Data Processing Agreement
How BlinkFix processes personal data on behalf of Enterprise organisations, suppliers, delivery companies and establishments.
Contents
1. Parties and scope
1.1 This Data Processing Agreement ("DPA") is between BlinkFix Ltd (company no. 13505930), 27 Old Gloucester Street, London WC1N 3AX, United Kingdom ("BlinkFix", the "Processor"), and the organisation, supplier or delivery company that has accepted the Enterprise Terms, or the business that has accepted the Merchant Terms (the "Customer", the "Controller").
1.2 It applies to personal data that BlinkFix processes on behalf of the Customer in providing BlinkFix Enterprise or an establishment's staff and integration tools (the "Customer Personal Data"). It forms part of, and is accepted together with, the Enterprise Terms or the Merchant Terms (the "Agreement").
1.3 It does not apply to personal data BlinkFix processes as a controller, which is described in the Privacy Policy. BlinkFix is a controller of, for example: (a) BlinkFix accounts; (b) customers' orders and payments; (c) billing, wallets, payouts and statements; (d) the delivery details of an order (name, address, phone, delivery code) and the records of deliveries, including deliveries by a delivery company; (e) a supplier order, including the buyer's delivery details; (f) car deposits, including claims, photos and BlinkFix's decisions; (g) the limited information BlinkFix gives a channel partner about the accounts it introduced; (h) its own check of the papers a delivery company uploads to be approved. When BlinkFix gives such data to a supplier, a delivery company or a channel partner so that it can do its part, that business receives it as a separate controller, for that purpose only, as the Fleet Terms, section 16 of the Enterprise Terms and the Channel Partner Terms say.
1.4 "UK GDPR", "EU GDPR" (Regulation (EU) 2016/679), "Data Protection Laws", "personal data", "processing", "controller", "processor", "data subject", "personal data breach" and "supervisory authority" have the meanings in the UK GDPR, the Data Protection Act 2018 and, where it applies, the EU GDPR.
2. Details of the processing
| Item | Description |
|---|---|
| Subject matter | Providing BlinkFix Enterprise and staff/integration tools under the Agreement |
| Duration | The term of the Agreement plus the deletion period in section 11 |
| Nature and purpose | Hosting, storing, organising, displaying, transmitting (chat, broadcasts, notifications, webhooks and integrations you enable), calculating (hours, bonuses, fees, sales), exporting, and processing with AI when a seat holder uses the AI assistant or imports a menu or product list. For a delivery company: storing its drivers' papers and shift records and reminding it before a paper runs out. For a supplier: storing its products, orders and invoices |
| Categories of data subjects | The Customer's seat holders, managers and staff; staff of establishments in the Customer's organisation; franchisees and their contacts; the Customer's business contacts and suppliers; customers of the Customer's establishments where the Customer enables contact sync or exports; for a delivery company, its drivers and dispatchers; for a supplier, its staff |
| Categories of personal data | Names, work email, phone, job titles and roles, establishment and region assignments, working hours and clock-in/out records and corrections, Establishment tablet access, bonuses and bonus payments, messages, files and document acceptances, access logs, push tokens and device names, contact details in imports, and customer name, email and phone where contact sync is enabled; for a delivery company, its drivers' names and contact details, driving licence, insurance and permit documents, vehicle details, shifts and working times; for a supplier, its staff's names and work email and the product and invoice data it enters |
| Special category data | None intended. The Customer must not put special category data (for example health data) into Enterprise unless strictly necessary and lawful |
| Frequency | Continuous |
3. Controller's instructions
3.1 BlinkFix processes Customer Personal Data only on the Customer's documented instructions, including with regard to international transfers, unless required to do otherwise by UK or EU law, in which case BlinkFix informs the Customer before processing unless that law prohibits it.
3.2 The Agreement, this DPA and the Customer's use and configuration of the service (including settings, integrations and actions of its admins) are the Customer's complete instructions. Further instructions must be in writing and consistent with the Agreement.
3.3 BlinkFix tells the Customer promptly if, in its opinion, an instruction infringes Data Protection Laws.
3.4 The Customer is responsible for the lawfulness of the processing it instructs, for having a lawful basis, and for giving data subjects the required information.
4. Confidentiality
BlinkFix ensures that everyone it authorises to process Customer Personal Data is bound by confidentiality and only accesses it as needed to provide the service, to support the Customer at its request, to handle reports and abuse, or to comply with the law.
5. Security
BlinkFix implements appropriate technical and organisational measures to protect Customer Personal Data (Article 32 UK/EU GDPR), including:
- encryption in transit (TLS) for all traffic, and encryption at rest provided by Google Cloud (our servers and database disks) and Cloudflare (files and backups);
- passwords and PINs stored only as hashes; integration secrets stored encrypted; API keys scoped and revocable; webhooks signed;
- access control by seat and role; staff access to production data limited to people who need it; logging of staff access to sensitive items;
- separation of customers' data by organisation in the application;
- rate limiting and abuse protection;
- daily backups of our database with continuous change logs, kept in a separate backup store for 7 days, and a process to restore them;
- regular review of the measures as the service changes.
The Customer is responsible for its own security, including seat management, keeping credentials and API keys secret, and securing systems it connects.
6. Sub-processors
6.1 The Customer gives BlinkFix general authorisation to engage the sub-processors in the Sub-processors list.
6.2 BlinkFix gives the Customer at least 30 days' notice of a new or replacement sub-processor by updating the list and emailing the Customer's admins or account owners. The Customer may object on reasonable data protection grounds within that period. The parties will discuss the objection in good faith; if it cannot be resolved, the Customer may end the affected service and receive a refund of prepaid fees for the remaining period.
6.3 BlinkFix imposes on each sub-processor data protection obligations that are no less protective than this DPA and remains responsible for their performance.
7. International transfers
7.1 BlinkFix's main hosting, including its database, is on Google Cloud in Frankfurt, Germany (EU). Database backups are kept in Cloudflare R2. BlinkFix's email server is in Canada. Some sub-processors, including the AI service, process data in the USA or elsewhere, as shown in the list.
7.2 Where Customer Personal Data is transferred outside the UK or the EEA to a country without an adequacy decision, BlinkFix ensures appropriate safeguards: the EU–US Data Privacy Framework and its UK Extension for certified recipients, or the European Commission's standard contractual clauses (Decision 2021/914, module 3 processor-to-processor or module 2 as applicable) with the UK International Data Transfer Addendum, together with a transfer risk assessment and supplementary measures where needed. A transfer to a country with an adequacy decision, such as Canada for commercial organisations, relies on that decision.
7.3 Where the Customer is in the EEA and BlinkFix (in the UK) receives Customer Personal Data, the transfer is covered by the European Commission's adequacy decision for the UK. If that decision ends, the standard contractual clauses (module 2, controller to processor) apply and are incorporated by reference, with Irish law and courts chosen for them, and the Customer's supervisory authority as the competent authority.
7.4 Customers outside the UK and the EEA. Where the Customer is outside the UK and the EEA (for example in the United Arab Emirates or the USA) and its law restricts sending personal data to the UK or to the countries in the Sub-processors list, the parties rely on this DPA and, where that law asks for more, on the standard clauses and the addendum named in 7.2 and 7.3, which the parties agree apply as far as that law allows.
8. Assistance
8.1 Data subject requests. BlinkFix, taking into account the nature of the processing, helps the Customer respond to requests from data subjects (access, correction, deletion, restriction, portability, objection), mainly through the service's features (admins can view, edit, export and remove data). If BlinkFix receives a request directly, it refers the person to the Customer and does not respond itself unless the Customer asks.
8.2 Impact assessments and consultation. BlinkFix provides reasonable information to help the Customer with data protection impact assessments and prior consultation with a supervisory authority.
9. Personal data breaches
BlinkFix notifies the Customer without undue delay, and in any event within 48 hours, after becoming aware of a personal data breach affecting Customer Personal Data, with the information the Customer reasonably needs to meet its obligations (nature of the breach, categories and approximate numbers, likely consequences, measures taken or proposed, and a contact point), updating it as more becomes known. BlinkFix takes reasonable steps to contain and remedy the breach. Notification is not an admission of fault.
10. Audits
BlinkFix makes available the information reasonably necessary to demonstrate compliance with this DPA and Article 28, including written answers to security questionnaires once a year. If that is not enough, or a supervisory authority requires it, the Customer may carry out an audit (itself or through an independent auditor bound by confidentiality) on at least 30 days' notice, during business hours, at most once a year, at its own cost, and without access to other customers' data.
11. Deletion and return
11.1 During the Agreement, admins can delete Customer Personal Data and export it (CSV and JSON exports, and through the API).
11.2 When the Agreement ends, the Customer has 30 days to export its data. BlinkFix then deletes Customer Personal Data within a further 30 days, including from active systems, unless UK or EU law requires it to keep it. Backups are kept for 7 days and then deleted on their normal cycle, and are not restored except for disaster recovery. On request, BlinkFix confirms deletion in writing.
11.3 Data about establishments on BlinkFix, their orders and their staff's personal BlinkFix accounts are not Customer Personal Data of the Enterprise Customer and continue under the Merchant Terms and the Privacy Policy.
12. Liability and precedence
12.1 Each party's liability under this DPA is subject to the limits in the Agreement.
12.2 If this DPA conflicts with the Agreement, this DPA prevails for the processing of Customer Personal Data. If the standard contractual clauses or the UK Addendum apply and conflict with this DPA, they prevail.
12.3 This DPA is governed by the law that governs the Agreement.
13. Contact
Privacy and data protection: [email protected] · BlinkFix Ltd, 27 Old Gloucester Street, London WC1N 3AX, United Kingdom.
Registration with the UK Information Commissioner's Office: applied for (application C2042936).
EU representative (Art. 27 GDPR)
BlinkFix's representative in the European Union under Article 27 of the EU GDPR is Michał Michalek, Poland (postal address on request at [email protected]), [email protected], +48 505 643 432. EU data subjects and supervisory authorities may contact the representative about BlinkFix's processing, including processing under this DPA.
14. Other countries' laws
14.1 EEA. Where the Customer is in Iceland, Liechtenstein or Norway, this DPA applies as it does for the EU, and "EU GDPR" includes the GDPR as it applies in the EEA.
14.2 United Arab Emirates. Where the UAE Federal Decree-Law No. 45 of 2021 regarding the Protection of Personal Data applies to Customer Personal Data, the Customer is the controller and BlinkFix is its processor, and sections 3 to 11 are BlinkFix's duties as processor under that law. Where the data protection law of the Dubai International Financial Centre or the Abu Dhabi Global Market applies, the same is true under that law. The parties rely on this DPA and section 7 for any transfer out of the UAE.
14.3 United States. Where a US state privacy law applies to Customer Personal Data (for example the California Consumer Privacy Act as amended by the California Privacy Rights Act), BlinkFix is the Customer's service provider or processor, and: (a) BlinkFix processes the Customer Personal Data only for the purposes in section 2 and on the Customer's instructions; (b) BlinkFix does not sell or share it (as the law defines those words); (c) BlinkFix does not keep, use or disclose it for any other purpose, or outside its direct business relationship with the Customer; (d) BlinkFix does not combine it with personal data it receives from other sources or collects itself, except as the law allows; (e) BlinkFix complies with that law and gives the same level of privacy protection; (f) the Customer may take reasonable steps (including under section 10) to make sure BlinkFix uses the data as this DPA says, and to stop and put right unauthorised use; (g) BlinkFix tells the Customer within 5 business days if it can no longer meet its obligations under that law.
14.4 If the data protection law of another country applies and asks for more than this DPA, the parties will agree in good faith what to add.