Data Processing Agreement

In short

Four things you should know before you tick

These four would surprise most owners, so they are at the top rather than buried.

1. Definitions and roles

We means 8Employ Ltd. You means the business named in the setup wizard, acting in the course of business. The service is Eira: your weekly report, your client portal, and review analysis where you have a Google listing. Your data is what we take from the systems you connect or the files you send, plus what you type into the portal. Your report is the weekly report we make from it. Your data protection contact is the email address on your account, unless you tell us a different one at [email protected]. Personal data, controller, processor, sub-processor, data subject and personal data breach carry their meanings in UK data protection law, meaning the UK GDPR and the Data Protection Act 2018 as amended, including by the Data (Use and Access) Act 2025.

How to read this. For some things you are in charge and we act only on your instructions. For others we decide, for our own business reasons. The law treats those very differently, so this is split. Part 1 is where you are the controller and we are your processor. Part 2 is where we are a controller in our own right: you are not instructing us, we are telling you what we do and how to say no. Part 3 applies to both.

Labels do not decide roles. The facts do. Nothing here changes what the law says our roles actually are. If in fact we decide the purpose of something in Part 1, we become a controller for it and accept a controller's responsibilities.

How we keep the two apart. Your report is produced in our live pipeline, from the data in your own client folder and your portal records, once a week, for you alone. The checks that run while your own report is being written, including the second AI step that reads the draft against your figures, are part of producing your report and are Part 1. One of us reads your first report before it is released; after that, each week's report passes an approval check before you see it. Part 2 is the work we do afterwards, outside that pipeline, on copies of past report data, to backtest, score and compare across venues. This is a procedure we operate by hand, not something our software enforces: we keep a written list of venues excluded from that work, a founder checks the list before any evaluation, backtest or benchmark run, and if you object we add your venue within 30 days and record the date. We do not claim that our evaluation tools read that list automatically, because they do not. If we are ever treated in law as a joint controller with you for anything in Part 1, this agreement is our arrangement for it: we remain responsible for security, sub-processors, telling you about breaches and deletion as Part 1 says; you remain responsible for the lawful basis and for telling the people whose data it is; and an individual may exercise their rights against either of us, and we pass any request to the right one of us within 5 working days.

Part 1: Where you are in charge

2. What you are asking us to do

2.1 Annex A sets out the subject matter, duration, nature and purpose of the processing, the types of personal data, the categories of people it is about, and your obligations and rights.

2.2 Your documented instructions are this agreement (including Annexes A, D and E), the Pilot Agreement, the choices you make in the setup wizard and the portal, and anything else you send us in writing to [email protected]. We keep a record of instructions we receive. To change an instruction, email [email protected] and we confirm in writing. If it is something the service cannot do, we say so within 5 working days and you may end the pilot at no cost under clause 23.4.

2.3 Your instructions include authorising us to send your data to the companies in Annex B, and to the countries and under the safeguards in Annex D.

2.4 Your rights and obligations. You may instruct us, ask for your data back or deleted, check what we do under clause 11, and be told about a breach under clause 9. You must have a lawful basis for the data you give us and tell the people it is about what they are entitled to know. Clause 19 says more.

3. We only do what you tell us to do

3.1 We process your data only on your documented instructions, including where that means sending it outside the United Kingdom, unless UK law requires otherwise. If it does, we tell you first unless the law forbids us.

3.2 If we think an instruction breaks UK data protection law we tell you promptly and may pause that part. We are not your legal adviser and will not always spot a problem.

3.3 If we go beyond your instructions and decide for ourselves why your data is processed, we become a controller for that processing and carry a controller's liabilities for it.

4. Everyone who can see your information keeps it confidential

4.1 Only our founders, and any contractor we bring in, can access your data. Today only our founders hold accounts. Annex C is honest about the fact that this is a limit on who has an account, not a technical rule enforced on every read.

4.2 Our founders are bound to confidentiality by their agreement with the company, and that duty continues after they stop working with us. Any contractor signs a written confidentiality undertaking before we give them access. We use no contractors today.

5. Keeping your information secure

5.1 We put in place appropriate technical and organisational measures, as Article 32 requires, taking account of what is available, what it costs, and the risk to people if it goes wrong.

5.2 Annex C lists what we have in place today, and also what we do not.

5.3 We will not reduce the overall level of protection in Annex C while this agreement lasts, though the measures themselves may change as the product does.

6. Other companies that help us

6.1 Your permission, given once. You agree we may use other companies to help produce your report. Those we use today are in Annex B and published at 8employ.uk/data-processing-agreement#annex-b. Accepting this agreement is your general written authorisation to use them.

6.2 What we promise. We check a company can protect your information before we use it, and we have a written data protection contract with each company listed as a sub-processor in Annex B, giving your information an equivalent level of protection to this agreement. If one of them gets it wrong, that is our responsibility to you, not theirs. We remain fully liable to you for what they do. Annex B separately names a tool that receives no personal data about you and is not a sub-processor.

6.3 Adding or changing one. We email your data protection contact and update the published list at least 30 days before the new company starts handling your information, saying who it is, what it will do, where it is based, and the date by which you can object.

6.4 Your right to object. Object within those 30 days, in writing, with reasons. We will try another way to do the same job. If we cannot without materially changing the service, either of us may end this agreement and the Pilot Agreement, and clause 10 applies. There is nothing to pay: the pilot is free.

6.5 Urgent replacements. If a company stops operating, or leaving it in place would put your information at risk, we may replace it first and tell you as soon as we can. Your right to object then runs from the day we tell you.

6.6 Your till, card and accounting providers are not our sub-processors and are not on the list. Annex F explains why.

7. Helping you when someone asks about their information

7.1 If an individual contacts us about data we hold for you, we will not answer beyond acknowledging them and pointing them to you, and we pass it on within 5 working days.

7.2 To help you answer a request, we search the report files, portal records and account records we hold for you, give you a copy of what we find in a usable format, and correct, delete or restrict data on your written instruction. We do this by hand, not at the press of a button, so give us as much notice as you can inside your own one month deadline.

7.3 This is free of charge. If a Google reviewer contacts you or us, that is Part 2 and clause 14 applies.

8. Helping you with security, breaches and impact assessments

8.1 Taking account of what we do and what we know, we help you meet your obligations under Articles 32 to 36. In practice: we give you the security information in Annex C and answer a reasonable written questionnaire for a data protection impact assessment; we tell you if we think something you have asked for carries a high risk; and we give you what you need for the ICO's incident report form.

8.2 Annex A is our written record of the processing we carry out for you, which is what Article 30(2) requires a processor to keep. We keep it up to date and give you a copy on request. It is part of this agreement, so you already have it.

9. Telling you if something goes wrong

9.1 If we find out your information has been lost, stolen, changed without permission, or seen by someone who should not have seen it, we tell you without undue delay and in any event within 48 hours of becoming aware. We contact your data protection contact by email, and by phone if we hold a number for you and cannot reach them by email within 4 hours.

9.2 Our first message says what we know then: what happened, when, roughly how many people and what kinds of information are affected, the likely consequences, and what we are doing. We will not wait for the full picture before telling you. We say what we do not yet know and send the rest in stages.

9.3 You decide whether to report to the Information Commissioner's Office and whether to tell the people affected. You have 72 hours from becoming aware. We give you, free, whatever you reasonably need to decide and to complete the ICO's form, and keep helping until it is closed.

9.4 We keep our own written record and give you a copy on request. We will not make a public statement naming you without your agreement, unless the law requires it.

9.5 The 48 hours runs from when we become aware. We do not have automatic alerting for every kind of incident, and Annex C says so. Where a breach happens at one of the companies in Annex B, our 48 hours runs from when they tell us; Anthropic owes us 48 hours, so you could hear about it up to four days after the event.

10. What happens to your information when we stop working together

10.1 Your choice. When this ends, we stop generating reports and switch off portal access within 5 working days. You then choose: we return your information or we delete it. Tell us which within 14 days of the end. If you do not, we delete it. Either way your information is gone from our live systems within 30 days of the end — the two steps run inside that one period, they do not add up.

10.2 Return. We give it to you in a common machine readable format such as CSV or JSON, free, in time for the deletion in 10.1 to happen inside the same 30 days.

10.3 Deletion. We delete your information from the systems we use day to day, meaning our database, the report files, the portal records, the stored connections to your till and accounting systems, and the copies we hold for the Part 2 work in clause 13, and confirm in writing. This is a manual job done by a director, not an automatic one. Annex E sets out the limits of what it reaches.

10.4 Things we must keep. We may keep a copy where the law requires it, for example for tax or to defend a legal claim, and we keep your consent record as the last row of Annex E says. We use those only for that reason, delete them when the reason ends, and tell you what we hold if you ask.

10.5 Not deleted. Our engine, report format and analysis methods stay ours. Anonymous, aggregated learnings, meaning figures that cannot identify you, your business or any individual, are not personal data and are not deleted. We will never show another venue your actual figures.

10.6 The companies that help us are instructed to delete too. Anthropic deletes what we send it within 30 days as a matter of course, unless its safety systems flag it or the law requires it to keep it longer; Resend holds email records for 30 days. Annex E sets out what we hold, for how long, what happens to backups, and the limits of what our deletion reaches today.

11. Checking that we are doing what we say

11.1 Information on request. We give you what you reasonably need to satisfy yourself we are meeting this agreement and Article 28: our security summary, our sub-processor list, our record of the processing we do for you, and answers to a reasonable written questionnaire. Within 30 days, free. A full written questionnaire once in any 12 month period; anything else you reasonably need to demonstrate compliance, when you need it.

11.2 A remote audit. If that does not answer your questions, you or an auditor you appoint may audit us remotely, reviewing documents and by screen share, on 30 days' written notice, with the scope agreed in advance, in normal working hours, without disrupting the service. Once in any 12 month period, at your cost, except that we bear our own time.

11.3 Coming to look. You may inspect the place where your information is processed where (i) we have notified you of a breach affecting it, (ii) a supervisory authority requires it, (iii) a remote audit found a material issue we have not fixed in reasonable time, or (iv) a physical security measure in Annex C cannot reasonably be verified by a remote audit. Same 30 days' notice, or shorter if a regulator requires; in working hours; limited to what is relevant; at your cost. Our systems run from a private residence, so any visit must be arranged in advance and at a location we agree. We will not refuse a legitimate inspection, and we will not host one unannounced.

11.4 Limits. Anyone auditing us signs a confidentiality undertaking, and we may redact anything revealing another client's information, our security secrets, or anything we may not lawfully disclose, telling you when we do. If we later hold an independent certification or audit report covering the service, giving it to you satisfies 11.1 and 11.2 for the period it covers unless you have a specific concern it does not address; we hold none today. We will use the audit rights in our contracts with the companies in Annex B to get you what you reasonably need about them, but we cannot send you into their offices.

12. Sending your information outside the United Kingdom

12.1 Some companies in Annex B are outside the UK, mainly in the United States. Annex D gives the country and legal mechanism for each.

12.2 Where a company is covered by UK adequacy regulations, including the UK Extension to the EU-US Data Privacy Framework, we rely on those. Where it is not, we rely on the standard clauses the ICO publishes: the EU Standard Contractual Clauses as amended by the ICO's International Data Transfer Addendum. We have carried out and recorded the risk assessment those rules require (Annex D), and we will send you a copy of it, or of any safeguard we rely on, if you ask.

12.3 If a mechanism stops being available, we move to another appropriate safeguard or stop that transfer, and we tell you.

Part 2: Where we decide

Part 2 is not an Article 28 processing agreement. It is disclosure, and where marked, consent. You are not instructing us to do any of it.

13. Using what we learn to improve the product

13.1 What we do. After the fact, on copies of past report data, we replay past weeks to see whether our analysis would have been right, tune the instructions we give the AI, score the quality of past outputs, and compare patterns across the venues we work with. The checks that run while your own report is being written are not this: they are part of producing your report, and clause 1 explains where the line falls.

13.2 Role and basis. We are a controller for this. Our lawful basis is legitimate interests, Article 6(1)(f): ours in analysis that is accurate and useful, and yours in the product getting better. It is not one of the "recognised legitimate interests" the law lists, so we have weighed it against the people the data is about and written that assessment down, dated 2 September 2026. In short: most of what we use is business figures, which are not about anyone. Where a person appears it is usually a member of your staff or a customer you named in a note. We build nothing about any individual, we never show one venue's data to another, and access is limited to our founders. Ask us for the assessment.

13.3 What we will not do. We will never show one venue's actual figures to another venue as part of the service. That is a promise in this contract, not just a description of current practice. The only exception is clause 16, and only if you chose it.

13.4 Anonymous and aggregated learnings. We produce statistics and benchmarks from which you, your business and any individual cannot be identified. Those are not personal data, we may use them freely, and we keep them indefinitely.

13.5 Data we do not use for this. Some of the places your data comes from restrict what a third party may do with it, and one category is not ours to reuse. So we do not use for the work in this clause: (a) data from a Square or Xero connection; or (b) the public Google reviews we collect under clause 14, including their text and the reviewers' names. Those are used only to produce your report and, for reviews, to draft suggested replies. This is a decision we operate, not a switch in our software: neither pilot venue uses Square or Xero today, and before we connect either for you we will have a way of keeping it out of that work. The improvement work in this clause uses your sales, menu, waste and booking figures, the notes you type, and our own past outputs, and nothing else.

13.6 Reviewer names. The display names of your Google reviewers reach the prompts we send to the AI when your report is written and when a suggested reply is drafted. They do not reach the work in this clause, because clause 13.5 keeps review content out of it altogether.

13.7 You can object. Clause 17 says what happens.

14. Your Google reviews

14.1 What we do. Where you have a Google listing, we query the Google Places API using your venue's name and location and read your public reviews, for up to five reviews Google returns for that venue. Google chooses which five, usually the ones it thinks most relevant. We use them to draft insights and suggested replies.

14.2 What we collect. The reviewer's public display name, star rating, review text, review date and how long ago it was posted. Not their profile link or photo.

14.3 Role and basis. We decide to collect these, so we are a controller. Reviewers are members of the public with no relationship with us. Our lawful basis is legitimate interests, and we have written that assessment down, dated 2 September 2026. We will send you a summary if you ask; a summary is also in section 14 of our Privacy Policy, which is the notice reviewers get under Article 14.

14.4 What happens to a review. It goes into your report, your portal, the PDF we email you, and into the text we send to Anthropic so the analysis and any suggested reply can be written. For every report that includes unanswered reviews we also draft a suggested reply. It is written in the first person as if by you, and may name a member of your staff the reviewer named. You decide whether to post any reply. We never post on your behalf and we never contact reviewers.

14.5 What you get, and for how long. You get the analysis. We do not give you more about a reviewer than Google already shows you publicly. Reviews sit inside your report archive and go when it goes (Annex E).

14.6 If a reviewer contacts us at [email protected], we search by venue and display name by hand, using the procedure in our deletion and requests runbook, and answer within one month. We have no automated way to find a reviewer's data across our report files.

14.7 Google is not our sub-processor. It is an independent controller of the query we send and of the review data it holds. Annex F.

15. Your contact details and your account

15.1 We hold your name and business contact details, login credentials, the sign-in links we send you, records of your portal sessions, security records including IP addresses and browser details, emails you send our support address, and short notes we keep about how you like your report, which can refer to you by name and which go to Anthropic with your report.

15.2 We are a controller for this. Our basis is that the processing is necessary for the contract with your business, and our legitimate interests in running and securing the service and recording who agreed to what.

15.3 Security records are stored on disk, not only in memory. An earlier version of our privacy policy said otherwise. That was wrong and is corrected here. The Privacy Policy is your notice as an individual about this processing.

16. Showing your reports as an example, if you chose that

16.1 This applies only if you ticked the separate optional box (consent version demo-v1): "I'm happy for 8Employ to show my reports and figures to prospective customers as an example of their work. (Optional — everything works exactly the same if you leave this unticked.)"

16.2 If you did, we may show your reports and figures to prospective customers as an example of our work. We are a controller, the purpose is our own marketing, and the basis is your agreement, and where you trade as an individual, your consent. Before we show anything we remove the reviews section from it, including reviewer names and review text.

16.3 Withdraw at any time by emailing [email protected]. We stop using new material within 7 days and create no new examples. Material already printed or sent cannot be recalled, and we will tell you what is already out there if you ask.

16.4 If you did not tick it, we do not do this, and nothing about your service is different.

17. Saying no, and what happens if you do

17.1 You can object to anything in Part 2 done on the basis of legitimate interests, at any time, by emailing [email protected]. It is free and you need not give a reason.

17.2 Object to clause 13 and we add your venue to the written exclusion list within 30 days and record the date, and a founder checks that list before any evaluation, backtest or benchmark run. Your weekly report carries on exactly as before. Statistics already produced, from which you cannot be identified, are not unpicked.

17.3 Object to review collection and we switch the reviews feature off for your venue; your report stops including review analysis. Withdraw demo consent and clause 16.3 applies.

17.4 Individuals can object too, including your staff and Google reviewers. If we cannot show compelling legitimate grounds that override their interests, we stop. We do not use your data or reviewer data for direct marketing.

17.5 Complaints. Tell us first at [email protected]. We acknowledge within 30 days and say what we are doing. If you are still unhappy, complain to the Information Commissioner's Office under section 165 of the Data Protection Act 2018: Wycliffe House, Water Lane, Wilmslow, Cheshire SK9 5AF, 0303 123 1113, ico.org.uk.

Part 3: Things that apply to both

18. Information we do not want, and must not receive

18.1 The service is built around business figures. We do not want your customers' personal data. Please do not send customer lists, booking names, email lists or card details. Our card and till connections give us amounts, not cardholders, by design.

18.2 Some personal data comes with the territory and we do process it: your own account details, staff names and shift times where your till provides them, names you type into portal notes, and reviewer names. Annex A lists these.

18.3 No special category or criminal offence data. You agree not to send us data about anyone's health, race or ethnic origin, religion, political opinions, trade union membership, sex life or sexual orientation, genetic or biometric data, or criminal offences. We do not seek it and the service does not need it. Review text reaches our AI analysis in full — we cannot filter it in advance and we do not control what a reviewer writes. If a review happens to contain sensitive information about someone, the reviewer chose to publish it and Article 9(2)(e) of the UK GDPR lets us process it on that footing. We do not go looking for it, we do not build on it, and we will take it out of a suggested reply. Requests about it are handled under clause 14.

18.4 If you send us information we did not ask for, we may delete it and tell you.

19. What you are responsible for

19.1 You are the controller for the data in Part 1. You must have a lawful basis and give the people it is about the information they are entitled to.

19.2 Telling your staff. If the data you connect or send includes staff names or hours, you must tell your staff that you use us to analyse it, that it is stored on our systems in the United Kingdom, and that notes you write naming them, and reviews naming them, are sent to Anthropic in the United States as part of writing your report. Section 2a of our Privacy Policy is written for your staff to read. We do not contact your staff.

19.3 Authority to connect. You confirm you are entitled to connect your till, card and accounting accounts to us and to share the exported data, and that doing so does not break your agreement with those providers.

19.4 If access is withdrawn. If you disconnect a provider, or it withdraws our access, we stop using that source from the next scheduled run and do not attempt to reconnect; your reports stop or become partial. We have no automatic detection of a provider-side revocation, so tell us. Where a provider's terms require deletion of data belonging to a seller who has revoked access, we delete it by hand through the same routine as clause 10.3, once we know.

19.5 Keep your logins private, and tell us promptly if your data protection contact or business details change. The figures come from your systems: we do not audit them and cannot make a wrong till export right.

20. Who is responsible if something goes wrong

20.1 The limit on our liability in clause 11 of the Pilot Agreement (£500 in total) applies to claims under this agreement too, including a claim to recover compensation or a penalty you have had to pay because we broke this agreement, except as clause 20.2 says. That limit reflects the pilot being free. There is no second, separate cap in this agreement.

20.2 But nothing in this agreement or the Pilot Agreement limits or excludes: either party's liability to an individual under Article 82 of the UK GDPR for damage caused by unlawful processing; either party's liability to the Information Commissioner's Office; liability for death or personal injury caused by negligence; liability for fraud or fraudulent misrepresentation; or anything else that cannot lawfully be limited. The cap does not reduce anything the law gives an individual.

20.3 We are liable to you for what our sub-processors do with your information (clause 6.2). Nothing here relieves either of us of our own direct duties under UK data protection law, and each of us remains responsible for its own compliance and for any penalty imposed on it.

21. How long this agreement lasts

21.1 It starts when you accept it in the setup wizard and runs while the Pilot Agreement runs.

21.2 It ends when the Pilot Agreement ends, except that clause 4, clause 10 with Annex E, clause 11 for 12 months afterwards, clauses 13 and 17 for as long as we hold any copy of your data, clause 20 and clause 24 carry on.

22. Which document wins

22.1 On anything to do with personal data, this agreement prevails over the Pilot Agreement. On everything else the Pilot Agreement prevails.

22.2 The Privacy Policy is information for individuals and changes neither agreement. Nothing in a sub-processor's own terms reduces what we owe you here.

23. Changes to this agreement

23.1 We never edit a published version in place. Every change makes a new numbered version with its own date and version string, and we keep the old ones. Ask and we will send you the one you accepted.

23.2 Minor changes, such as correcting an error, adding detail, or reflecting a sub-processor change already notified under clause 6, take effect 14 days after we email your data protection contact.

23.3 Material changes need a new version string and a fresh tick in the wizard. A material change is one that reduces your rights or protections, increases what you must do, changes clause 6, 7 or 11, adds a new category of personal data or a new purpose in Part 2 of the Data Processing Agreement, weakens our security or retention commitments, changes who we send your data to, or changes the AI provider. Silence is not agreement to a material change.

23.4 We may change this because the law changes, the product changes, a sub-processor changes, or we got something wrong. If you do not accept a change you can end the pilot at no cost, and clause 10 applies.

24. Law, courts and how you accepted this

24.1 This agreement is governed by the law of England and Wales, and the courts of England and Wales have exclusive jurisdiction.

24.2 Someone who is not a party has no right to enforce this under the Contracts (Rights of Third Parties) Act 1999. That does not affect any right an individual has under data protection law.

24.3 Article 28(9) allows this contract to be made in writing, including electronically. You accepted it by ticking the required box in our setup wizard. We store the wording shown to you, the version string pilot-dpa-v1, the date and time in UTC, and the IP address, as our record.

Annex A. Details of the processing we do for you

This Annex is also our Article 30(2) record of the processing we carry out for you (clause 8.2).

Annex B. The companies that help us (sub-processors)

Published list: 8employ.uk/data-processing-agreement#annex-b

The legal mechanism for each transfer outside the UK is in Annex D, so it is stated once rather than twice.

A tool that receives no personal data about you. When a report run fails or is waiting for our approval, we send ourselves an alert in Slack. It carries your client identifier and the error text. These alerts are built to carry no name, email address or other personal data about you, your staff or your customers. If an error message ever did, we would treat that as a breach under clause 9. Slack is not a sub-processor and we claim no data protection contract with it; signing Salesforce's data processing addendum for Slack is on our list, and we do not rely on it today because these alerts carry none of your personal data.

Our hosting is not a third party. The service runs on our own equipment at our own premises in Swansea, Wales, reached only through the Cloudflare Tunnel. No cloud provider holds your report data. Google's Places API is not on this list. See Annex F.

Annex C. The security we have, and the security we do not

Where it runs. On our own equipment at our own premises in Swansea, Wales, not a rented cloud server. Physical access is controlled by the director whose premises they are. The service is not reachable directly from the internet; traffic arrives through a Cloudflare Tunnel.

In place today

Not in place today. We would rather tell you.

Annex D. Sending information outside the United Kingdom

Our transfer risk assessment. The transfer rules changed on 5 February 2026. We now have to be satisfied, acting reasonably and proportionately, that protection for people's information is not materially lower after a transfer than it is here. That is the data protection test, formerly called a transfer risk assessment. We have carried one out and recorded it for our transfers to the United States, relying on the Department for Science, Innovation and Technology's published Analysis of the UK Extension to the EU-US data privacy framework (September 2023), which the ICO says it is reasonable and proportionate for an exporter to rely on whatever the level of risk. We are satisfied it addresses both the risk of people in the United States who are not bound by our clauses accessing the information, including government and public bodies, and the risk of difficulty enforcing the clauses. We will review it if that analysis changes or is withdrawn. Ask us for a copy of the assessment or of any standard clauses named above.

Your own providers. Your till, card and accounting providers may be based outside the UK. Xero, for example, is an Australian and New Zealand business, and Australia does not have UK adequacy. Those are not our transfers: they happen under your agreement with your provider. Annex F.

Annex E. What we keep, for how long, and how it goes

Deletion is a manual procedure operated by a director, within 30 days of your request or of the pilot ending, confirmed in writing. We have no automatic timer that deletes report data, and we are not going to claim we do.

Backups. We do not keep separate backup copies of your reports or of the portal database, so there is nothing extra to purge. The one copy we do keep is a rotating same-machine backup of our client list, which is cleared on the next save after we delete your record. If we introduce backups they will be covered by the same procedure: put beyond use from the day we delete your live data, meaning not opened, searched or restored from, and deleted on the next backup cycle.

The limits of our deletion, stated plainly. The routine removes your data folder and your portal records. It does not reach every mention of your account inside our application and web server logs, which may include your email address; those go on the 12 month cycle above. Our support inbox and our prospect waitlist are separate files the routine does not touch, and we clear those by hand.

These periods match our Privacy Policy. If you find they do not, tell us and we will fix whichever document is wrong.

Annex F. Your data sources are not our sub-processors

Your till, card and accounting providers. SumUp, GoodTill, Square, EposNow, Xero, Dojo, ICRTouch, and any spreadsheet, CSV or email export you send us, are your suppliers. You appoint them, you agree terms with them, and they handle your data for you and not on our instructions. That is why they are not in Annex B. If you look for your till provider on our sub-processor list and cannot find it, nothing has been left out. What we do is read the data you have authorised us to read, through the connection you set up. Clauses 19.3 and 19.4 cover your authority to connect and what happens if access is withdrawn.

Google, for your reviews. When we fetch your public reviews we send Google your venue's name and location as a search query. For that, Google is an independent controller, not our processor: it decides for itself why and how it handles the query and the review data, under its own terms and privacy policy. It does not act on our instructions, so it is not in Annex B and there is no Article 28 contract between us about it. We send Google no information about you, your staff or your customers as individuals.

Version 1.1 · 4 September 2026 · wizard consent version pilot-dpa-v1 8Employ Ltd · company number 17082344 · registered in England and Wales · registered office as filed at Companies House · ICO registration ZC104872 Read with the Pilot Agreement (https://8employ.uk/pilot-agreement) and the Privacy Policy (https://8employ.uk/privacy-policy).