Skip to content
SlicewiseStart free trial

Data processing agreement

Last updated 28 October 2026

This agreement forms part of the terms of service between Resourcewise Consultancy Ltd (the “Processor”) and the business using Slicewise (the “Controller”), and applies to the personal data of the Controller's customers and staff that the Processor handles on the Controller's behalf. It reflects Article 28 of the UK GDPR.

Subject matter

  • What: hosting and operating the ordering website, kitchen and driver screens and back office.
  • Data: customer names, email, phone, delivery addresses, order history, loyalty points, marketing preferences; staff names, emails and roles.
  • Duration: while the Controller's account is open, plus up to 30 days after closure for export, then deletion.

The Processor will

  • process the data only on the Controller's documented instructions (the Controller's use of the product), unless the law requires otherwise;
  • make sure people with access are bound by confidentiality;
  • keep the data secure: separation between businesses, encrypted connections and stored secrets, hashed passwords, two-step sign-in, access control by role, activity logging and backups;
  • use sub-processors (hosting, email delivery) only with equivalent protections, and tell the Controller of changes;
  • help the Controller respond to data-subject requests: the product includes customer data export, account closure with a recovery window, and erasure;
  • tell the Controller without undue delay (and within 48 hours) after becoming aware of a personal data breach, and help with assessments and notifications;
  • on closure, return (export) and then delete the data, and allow audits on reasonable notice.

The Controller will

Have a lawful basis for the processing, give its customers a privacy notice (the product provides a template), and use the product's retention and erasure tools appropriately.

Retention built into the product

Customer accounts closed by the customer are erased after 30 days; personal details on orders are wiped after 6 years; staff activity logs are deleted after 12 months; expired sessions and reset links daily.

This is a template: have it reviewed by a solicitor before relying on it.