Data Processing Agreement

including Cookie Policy and Sub-Processor List

Effective Date: 14 March 2026 | Version 1.0

This Data Processing Agreement (“DPA”) forms part of the Terms of Service between Coderdex Ltd. (“Processor”, “Company”, “we”, “us”) and the Customer accessing or using the Menucore platform (“Controller”, “you”). This DPA sets out the terms on which the Processor will process Personal Data on behalf of the Controller in connection with the provision of the Service.

This DPA is incorporated into and subject to the Menucore Terms of Service available at https://menucore.pro/terms-of-service. Capitalised terms not defined herein have the meanings given to them in the Terms of Service. In the event of any conflict between this DPA and the Terms of Service with respect to the processing of Personal Data, the terms of this DPA shall prevail.

By accessing or using the Service, the Controller agrees to the terms of this DPA. If the Controller does not agree, it must not use the Service.

1. Definitions

In this DPA, the following terms have the meanings set out below. Terms defined in applicable Data Protection Law shall have the meanings given to them therein.

“Controller” means the natural or legal person, public authority, agency, or other body which, alone or jointly with others, determines the purposes and means of the processing of Personal Data — in this context, the Customer.
“Data Protection Law” means all applicable legislation relating to data protection and privacy, including without limitation: (i) the EU General Data Protection Regulation (Regulation (EU) 2016/679) (“GDPR”); (ii) the UK GDPR and the UK Data Protection Act 2018; (iii) the Cyprus Law on the Protection of Natural Persons with regard to the Processing of Personal Data (Law 125(I)/2018); (iv) the California Consumer Privacy Act as amended by the California Privacy Rights Act (“CCPA/CPRA”); and (v) any other applicable national or state data protection legislation, as amended or replaced from time to time.
“Data Subject” means an identified or identifiable natural person whose Personal Data is processed under this DPA — in this context, primarily Authorised Users of the Controller.
“Personal Data” means any information relating to an identified or identifiable natural person, as defined under applicable Data Protection Law.
“Personal Data Breach” means a breach of security leading to the accidental or unlawful destruction, loss, alteration, unauthorised disclosure of, or access to, Personal Data transmitted, stored, or otherwise processed.
“Processing” means any operation or set of operations performed on Personal Data, whether or not by automated means, including collection, recording, organisation, structuring, storage, adaptation, retrieval, consultation, use, disclosure, dissemination, alignment, restriction, erasure, or destruction.
“Processor” means a natural or legal person, public authority, agency, or other body which processes Personal Data on behalf of the Controller — in this context, Coderdex Ltd.
“Restricted Transfer” means a transfer of Personal Data from the European Economic Area (“EEA”), the United Kingdom, or Switzerland to a third country or international organisation that is not subject to an adequacy decision under applicable Data Protection Law.
“Standard Contractual Clauses” or “SCCs” means the standard contractual clauses for the transfer of Personal Data to third countries adopted by the European Commission pursuant to Commission Implementing Decision (EU) 2021/914, as may be amended or replaced from time to time.
“Sub-Processor” means any third party engaged by the Processor to carry out specific processing activities on behalf of the Controller in connection with the Service.

2. Scope, Roles, and Nature of Processing

2.1 Roles

The parties acknowledge that, with respect to the processing of Personal Data in connection with the Service:

the Controller determines the purposes and means of processing and acts as data controller within the meaning of applicable Data Protection Law; and
the Processor processes Personal Data solely on behalf of and under the instructions of the Controller, acting as data processor within the meaning of applicable Data Protection Law.

2.2 Details of Processing

The subject matter, nature, purpose, and duration of processing, together with the types of Personal Data and categories of Data Subjects, are set out in Annex I to this DPA.

2.3 No Processing for Own Purposes

The Processor shall not process Personal Data for its own purposes, for the purposes of any third party, or for any purpose other than those specified in this DPA and the Terms of Service, except to the extent required by applicable law (in which case the Processor shall, to the extent permitted by law, inform the Controller in advance).

3. Obligations of the Processor

3.1 Processing on Instructions

The Processor shall process Personal Data only on documented instructions from the Controller, including with regard to transfers of Personal Data to a third country. The Terms of Service and this DPA constitute the Controller’s documented instructions as at the effective date of this DPA. The Controller may issue further instructions from time to time, provided that such instructions are consistent with this DPA and applicable Data Protection Law. The Processor shall promptly inform the Controller if, in its reasonable opinion, any instruction infringes applicable Data Protection Law.

3.2 Confidentiality of Processing

The Processor shall ensure that all persons authorised to process Personal Data are subject to a binding obligation of confidentiality with respect to such Personal Data, whether by contract, professional rules, or statutory obligation. Such obligation of confidentiality shall survive the termination of this DPA.

3.3 Technical and Organisational Security Measures

The Processor shall implement and maintain appropriate technical and organisational measures to ensure a level of security appropriate to the risks presented by the processing, taking into account: (i) the state of the art; (ii) the costs of implementation; (iii) the nature, scope, context, and purposes of processing; and (iv) the risks of varying likelihood and severity to the rights and freedoms of natural persons.

Such measures include, as applicable:

encryption of Personal Data in transit (TLS 1.2 or higher) and at rest;
ongoing confidentiality, integrity, availability, and resilience of processing systems;
the ability to restore availability and access to Personal Data in a timely manner in the event of an incident;
a process for regularly testing, assessing, and evaluating the effectiveness of security measures;
role-based access controls limiting access to Personal Data to authorised personnel only;
logical separation of Customer Data between tenants within the Service.

3.4 Sub-Processing

The Controller grants the Processor general written authorisation to engage the Sub-Processors listed in Annex II to this DPA. The Processor shall:

impose on each Sub-Processor data protection obligations substantially equivalent to those in this DPA, by way of a written contract;
remain fully liable to the Controller for the performance of each Sub-Processor’s obligations to the extent the Sub-Processor fails to fulfil its obligations;
provide the Controller with at least thirty (30) days’ prior written notice before engaging any new Sub-Processor or making material changes to existing Sub-Processor arrangements, by updating the Sub-Processor List at https://menucore.pro/sub-processors or by email notification;
allow the Controller to object to new or changed Sub-Processors within fourteen (14) days of receiving notice. If the Controller objects on reasonable Data Protection grounds and the Processor cannot resolve the objection, the Controller may terminate the affected portion of the Service on written notice without penalty.

3.5 Data Subject Rights Assistance

Taking into account the nature of the processing, the Processor shall assist the Controller, by appropriate technical and organisational measures, in fulfilling the Controller’s obligation to respond to requests from Data Subjects exercising their rights under applicable Data Protection Law (including rights of access, rectification, erasure, restriction, portability, and objection). The Controller acknowledges that certain Data Subject rights, such as account deletion, are available directly through the Service interface (via the “Delete Account” function). The Processor shall respond to requests from the Controller for assistance with Data Subject rights within a reasonable time and in any event within the timescales required by applicable law.

3.6 Assistance with Compliance Obligations

The Processor shall, upon reasonable written request and taking into account the nature of the processing and the information available to the Processor, assist the Controller in ensuring compliance with the Controller’s obligations under Articles 32 to 36 of the GDPR (or equivalent provisions under applicable Data Protection Law), including with respect to:

security of processing (Article 32 GDPR);
notification of a Personal Data Breach to supervisory authorities (Article 33 GDPR);
communication of a Personal Data Breach to Data Subjects (Article 34 GDPR);
data protection impact assessments (Article 35 GDPR);
prior consultation with supervisory authorities (Article 36 GDPR).

3.7 Personal Data Breach Notification

In the event of a confirmed or reasonably suspected Personal Data Breach affecting Personal Data processed under this DPA, the Processor shall:

notify the Controller without undue delay and, where feasible, within seventy-two (72) hours of becoming aware of the breach;
provide the Controller with sufficient information to allow the Controller to meet any obligations to report the breach to relevant supervisory authorities or affected Data Subjects, including: (i) the nature of the breach; (ii) the categories and approximate number of Data Subjects affected; (iii) the categories and approximate volume of Personal Data records affected; (iv) likely consequences of the breach; and (v) measures taken or proposed to address the breach.

The Processor’s notification of a breach shall not constitute an acknowledgement of fault or liability.

3.8 Data Protection Impact Assessments

Where a proposed processing activity is likely to result in a high risk to the rights and freedoms of natural persons, the Processor shall provide reasonable assistance to the Controller in carrying out a data protection impact assessment (“DPIA”) pursuant to Article 35 GDPR, to the extent such assistance requires information in the Processor’s exclusive possession.

3.9 Audit Rights

The Processor shall make available to the Controller all information reasonably necessary to demonstrate compliance with the obligations set out in this DPA, and shall allow for and contribute to audits and inspections conducted by the Controller or a third-party auditor mandated by the Controller, subject to the following conditions:

the Controller shall provide at least thirty (30) days’ prior written notice of any audit, unless a shorter notice period is required by a supervisory authority or necessitated by a Personal Data Breach;
audits shall be conducted during normal business hours, in a manner that minimises disruption to the Processor’s operations, and no more than once per calendar year (unless required by law or following a confirmed Personal Data Breach);
the Controller and its auditors shall keep confidential all information obtained during the audit;
as an alternative to a direct audit, the Processor may provide the Controller with relevant third-party certifications (e.g. ISO 27001, SOC 2) or audit reports that are reasonably sufficient to demonstrate compliance, provided such reports are subject to appropriate confidentiality obligations.

3.10 Deletion and Return of Personal Data

Upon termination or expiry of the Terms of Service, or upon written request by the Controller, the Processor shall, at the Controller’s election:

delete all Personal Data (including copies) from its systems and those of its Sub-Processors; or
where technically feasible, return all Personal Data to the Controller in a commonly used, machine-readable format.

The Processor shall complete such deletion or return within ninety (90) days of the termination date and shall provide written confirmation to the Controller upon completion. The Processor may retain Personal Data to the extent required by applicable law, in which case such data shall remain subject to the obligations of this DPA and shall be deleted as soon as retention is no longer legally required.

4. Obligations of the Controller

The Controller represents, warrants, and undertakes that:

it has a valid legal basis under applicable Data Protection Law for each category of processing described in Annex I, including, where required, obtaining the informed consent of Data Subjects;
it will provide Data Subjects with all required privacy notices and information regarding the processing of their Personal Data, including the information required under Articles 13 and 14 of the GDPR (or equivalent provisions), by reference to the Menucore Privacy Policy and this DPA;
all Personal Data submitted to the Service is accurate, kept up to date, and not excessive in relation to the purposes of processing;
it will comply with all applicable Data Protection Law in connection with its use of the Service and its own processing activities;
it will not instruct the Processor to process Personal Data in a manner that would cause either party to violate applicable Data Protection Law;
it will promptly notify the Processor of any changes to its instructions that may affect the Processor’s compliance obligations.

5. International Data Transfers

5.1 Transfers to Third Countries

The Processor’s Sub-Processors, as listed in Annex II, are located in the United States of America. Processing of Personal Data by these Sub-Processors involves Restricted Transfers from the EEA, the United Kingdom, and Switzerland to the United States.

5.2 Transfer Mechanisms

All Restricted Transfers to Sub-Processors are conducted on the basis of one or more of the following lawful transfer mechanisms:

Standard Contractual Clauses (Module Two: Controller to Processor) adopted by the European Commission pursuant to Implementing Decision (EU) 2021/914, incorporated into the contractual arrangements between the Processor and each Sub-Processor;
the UK International Data Transfer Addendum to the EU SCCs, issued by the UK Information Commissioner’s Office pursuant to Section 119A of the UK Data Protection Act 2018, for transfers from the United Kingdom;
such other transfer mechanism as may be approved from time to time under applicable Data Protection Law.

5.3 Controller as Exporter

Where the SCCs apply to Restricted Transfers covered by this DPA, the Controller acts as the data exporter and the Processor (or, where applicable, the relevant Sub-Processor) acts as the data importer. The details of the processing relevant to the SCCs are as set out in Annex I and Annex II of this DPA.

5.4 Updates to Transfer Mechanisms

The Processor shall promptly update the transfer mechanisms described in this Section 5 to reflect any changes to applicable Data Protection Law or supervisory authority guidance relating to international transfers, and shall notify the Controller of any material changes to such mechanisms.

6. Cookie Policy

6.1 What Are Cookies

Cookies are small text files placed on a user’s device by a website or application. The Service uses cookies and similar tracking technologies for the purposes described in this Section 6. This Cookie Policy applies to all Authorised Users accessing the Service and forms part of this DPA.

6.2 Legal Basis for Cookies

The legal basis for placing cookies depends on their category:

Strictly Necessary cookies: placed on the basis of legitimate interests (Article 6(1)(f) GDPR) or, where applicable, as necessary for the performance of the contract (Article 6(1)(b) GDPR). These cookies do not require consent as they are essential to the operation of the Service;
Functional cookies: placed on the basis of the Controller’s and the Authorised User’s legitimate interests in a consistent and personalised user experience (Article 6(1)(f) GDPR);
Analytics cookies: placed on the basis of the Authorised User’s consent (Article 6(1)(a) GDPR), obtained through the cookie consent mechanism presented upon first access to the Service.

6.3 Cookie Register

The following cookies are currently used by the Service:

Cookie Name	Category	Provider	Duration	Purpose
sb-access-token / sb-refresh-token	Strictly Necessary	First-party (Supabase)	Session / up to 1 year	Maintains the authenticated user session. Without this cookie the user cannot remain logged in between page loads.
mc_consent	Strictly Necessary	First-party (Menucore)	180 days	Stores the Authorised User’s cookie consent preferences so they can be honoured across all Menucore subdomains without repeated prompts.
g_state / g_csrf_token	Strictly Necessary	First-party (Google OAuth)	Session	Used by Google Sign-In to prevent cross-site request forgery (CSRF) during the OAuth 2.0 authentication flow.
mc_ui_prefs	Functional	First-party (Menucore)	1 year	Stores non-personal interface preferences such as selected view type (e.g. grid or list) and last-visited page section to improve usability across sessions.
_ga / _ga_*	Analytics	Third-party (Google Analytics 4)	2 years / 1 year	Used by Google Analytics to distinguish unique users and sessions, and to generate aggregated statistical reports about Service usage. No personally identifiable information is stored.
_gid	Analytics	Third-party (Google Analytics 4)	24 hours	Used by Google Analytics to distinguish users within a session window.

6.4 Managing and Withdrawing Consent

Authorised Users may manage cookie preferences, including withdrawing consent for Analytics cookies, at any time through:

the cookie consent banner displayed upon first access to the Service; or
their web browser settings (by blocking or deleting cookies). Please note that disabling Strictly Necessary cookies will impair the functionality of the Service and may prevent Authorised Users from remaining logged in.

Instructions for managing cookies in commonly used browsers are available from the browser developer’s official documentation. Withdrawal of consent for Analytics cookies does not affect the lawfulness of processing based on consent before its withdrawal.

6.5 Third-Party Analytics

The Service uses Google Analytics 4, operated by Google LLC. Google Analytics collects anonymised and aggregated data about usage of the Service (such as page views, session duration, and general geographic region) to help the Processor understand how the Service is used and how it can be improved. The Processor has enabled IP anonymisation within Google Analytics, meaning that full IP addresses are not stored by Google. Google Analytics data is processed by Google in the United States under Standard Contractual Clauses. For further information, please refer to Google’s Privacy Policy at https://policies.google.com/privacy.

6.6 Updates to Cookie Policy

The Processor may update this Cookie Policy from time to time to reflect changes to the cookies used by the Service, changes in applicable law, or changes in the Sub-Processors providing tracking technologies. Material changes will be communicated through the cookie consent mechanism upon the next session.

7. Term and Termination

This DPA shall remain in force for the duration of the Terms of Service and shall automatically terminate upon the termination or expiry of the Terms of Service, subject to the obligations of Section 3.10 (deletion and return of Personal Data) and Section 3.2 (confidentiality), both of which shall survive termination.

8. Liability

Each party’s liability under this DPA is subject to the limitations and exclusions set out in the Terms of Service. Nothing in this DPA limits either party’s liability where such limitation is not permitted under applicable Data Protection Law, including liability arising from a party’s intentional breach of this DPA or gross negligence in connection with the processing of Personal Data.

Where both parties are liable to a Data Subject for the same damage arising from a breach of applicable Data Protection Law, they shall be jointly and severally liable, with the right to recover from the other party the portion of the compensation corresponding to that party’s share of responsibility for the damage.

9. General Provisions

9.1 Order of Precedence

In the event of any conflict between this DPA and the Terms of Service with respect to the processing of Personal Data or Data Protection obligations, this DPA shall prevail. In the event of any conflict between this DPA and the SCCs, the SCCs shall prevail with respect to Restricted Transfers.

9.2 Governing Law

This DPA shall be governed by and construed in accordance with the laws of the Republic of Cyprus, without prejudice to the mandatory provisions of the GDPR and other applicable Data Protection Law that cannot be derogated from by agreement.

9.3 Amendments

The Processor may amend this DPA from time to time to reflect changes in applicable Data Protection Law, supervisory authority guidance, or operational requirements. Material amendments will be communicated to Controllers with at least thirty (30) days’ prior notice in accordance with the notice provisions in the Terms of Service. Continued use of the Service following the effective date of an amendment constitutes acceptance.

9.4 Severability

If any provision of this DPA is found to be invalid or unenforceable, the remaining provisions shall continue in full force and effect.

9.5 Entire Agreement on Data Processing

This DPA, together with the Terms of Service, the Privacy Policy, and the Annexes hereto, constitutes the entire agreement between the parties with respect to the processing of Personal Data in connection with the Service and supersedes all prior agreements and understandings relating to the same subject matter.

Annex I — Details of Processing

Pursuant to Article 28(3) GDPR and Clause 9 of the Standard Contractual Clauses

A. Parties

Data Exporter (Controller): The Customer as identified by the account registration details provided to the Service. Data Importer (Processor): Coderdex Ltd., operator of the Menucore platform, email: support@menucore.pro.

B. Subject Matter and Duration of Processing

The Processor processes Personal Data on behalf of the Controller for the duration of the Terms of Service, solely to provide, maintain, support, and improve the Menucore platform and related services.

C. Nature and Purpose of Processing

Account creation, authentication, and user session management;
Provision of the Service features including ingredient management, recipe costing, and menu analytics;
Customer support and communication;
Service security monitoring, fraud prevention, and abuse detection;
Aggregated, anonymised analytics to improve the Service (Google Analytics 4);
Compliance with legal obligations.

D. Categories of Personal Data

Category	Specific Data Elements	Collected By
Identity Data	First name, last name (optional), email address	Controller / Google OAuth
Business Data	Company name, restaurant or business name (optional)	Controller
Authentication Data	Hashed passwords (Supabase Auth); OAuth tokens (Google Sign-In). Plaintext passwords are never stored.	Supabase / Google
Usage & Technical Data	IP address, browser type, operating system, session logs, feature interaction events, approximate geographic region (anonymised)	Processor / Google Analytics
Customer Operational Data	Ingredient names and costs, recipe data, menu items and pricing — this data is not Personal Data but is processed as Customer Data under the Terms of Service	Controller

Note: Billing and payment data (including VAT numbers, billing addresses, and payment card details) are collected and processed exclusively by Paddle.com Market Limited in its capacity as Merchant of Record. The Processor does not receive, store, or process payment or billing Personal Data.

E. Categories of Data Subjects

Authorised Users of the Controller (employees, contractors, or agents of the Controller’s business who access the Service);
Account holders who register directly via the Service website.

F. Special Category Data

The Processor does not intentionally process special category data (as defined under Article 9 GDPR) or data relating to criminal convictions and offences. The Controller must not submit such data to the Service.

G. Retention Period

Personal Data is retained for the duration of the active account and for up to ninety (90) days following account deletion or termination of the Terms of Service, unless a longer period is required by applicable law. Usage and analytics data collected via Google Analytics is subject to Google’s own retention settings, configurable by the Processor within the Google Analytics interface (default: 14 months).

Annex II — Approved Sub-Processors

Current as of 14 March 2026. Subject to updates at https://menucore.pro/sub-processors

The Controller hereby authorises the Processor to engage the following Sub-Processors in connection with the provision of the Service:

Sub-Processor	Country	Processing Activity	Transfer Mechanism
Vercel Inc.	United States	Application hosting and content delivery	Standard Contractual Clauses (SCCs)
Supabase Inc.	United States	Database hosting, authentication (user/password), and backend infrastructure	Standard Contractual Clauses (SCCs)
Google LLC	United States	Authentication services (Google Sign-In / OAuth 2.0)	Standard Contractual Clauses (SCCs)
Google LLC	United States	Web analytics (Google Analytics 4)	Standard Contractual Clauses (SCCs)
Paddle.com Market Limited	United Kingdom	Payment processing and subscription management (Merchant of Record — does not receive Customer Data from the Service)	UK GDPR adequacy / SCCs

The Processor maintains an up-to-date Sub-Processor list at https://menucore.pro/sub-processors. The Controller may subscribe to receive email notifications of changes to this list by contacting support@menucore.pro.