Data Processing Agreement

Kitchen Savers edition, prepared under the Data Protection (Bailiwick of Guernsey) Law, 2017

Controller

The business accepting in Kitchen Savers

Date

Date of acceptance

Service

Kitchen Savers

Version

2.4, October 2026

Parties

This Data Processing Agreement ("Agreement") is entered into between:

Data Controller: the business that accepts this Agreement in Kitchen Savers, as recorded at the time of acceptance ("the Controller")

Data Processor: Time Savers Limited, a company registered in Guernsey with company number 78775, incorporated on 7 September 2026, whose registered office is at Smugglers Cove, Rue de la Vallée, Torteval, Guernsey, GY8 0PW, and which is registered with the Office of the Data Protection Authority ("the Processor")

Together referred to as "the Parties".

1. Background

1.1 The Controller wishes to use Kitchen Savers, the Processor's online service for keeping food-safety records in commercial kitchens, as described in the Kitchen Savers Terms ("the Services").

1.2 In providing the Services, the Processor will process personal data on behalf of the Controller.

1.3 The Parties enter into this Agreement to ensure that such processing is carried out in accordance with the Data Protection (Bailiwick of Guernsey) Law, 2017 ("the Law").

2. Definitions

In this Agreement:

"Personal Data" means any information relating to an identified or identifiable natural person, as defined under the Law.

"Processing" means any operation performed on Personal Data, including collection, storage, use, disclosure, or deletion.

"Data Subject" means the individual to whom Personal Data relates.

"Sub-Processor" means any third party engaged by the Processor to process Personal Data on behalf of the Controller.

"Security Incident" means any accidental or unlawful destruction, loss, alteration, unauthorised disclosure of, or access to, Personal Data.

"Annex A" means the annex to this Agreement headed Details of Processing, which forms part of this Agreement.

3. Scope and Purpose of Processing

3.1 The Processor shall only process Personal Data on documented instructions from the Controller.

3.2 The categories of Personal Data, the categories of Data Subjects, the nature and purpose of the processing, the retention period, and the Sub-Processors engaged by the Processor are set out in Annex A.

3.3 The Processor shall not process Personal Data for any purpose other than delivering the Services without the prior written consent of the Controller.

4. Obligations of the Processor

The Processor agrees to:

4.1 Process Personal Data only in accordance with the Controller's documented instructions and the terms of this Agreement.

4.2 Ensure that all personnel with access to Personal Data are bound by written confidentiality undertakings that continue after their engagement with the Processor ends. The Processor confirms that such undertakings are in place for all personnel who have access to Personal Data at the date of this Agreement.

4.3 Implement and maintain appropriate technical and organisational security measures to protect Personal Data against unauthorised or unlawful processing and against accidental loss, destruction, or damage. These measures include, but are not limited to:

• Encrypted data storage via Supabase, hosted on AWS infrastructure in London, United Kingdom
• Each client's data separated at database level, with access checked against the client's account on every request
• Access removed immediately when a user is removed by the Controller or the Processor
• Error reports stripped of names, email addresses, telephone numbers, PINs and login details before they leave the application
• Use of secure, authenticated connections for all data transmission

4.4 Process Personal Data only in Guernsey, the United Kingdom, the European Economic Area, or another authorised jurisdiction within the meaning of the Law, and not transfer Personal Data to any other jurisdiction without the prior written consent of the Controller, unless required to do so by applicable law. The Controller consents to processing by the Processor's personnel in the United Kingdom and by the Sub-Processors in the locations set out in Annex A. Where Personal Data is transferred to, or made accessible from, a jurisdiction that is not an authorised jurisdiction, the Processor shall ensure that the transfer is permitted by the Law. Transfers to a Sub-Processor in the United States shall be made only while that Sub-Processor is certified under the EU-US Data Privacy Framework or, where it is not certified or that framework ceases to apply, under standard data protection clauses recognised under the Law. The Processor shall keep a written record of its assessment of each such transfer and shall give the Controller details of the safeguards relied on upon request.

4.5 Notify the Controller without undue delay, and in any event within 24 hours, upon becoming aware of a Security Incident affecting Personal Data processed under this Agreement.

4.6 Assist the Controller in responding to requests from Data Subjects exercising their rights under the Law, including rights of access, rectification, erasure, and objection.

4.7 Within 60 days of the termination or expiry of this Agreement, delete or return all Personal Data, at the Controller's election, in accordance with clause 7.2.

4.8 Make available to the Controller all information reasonably necessary to demonstrate compliance with this Agreement and the Law.

5. Sub-Processors

5.1 The Controller provides general written authorisation for the Processor to engage the Sub-Processors listed in Part 5 of Annex A in connection with the Services.

5.2 The Processor shall notify the Controller in writing of any intended addition to or replacement of its Sub-Processors at least 14 days before the change takes effect. The Controller may object to the change on reasonable data protection grounds by written notice to the Processor within 14 days of that notification. If the Controller objects, the Parties shall discuss the objection in good faith and seek to resolve it. If the objection cannot be resolved, either Party may terminate this Agreement, and the Services affected by the change, by written notice to the other Party without penalty.

5.3 The Processor shall ensure that Sub-Processors are bound by data protection obligations equivalent to those set out in this Agreement.

6. Obligations of the Controller

The Controller agrees to:

6.1 Ensure that it has a lawful basis for processing Personal Data and for providing that data to the Processor.

6.2 Provide the Processor with clear and documented instructions regarding the processing of Personal Data.

6.3 Ensure that Data Subjects have been informed of the processing activities carried out under this Agreement where required by the Law.

7. Data Retention

7.1 The Processor shall retain Personal Data only for as long as is necessary to deliver the Services or as required by applicable law, as described in Part 4 of Annex A.

7.2 Within 60 days of the termination or expiry of this Agreement, the Processor shall, at the Controller's election, either securely delete or return all Personal Data and delete any remaining copies, unless applicable law requires the Processor to retain it. On termination or expiry, the Processor shall make a full export of the Controller's Personal Data available to the Controller for download for 60 days, after which the Personal Data shall be securely deleted. The Controller may ask the Processor to delete the Personal Data before the end of that period. If the Controller does not make an election, the Processor shall securely delete the Personal Data. Copies of Personal Data held in routine backups shall be deleted when those backups expire, which shall be no later than 30 days after the deletion of the live data, and shall remain subject to this Agreement until deleted.

8. Audit Rights

8.1 The Controller may, on reasonable written notice of no less than 14 days, request an audit of the Processor's data processing activities to verify compliance with this Agreement.

8.2 The Processor shall cooperate with any audit carried out in accordance with this clause 8 and provide reasonable access to relevant records, systems, and personnel.

8.3 The Controller may request an audit no more than once in any 12-month period, unless a Security Incident affecting the Controller's Personal Data has occurred, in which case the Controller may request an additional audit relating to that Security Incident.

8.4 Audits shall be carried out at the Controller's own cost and shall be conducted remotely, by document review, written questions, and video call, wherever reasonably possible. Any on-site audit shall take place during normal business hours and be carried out so as to minimise disruption to the Processor's business.

8.5 The Controller shall keep confidential all information obtained in the course of an audit and use it only to verify compliance with this Agreement and the Law. Any third party auditor appointed by the Controller must be bound by written confidentiality obligations before the audit begins.

9. Liability

9.1 Each Party shall be liable for its own breaches of this Agreement and of the Law.

9.2 The limits and exclusions of liability in clauses 10.1 to 10.3 of the Processor's Terms and Conditions of Service apply to this Agreement as if they were set out in it.

10. Term and Termination

10.1 This Agreement shall remain in force for the duration of the Services provided by the Processor to the Controller.

10.2 Either Party may terminate this Agreement on 30 days' written notice.

10.3 Termination of this Agreement does not affect either Party's obligations with respect to Personal Data processed prior to termination.

11. Governing Law

11.1 This Agreement shall be governed by and construed in accordance with the laws of the Bailiwick of Guernsey.

11.2 Any disputes arising under this Agreement shall be subject to the exclusive jurisdiction of the courts of the Bailiwick of Guernsey.

12. Acceptance

12.1 This Agreement is accepted electronically in Kitchen Savers, together with the Kitchen Savers Terms and the Processor's Terms and Conditions of Service, by a person authorised to act for the Controller. The Processor keeps a record of each acceptance, including who accepted, the date and the version accepted, and emails the Controller a copy.

Annex A: Details of Processing

This Annex forms part of the Agreement and sets out the details of the processing carried out by the Processor on behalf of the Controller.

Part 1: Categories of Personal Data

The Personal Data processed may include:

• Names of the Controller's staff who record checks
• Email addresses, roles and business of owners and managers
• Food-safety check records, with the time and the person who recorded each one
• Logs of sign-ins, corrections, exports and support access
• Export files created by the Controller

Part 2: Categories of Data Subjects

• Owners, managers, employees and workers of the Controller

Part 3: Nature and Purpose of Processing

• Subject matter: Personal Data processed in connection with the Services
• Nature: Collection, storage, retrieval, analysis, and transmission of data as required to deliver the Services, including the sending of reminders, alerts and login links by email
• Purpose: To enable the Processor to deliver the agreed Services to the Controller

Part 4: Retention Period

Personal Data is retained for the duration of the Services, and only for as long as is necessary to deliver them or as required by applicable law. Within 60 days of the termination or expiry of this Agreement, the Processor shall securely delete or return all Personal Data at the Controller's election, in accordance with clauses 4.7 and 7.2. The export provided under clause 7.2 consists of a set of spreadsheet files (one for each type of record), a signed PDF, and a machine-readable file. Copies held in routine backups are deleted when those backups expire, no later than 30 days after the live data is deleted.

Part 5: Sub-Processors

The Controller authorises the Processor to engage the following Sub-Processors under clause 5.1: