4. Sub-processors
4.1 The Partner gives general authorisation for PrepHub to use the sub-processors below.
| Sub-processor | What it does | Data it receives | Location |
|---|---|---|---|
| Microsoft Azure (Microsoft Ireland Operations Ltd) | Hosts the website and application | All Platform data in transit | [PLACEHOLDER: Azure region, e.g. UK South] |
| Akamai / Linode (Akamai Technologies) | Managed database and file storage | All stored Platform data, uploaded photos and files | [PLACEHOLDER: data centre region] |
| Resend (Plus Five Five Inc.) | Sends order and account emails; receives email replies | Names, email addresses, email content | United States |
| Stripe (Stripe Payments UK Ltd) | Card payments, through the Partner's own connected account | Order amounts, Customer email, payment details | UK, EU and United States |
4.2 Lookup services, not sub-processors of Partner records: postcodes.io and OpenStreetMap Nominatim (address and postcode lookups) and Esri (map tiles) receive only the search text or map location a user enters or views.
4.3 PrepHub will put written terms in place with each sub-processor giving at least the same protection as this DPA, and stays responsible for their performance.
4.4 PrepHub will give at least 30 days' notice by email before adding or replacing a sub-processor. The Partner may object on reasonable data protection grounds; if the parties can't resolve it, the Partner may end the Partner Agreement at no cost before the change.
5. Security
PrepHub keeps appropriate technical and organisational measures in place, including:
- Encryption: all traffic over HTTPS; two-factor secrets encrypted at rest; passwords stored only as secure hashes. [PLACEHOLDER: confirm database and storage encryption at rest with Akamai.]
- Access control: two-factor sign-in required for all kitchen staff and PrepHub admins; staff see only their own kitchen's data; every admin page and API checks access on the server.
- Card data: card details are taken by Stripe and never reach PrepHub.
- Application security: signed session cookies, a Content Security Policy and security headers, limits on repeated sign-in attempts, and checks on redirects and uploads.
- Change control: code is reviewed, tested automatically before every deployment, and kept in version control.
- Backups: [PLACEHOLDER: database backup frequency and retention from Akamai].
- People: access limited to the Build Orbit team who need it, under confidentiality.
PrepHub may update these measures, but won't reduce the overall level of protection.
6. Personal data breaches
6.1 PrepHub will tell the Partner without undue delay, and within 48 hours, after becoming aware of a personal data breach affecting the Partner's data. This leaves the Partner time to meet its own 72-hour deadline to report to the ICO.
6.2 The notice will say, as far as known at the time: what happened, the categories and rough numbers of people and records affected, the likely consequences, what PrepHub has done or will do, and a contact. Information not yet known follows as it becomes available.
6.3 PrepHub will take reasonable steps to contain the breach and stop it happening again, and help the Partner tell the ICO and affected people where needed.
6.4 Each party bears its own costs of dealing with a breach, unless it was caused by the other party's breach of this DPA.
7. International transfers
7.1 PrepHub will only transfer the Partner's data outside the UK where the transfer is lawful under the UK GDPR, using one of:
- UK adequacy regulations (for example, the EEA, or US organisations certified under the UK Extension to the EU-US Data Privacy Framework);
- the ICO's International Data Transfer Agreement, or the EU Standard Contractual Clauses with the UK Addendum, backed by a transfer risk assessment.
7.2 Transfers today: email delivery (Resend, United States) and parts of payment processing (Stripe, United States). [PLACEHOLDER: confirm the safeguard each relies on from its current DPA.]
7.3 PrepHub will tell the Partner on request which safeguard covers each transfer.
8. Deletion and return
8.1 When the Partner Agreement ends, the Partner can export its order, customer and payment records from the kitchen admin for 30 days [PLACEHOLDER: export format, e.g. CSV].
8.2 Within 90 days after that, PrepHub will delete or anonymise the Partner's processor data, including from active systems, and from backups as they expire on their normal cycle.
8.3 PrepHub may keep data where the law requires it, kept secure and used for nothing else: order and payment records for 6 years for tax and accounting.
8.4 Data PrepHub holds as an independent controller, such as Customer accounts, stays with PrepHub under its Privacy Policy.
8.5 PrepHub will confirm deletion in writing on request.
9. Audits, liability and law
9.1 Information and audits: PrepHub will answer reasonable written questions about its compliance and share relevant summaries, such as this DPA's security measures and sub-processors' certifications. If that isn't enough, or the ICO requires it, the Partner may audit PrepHub once a year with 30 days' notice, during working hours, at the Partner's cost and under confidentiality.
9.2 Liability: each party's liability under this DPA is subject to the limits in the Partner Agreement (clause 9), except where the law doesn't allow it to be limited.
9.3 Changes: PrepHub may update this DPA to reflect changes in the law or ICO guidance, with 30 days' notice.
9.4 Order of precedence: on data protection, this DPA wins over the Partner Agreement.
9.5 Law: this DPA is governed by the law of Scotland, and the Scottish courts have exclusive jurisdiction.
PrepHub is run by Build Orbit Ltd, a company registered in Scotland (number SC905496). Registered office: 18 Sauchie Crescent, Kinglassie, Lochgelly, Scotland, KY5 0YZ.