Data Processing Agreement

1. What this is

This agreement is part of the Terms of Service between BakeFleet LLC ("BakeFleet", "we", "us") and the bakery ("you"). It applies automatically when you accept the terms. Nothing needs to be signed.

It covers the personal data we handle on your behalf. If it conflicts with the terms, this agreement wins on how that personal data is handled. Everything else in the terms applies to this agreement too.

The limits on liability in section 14 of the terms apply to this agreement. Claims under this agreement and claims under the terms count together toward the single cap in that section. This agreement does not create a separate or additional cap.

This agreement is between you and us only. Your customers, staff and drivers have no rights under it.

2. Who is who

For the personal data your customers give you, such as their name, email, delivery address and order history, you are the controller and we are the processor. You decide what to collect and why. We hold and process it on your instructions, which in practice means operating the software you are using. Where a privacy law uses different words, you are the "business" and we are your "service provider".

Your instructions to us are the terms, this agreement, and the way you configure and use the service. If we believe an instruction breaks the law, we will tell you.

For your own account data, such as your name, login, billing details and how you use the product, we are the controller. That relationship is covered by our privacy policy.

3. What we process, and why

Whose data. Your customers, people who receive an order or delivery from you, and the staff and drivers you invite.

What data.

• Identity and contact — name, email address, and the delivery address on an order, so an order can be taken and delivered.
• Order data — what was ordered, when, for which date, what was actually handed over, and any notes attached to the order.
• Payment metadata — the card brand, its last four digits, and identifiers from the payment processor. Full card numbers do not reach our servers.
• Messaging data — where you use text messaging, the phone numbers you send to and the content of those messages, their delivery status, and records of consent and opt-outs.
• Delivery data — geocoded addresses, routes and delivery status.
• Technical data — session cookies, and IP addresses in server logs, for security and abuse prevention.

Why. We process this data to run the service for you, to keep it secure, to prevent fraud and abuse, to find and fix faults, and to comply with law. We may also produce aggregated, de-identified statistics as described in section 8 of the terms.

We do not sell it. We do not share it with advertising platforms, and we do not advertise to your customers. Our own advertising and analytics tags are not placed on your storefront or checkout pages. We do not use one bakery's customer data to benefit another. We do not keep, use or disclose it for any purpose other than those above, and we do not combine it with personal data from other sources except where the law allows a service provider to do so. If we find we can no longer meet these obligations, we will tell you.

4. Your side

As controller, you are responsible for the following.

• Having the right to collect your customers' data and to give it to us, including any contacts you import.
• Giving your customers the privacy notice the law requires, and getting any consent the law requires, including consent for marketing emails and texts.
• Making sure your instructions to us are lawful.
• Keeping sensitive data out of the service. Do not use it to collect government ID numbers, financial account numbers, health information or data about children. Keep order notes to what you need to fulfil the order.
• Answering your customers' requests about their data, and deciding who to notify after a breach.
• Any tracking tags, pixels, scripts or integrations you add to your storefront, including the notices and consents they need. Data they collect goes to your providers, not to us, and is outside this agreement.
• Securing your own accounts, devices and exported files.

Section 15 of the terms (indemnity) applies to claims that arise because you did not meet these responsibilities.

5. Isolation between bakeries

The service is built so that every bakery's data is scoped to that bakery at the database level, and uploaded files are stored under a per-bakery prefix. It is designed so that another bakery on the platform cannot read your customers, orders or settings. This is enforced in code rather than by convention, and it is checked by automated tests that run before each release.

Some storefront content, such as your products and business details, is public by design.

6. Sub-processors

You authorise us to use third-party providers to run the service. Each is engaged under written data protection terms no less protective than this agreement, and each may process your customers' personal data only to deliver the function it is listed for. Any liability we have in connection with a provider is subject to the limits on liability in section 14 of the terms.

Each is listed below by function and by the data it handles. We do not publish the providers' names: a list of exactly which suppliers hold a platform's data is also a list of which supplier to phish, whose breach notices to watch and whose support desk to social-engineer. The categories are specific so this section still tells you what leaves the platform and why.

Payments. Your customers' payments are processed under your own account with the payment processor named in the terms, and your own agreement with it. Card details go directly from your customer to that processor. For those payments it is your provider, not our sub-processor.

7. Security

We maintain reasonable technical and organisational measures to protect your customers' data. Those measures currently include the following.

• Traffic is encrypted in transit, including on custom domains.
• Passwords are hashed, never stored recoverably, and affiliate partner payout details are encrypted at rest.
• Card details are handled by the payment processor and are not stored on our servers.
• Phone numbers and message content are encrypted at rest.
• Administrative access to the platform requires a second factor.
• Actions taken by platform staff on a bakery's account are recorded in an audit log, including support access.
• People with access to your customers' data are bound by confidentiality obligations.

We may change these measures as long as the overall level of protection does not fall. No system is perfectly secure. This section describes our practices; it is not a promise that an incident will never happen.

8. Your customers' rights

Because you are the controller, requests from your customers for access, correction, deletion or a copy of their data come to you. The software gives you what you need to answer them: customer records are visible and editable in your admin, and orders and customers export as CSV.

If such a request reaches us directly and we can tell which bakery it concerns, we will not action it ourselves. We will pass it to you promptly and give you reasonable help to respond. If you need help beyond what the software already lets you do yourself, we may charge a reasonable fee, which we will tell you first.

9. Retention and deletion

We hold your data for as long as your account is open. When an account is cancelled or terminated, data is retained for 90 days, so an account closed by mistake, or one you come back to, can be restored. It is then deleted from our live systems, and backups are overwritten within a further 35 days. You may ask for earlier deletion. Deleting your account deletes your customers' data with it.

Records we are required to keep for tax or accounting purposes, anything needed to resolve a dispute, and audit-log entries recording that a deletion happened are retained separately for as long as needed. You can export your data at any time before deletion.

10. Breach notification

A breach means confirmed unauthorised access to, or loss or disclosure of, your customers' personal data on systems we or our sub-processors control. Unsuccessful attempts, such as blocked logins and port scans, do not count. Access gained through your own compromised credentials or devices is yours to handle, though we will help.

If we confirm a breach, we will notify you without undue delay, and we aim to do so within 72 hours of confirming it. We will tell you what we know about what happened, who is affected and what we are doing about it, and will update you as we learn more. A notice from us is not an admission of fault or liability.

Notifying your customers and any regulator is your decision as controller, and we will give you the information you reasonably need to make it. Any liability we have for a breach is subject to the limits in section 14 of the terms.

11. Information and audits

On reasonable written request, and no more than once a year, we will answer written questions and provide a summary of our security measures so you can confirm we are meeting this agreement. More frequent or more detailed requests may carry a reasonable fee. Because the platform is shared between bakeries, on-site inspections and testing of our systems are not available. If a law gives you an audit right that goes further, we will first agree its scope, timing, cost and confidentiality with you.

12. Legal requests

If a court or government body demands your customers' data from us, we will tell you before responding unless the law forbids it, and we will disclose only what is required.

13. Where data is held

Data is stored and processed in the United States, on infrastructure operated by the providers listed in section 6. Some providers, such as traffic delivery networks, handle request metadata in other countries.

This agreement is written for bakeries operating in the United States. It does not include the transfer terms that European or UK data protection law requires. If you are established in, or sell to customers in, the EEA or the UK, contact us before using the service.

14. Term, changes and contact

This agreement lasts for as long as we hold your customers' data. We may update it in the way section 17 of the terms describes.

Last updated September 2026. Anything about this document, or a request that needs a human: support@bakefleet.com.