Data processing agreement

1. Parties and how this agreement applies

Unpickle is an operations app for cafés, restaurants and bars: deliveries, daily jobs, stock and house knowledge. It is run by Matte Group Ltd (“we”, “us”).

Registered in England and Wales, company number 14554960. Registered office: 22a Beaufort Road, London, KT1 2TQ, United Kingdom. Registered with the Information Commissioner's Office, number ZB916998.

You can reach us at hello@unpickleapp.com. A person answers.

For existing customers, contractual updates take effect after the notice required by the terms of service and section 7 below. Mandatory data protection rights and duties continue to apply throughout.

This agreement is between us, as processor, and the business that holds an Unpickle shop account (“you” or “the shop”), as controller. It forms part of our terms of service and applies automatically when you use Unpickle; there is nothing to sign. It sets out the terms required by Article 28 of the applicable GDPR. If it conflicts with the terms of service on data protection, this agreement wins. Mandatory international transfer clauses take priority over either agreement where they conflict.

“Applicable data protection law” means the UK GDPR, the Data Protection Act 2018 and, to the extent it applies to the processing, the EU GDPR and relevant EU Member State law, as amended. Words such as “personal data”, “processing”, “controller”, “processor” and “personal data breach” have the meanings given in that law. References to the supervisory authority mean the ICO or the other authority competent under the applicable law.

This agreement covers personal data we process on the shop’s behalf. It does not cover processing for which we are a controller, such as our own billing and business administration, which is explained in our privacy policy.

2. Subject matter and duration

We process personal data to provide Unpickle to the shop. We do so for as long as the shop has an account, and afterwards only for as long as section 11 allows.

3. Nature and purpose

Storing, organising, displaying, sending and deleting the shop’s records so that its team can check deliveries, complete and track tasks, count and reorder stock, read house knowledge and receive alerts, together with the optional AI features (invoice reading, report questions, duplicate product labelling and supplier message drafts) when someone in the shop uses them.

4. Types of personal data

• Names, email addresses, phone numbers, roles and active status of managers and staff.
• Login identifiers and sign-in records.
• Work records linked to a person: tasks assigned and completed, delivery checks, stock counts, low-stock reports, notes, points and streaks.
• Photos (task evidence, damaged items, invoices and stock counts), which may incidentally show people.
• Supplier contact details entered by the shop.
• Notification details: Telegram chat identifiers and browser push subscriptions, where people opt in.
• Anything else the shop chooses to enter in free-text fields or knowledge base articles.

Do not enter special category data (such as health information) or data about criminal convictions or offences unless we have separately agreed in writing to process it, including its purpose and the safeguards required. That agreement does not remove the shop’s responsibility to establish the additional legal conditions for processing that data.

5. Data subjects

The shop’s managers and staff, its suppliers’ contacts, and any other person the shop records in Unpickle.

6. Our obligations

We will:

1. process the shop’s personal data only on its documented instructions, including for international transfers. Those instructions are this agreement, the shop’s use of the service and any further instructions agreed in writing. We may process without an instruction where UK law requires it, or EU or Member State law where the EU GDPR applies; we will tell the shop about that requirement before processing unless that law prohibits notice on important grounds of public interest;
2. immediately inform the shop if, in our opinion, an instruction infringes applicable data protection law, and suspend the affected processing until the instruction is resolved lawfully;
3. make sure everyone we authorise to process the data is bound by confidentiality;
4. take all appropriate technical and organisational measures required by Article 32 of the applicable GDPR, including the measures in section 8;
5. only use other processors as set out in section 7;
6. help the shop respond to people exercising their rights (section 10);
7. help the shop meet its duties on security, breach notification, data protection impact assessments and consultation with the relevant supervisory authority, taking into account the nature of the processing and the information available to us;
8. delete or return the data at the end, as set out in section 11; and
9. make available the information needed to show we meet these obligations, and allow audits as set out in section 12.

7. Sub-processors

The shop gives general authorisation for us to use the sub-processors below. We will engage sub-processors only under written contracts imposing the same data protection obligations as this agreement, including sufficient guarantees of appropriate technical and organisational measures. We remain fully liable to the shop for their performance of those obligations.

We’ll give at least 30 days’ notice before adding or replacing a sub-processor, by email to the shop’s managers and by updating this page. If the shop has a reasonable data protection objection, it can tell us within that period; if we can’t resolve it, the shop may close its account and we’ll refund any fees paid for the period after the change takes effect.

We will make restricted international transfers only on the shop’s documented instructions and with a lawful safeguard under the applicable GDPR. For UK transfers this may be UK adequacy regulations, the European Commission’s Standard Contractual Clauses with the UK International Data Transfer Addendum, or the UK International Data Transfer Agreement. Where EU transfer rules apply, we will use an applicable European Commission adequacy decision or the EU Standard Contractual Clauses. We will assess the protection provided and apply any supplementary measures required before a transfer takes place. The shop can request details and a copy of the relevant safeguards by emailing us.

A shop’s instruction to use an optional integration does not remove these obligations. Services that receive data as independent controllers are described separately in the privacy policy; they are not authorised as sub-processors by this section.

8. Security measures

• Encryption of data in transit (HTTPS) and at rest.
• Access to shop records restricted by shop and role through database and application access controls.
• Uploaded files kept in private storage and shared only through links that expire.
• Role-based access inside a shop: staff cannot access manager-only data, and deactivated accounts are denied access to shop data.
• Rate limits on password resets, outgoing email, exports and other sensitive actions.
• Access to production systems limited to the people who need it to run the service.
• Encrypted database recovery backups, with access and expiry managed under section 11.

9. Personal data breaches

If we become aware of a personal data breach affecting the shop’s data, we’ll tell the shop without undue delay and in any case within 24 hours, by email to its managers. We will send an initial notice without waiting for the investigation to finish. As information becomes available, we’ll explain what happened, the categories and approximate numbers of people and records affected, the likely consequences, our contact for further information and what we’re doing to contain and remedy the breach. We will provide updates without undue delay and give the shop the help it reasonably needs to notify the relevant supervisory authority and the people affected.

10. Helping with people’s rights

Managers can view, correct, export and delete most records themselves in the app, including downloading CSV files from Settings → Your data. Where they can’t, we’ll help. If a person contacts us directly about data the shop controls, we’ll promptly pass the request to the shop and won’t answer it ourselves unless the shop asks us to or applicable law requires it. Taking account of the nature of the processing, we will provide appropriate technical and organisational assistance, insofar as possible, so the shop can meet its obligations and the applicable response deadlines.

11. At the end

When the processing services end, the shop may choose to have its personal data returned or deleted. Managers can export records from Settings → Your data while they have access, and can email us for a return of the shop’s personal data, including uploaded photos, before the scheduled deletion. We will complete the return securely in commonly used electronic formats and delete our remaining active copies within 30 days of the request. The shop can also request deletion by email or by using Close my shop; we delete the shop’s active personal data, files and logins within 30 days of that request.

Unless the shop gives an earlier return or deletion instruction, it instructs us to retain its records for 90 days after the end of its last paid period so it can resume service, then delete them. If a free trial ends without a subscription, the same 90-day period runs from the end of the trial. During that period the shop can request return or earlier deletion by email, including if it no longer has access to the app.

Any remaining backup copies, including manual backups or exports held by us, are encrypted, kept beyond ordinary use and deleted or expire within 30 days after deletion of the active data. They are used only for disaster recovery; if a backup is restored, we reapply deletion requests before making the restored data available for ordinary use. We retain personal data longer only where applicable law requires storage, and restrict that data to the required purpose and period. Billing records we hold as a controller are addressed separately in the privacy policy. We will confirm completion of deletion on request.

12. Audits and information

On request we’ll answer reasonable written questions about how we protect the shop’s data, and provide the information needed to demonstrate compliance with this agreement and Article 28, including relevant available summaries of our sub-processors’ security certifications. We will allow and contribute to audits, including inspections, by the shop or an independent auditor it appoints who is bound by confidentiality. Routine audits take place on at least 30 days’ notice, during business hours, no more than once a year, and at the shop’s own reasonable cost.

Those notice, frequency and business-hours limits do not apply where an additional or urgent audit is reasonably necessary following a personal data breach, suspected material noncompliance, a material change in processing or a supervisory authority’s request. In those cases we will cooperate on notice and timing appropriate to the circumstances. Audit arrangements and costs must not prevent the shop or a supervisory authority from exercising rights required by applicable data protection law.

13. The shop’s responsibilities

The shop is responsible for having a lawful basis for the data it puts into Unpickle and meeting any necessary additional conditions for sensitive data, for giving people the required privacy information (including that it uses Unpickle), and for the accuracy of what it enters. The shop must give lawful instructions and ensure the people administering its account are authorised to give them.

14. Liability

Each party’s liability under this agreement is subject to the limits and exclusions in our terms of service, except where the law doesn’t allow liability to be limited. Those limits do not restrict data subjects’ statutory rights to compensation, supervisory authorities’ powers, or rights and liabilities that cannot be limited under mandatory international transfer clauses.

15. Changes and law

We may update this agreement to reflect changes in the law or in how we provide the service, with notice as set out in the terms of service, without reducing the protection required by applicable data protection law. The specific notice requirements for sub-processors in section 7 still apply. This agreement is governed by the law of England and Wales, subject to mandatory data protection law and international transfer clauses. Questions: email hello@unpickleapp.com.