Data Processing Agreement

Version: 2026-10
Last updated: 6 October 2026

1. Parties and how this agreement applies

This agreement is between the caterer who uses Caterway ("you", the controller) and Gentlio Oy, business ID 3644859-5, Sörnäisten rantatie 25 A1, 00530 Helsinki, Finland ("Caterway", "we", the processor).

It forms part of the Terms of Service. You accept it when you create an account, and it applies for as long as we process personal data for you. GDPR Art. 28(9) allows this agreement in electronic form.

If this agreement and the Terms disagree on the processing of personal data, this agreement wins. Words such as "personal data", "processing", "controller", "processor", "data subject" and "personal data breach" mean what they mean in the GDPR (2016/679).

2. What we process for you

We process your customers' and guests' personal data to provide Caterway to you. Annex 1 sets out the subject matter, nature, purpose and duration of the processing, and the categories of data and data subjects. Your own account data is not covered by this agreement. For that we are the controller, and our Privacy Policy applies.

3. Your instructions (GDPR Art. 28(3)(a))

We process the personal data only on your documented instructions. Your instructions are this agreement, the Terms, and what you do in the service: the settings you choose, the data you enter and the actions you take. You can give further instructions in writing to support@caterway.io.

If EU or Finnish law requires us to process the data in some other way, we tell you before we do, unless that law forbids telling you. If we think an instruction breaks the GDPR or other data protection law, we tell you straight away.

You are responsible for having a lawful basis for the data you put into the service, and for telling your customers how you use it.

4. Confidentiality (GDPR Art. 28(3)(b))

Only people who need access to provide or support the service can reach the personal data. Everyone with access is bound by confidentiality, by contract or by law.

5. Security (GDPR Art. 28(3)(c) and Art. 32)

We protect the personal data with the technical and organisational measures in Annex 2. We may change them, but never in a way that lowers the overall level of protection.

6. Subprocessors (GDPR Art. 28(3)(d), 28(2) and 28(4))

You give us general authorisation to use subprocessors. The current ones are in Annex 3 and at caterway.io/subprocessors.

Before we add or replace a subprocessor that processes your customers' data, we email the account owner at least 30 days in advance and update the page. You can object in writing within that time, on reasonable data protection grounds. We then try to find a solution with you. If we cannot, you may end the affected part of the service before the change takes effect, and we refund any prepaid fees for the time after that.

We bind each subprocessor to data protection obligations that are at least as strict as this agreement. We remain responsible to you for their work.

7. Requests from data subjects (GDPR Art. 28(3)(e))

You answer your customers' requests to see, correct, delete, restrict, move or object to the processing of their data. The service lets you view, edit and delete their records. Where it does not let you do something you need, we do it on your written instruction.

If one of your customers sends a request to us, we forward it to you without undue delay and tell the person that we have done so. We do not answer the request ourselves unless you ask us to.

8. Breaches and other help (GDPR Art. 28(3)(f))

If we become aware of a personal data breach that affects your data, we tell you without undue delay, and in any event within 48 hours. We tell you, as far as we know them at the time: what happened, which data and roughly how many people are affected, the likely consequences, and what we have done or propose to do. We send the rest as we learn it.

We also help you, taking into account what we know about the processing, with your security duties (Art. 32), breach notices to the authority and to the people affected (Art. 33 and 34), and data protection impact assessments and prior consultation (Art. 35 and 36).

9. When the service ends (GDPR Art. 28(3)(g))

Before you close your account, you can download all your data in one ZIP file (Settings > Account > Download all data). When the account is deleted, we delete your customers' data from the service. It disappears from our database provider's backups when those backups expire, after about 7 days. If we ever restore a backup, we apply our register of deletions again so that deleted data stays deleted. We keep data only where EU or Finnish law requires us to.

When you ask us to delete your account, we wait 30 days before deleting anything, so you can undo a mistake or download your data. Then we delete the data and every uploaded file, including files your customers attached to their requests.

10. Information and audits (GDPR Art. 28(3)(h))

We give you the information you need to show that we keep this agreement. On request we answer a reasonable written security questionnaire, and share the certifications or audit reports our main subprocessors publish.

If that is not enough, you or an independent auditor bound by confidentiality may audit us. Give us 30 days' notice, and keep it to once a year, unless a breach or a supervisory authority makes another audit necessary. Each party pays its own costs. An audit must not reveal other customers' data.

11. Transfers outside the EU

Your data is stored in the EU. Where a subprocessor processes it outside the EU or EEA, we make sure a valid transfer mechanism is in place.

For providers in the United States that are certified under the EU-US Data Privacy Framework (Resend, Vercel, Google, Microsoft, Cloudflare and Sentry), we rely on the European Commission's adequacy decision for that framework. Supabase is not certified, so its data processing agreement relies on the European Commission's standard contractual clauses.

The framework is under appeal at the Court of Justice of the European Union (case C-703/25 P, pending). If it is struck down, or stops covering a provider, the standard contractual clauses in that provider's data processing agreement apply instead. They are the fallback for every US subprocessor.

12. What we do not do

We do not use your customers' data for our own purposes, sell it, or use it to contact your customers about Caterway. The calculator statistics in Annex 1 are processed to show them to you. For our own use we take only totals across all caterers' calculators, which identify no one, to improve the calculator.

13. Liability, term and law

Liability under this agreement is part of the total cap in Section 21 of the Terms of Service, not in addition to it. The limits do not affect the rights of data subjects under the GDPR or other mandatory law.

This agreement lasts as long as we process personal data for you. Sections that by their nature should outlast it, such as confidentiality and deletion, continue to apply. Finnish law governs it.

We may update this agreement. We tell you about every change directly, by email to the account owner, at least 30 days before it takes effect, and the change applies to you only once you have accepted it in the service. If you do not accept it, you may end the service before the change takes effect, and we refund any prepaid fees for the unused period.

Annex 1. Description of the processing

Annex 2. Security measures

These are the measures in place on 4 October 2026.

Hosting and encryption

• The database, file storage and sign-in run on Supabase in the EU (Paris).
• Server code runs on Vercel in the EU (Frankfurt).
• All connections use HTTPS (TLS). Browsers are told to use HTTPS only (HSTS).
• Supabase encrypts stored data and takes daily backups.

Access control

• Row-level security in the database keeps each workspace's data apart.
• A workspace owner decides which team members join the workspace. Quotes and order pages are reached through unguessable links.
• Passwords are stored only as hashes by Supabase. Accounts can turn on two-factor authentication with an authenticator app.
• Caterway administrators can access workspaces to give support. Changes made through admin tools are written to an audit log. Read access is not logged yet, and two-factor authentication is not yet required for administrators.

Application

• Sign-in, signup and the quote request form are protected by Cloudflare Turnstile.
• Supabase limits repeated sign-in attempts. AI features have usage limits.
• Payment webhooks from Stripe are verified by signature. Card data never reaches our servers.
• The caterer's customer pages load no analytics or marketing tools and store nothing on the visitor's device for us. Calculator statistics are counted on our server (Annex 1).
• Fonts are served from Caterway's own servers, so the visitor's browser makes no request to a font service.
• Errors are reported to Sentry, with session replay turned off.

Deletion

• The caterer can edit and delete records in the dashboard, and delete the whole account.
• What the dashboard cannot erase, we erase on written instruction (see §7 and §9).

Organisation

• Access to production systems is limited to the people who run the service.
• Breaches are reported to the caterer as in §8.

Annex 3. Subprocessors

Providers marked "Yes" in the last column can receive your customers' data and are subprocessors under this agreement. The others serve Caterway's own business and are listed for completeness. The change log is at caterway.io/subprocessors.