Mealround
Book a demo

This agreement sets out how Teddys Ventures Limited, trading as Mealround, processes personal data for a customer under UK GDPR Article 28. It forms part of the customer’s Mealround Subscription Agreement.

1. Parties and scope

1.1 The Customer is the meals service named on the Order Form. The Customer decides why and how its customers’ personal data is used, so it is the data controller.

1.2 Mealround means Teddys Ventures Limited, registered in England and Wales (company no. 17175500), registered office Suite 6, The Workshop, Wharf Road, Eastbourne, East Sussex, BN21 3FG. Mealround is registered with the Information Commissioner’s Office, registration number ZC275505. Mealround processes personal data only to provide the Mealround service to the Customer, so it is the data processor.

1.3 This agreement covers all personal data Mealround processes for the Customer through the Mealround service, as described in Schedule 1. If it conflicts with the Subscription Agreement on data protection, this agreement wins.

1.4 Words such as personal data, processing, controller, processor, data subject and personal data breach have the meanings given in the UK GDPR and the Data Protection Act 2018.

2. Mealround’s obligations

Mealround will:

  1. Process the personal data only on the Customer’s documented instructions. Using the Mealround service as designed, and this agreement, count as those instructions. If Mealround believes an instruction breaks data protection law, it will tell the Customer.
  2. Make sure everyone at Mealround who can access the data is bound by a duty of confidentiality and only accesses it when needed to support the Customer.
  3. Keep the data secure using the measures in section 3.
  4. Not use the data for its own purposes, sell it, or share it with anyone except the sub-processors in Schedule 2.
  5. Keep the data in the UK. Mealround will not transfer it outside the UK without the Customer’s written agreement and appropriate safeguards.
  6. Help the Customer respond to requests from data subjects, mainly by giving the Customer the tools in Mealround to find, export, correct and delete records.
  7. Give reasonable help with data protection impact assessments and any consultation with the ICO, where this relates to the Mealround service.
  8. Make available the information reasonably needed to show it meets this agreement.

3. Security

  • UK hosting: the service and its database run on Microsoft Azure in the UK South (London) region.
  • Encryption at rest: stored data and backups are encrypted (Azure SQL transparent data encryption).
  • Encryption in transit: all connections to Mealround use HTTPS.
  • Backups: the database is backed up automatically and can be restored to any point in the last 35 days. Backups are encrypted and kept in the UK.
  • Separation: each customer can see only its own data.
  • Access: office staff sign in with their own login. Drivers sign in with a mobile number and PIN and see only the round they are on that day. The Customer controls who has access and can remove it at any time.
  • Support access: Mealround staff access a customer’s data only to set up, support or fix the service.
  • Updates: Mealround keeps the service up to date and applies security fixes promptly.

4. Sub-processors

4.1 The Customer agrees that Mealround may use the sub-processors listed in Schedule 2.

4.2 Mealround will give the Customer at least 30 days’ notice by email before adding or replacing a sub-processor. If the Customer has a reasonable data protection objection and the parties cannot resolve it, the Customer may end the subscription without penalty.

4.3 Mealround will have a written contract with each sub-processor that protects the data at least as well as this agreement, and stays responsible to the Customer for what its sub-processors do.

5. Personal data breaches

5.1 Mealround will tell the Customer without undue delay, and in any case within 48 hours, after becoming aware of a personal data breach affecting the Customer’s data.

5.2 The notice will say, as far as known at the time: what happened, which data and roughly how many people are affected, the likely consequences, and what Mealround has done or will do about it.

5.3 Mealround will help the Customer meet its own duty to report to the ICO within 72 hours and to tell affected people where needed.

6. End of the agreement

6.1 The Customer can export its data from Mealround at any time. When the subscription ends, Mealround will also send a full export on request.

6.2 Within 30 days after the subscription ends, Mealround will delete the Customer’s personal data from the live service, unless the law requires Mealround to keep it.

6.3 Copies in automatic backups are deleted as those backups expire on their normal cycle, within a further 35 days. Until then they stay encrypted and are not used.

6.4 Mealround will confirm in writing when deletion is complete.

7. Audits, liability, term and law

7.1 Audits: Mealround will answer the Customer’s reasonable written questions about its data protection and security, including supplier questionnaires. If those answers are not enough, the Customer may carry out an audit once a year, on 30 days’ notice, at its own cost.

7.2 Liability: each party’s liability under this agreement is as set out in the Subscription Agreement. Nothing limits liability that cannot be limited by law.

7.3 Term: this agreement lasts as long as Mealround processes personal data for the Customer, including the deletion period in section 6.

7.4 Law: this agreement is governed by the law of England and Wales.

Schedule 1: Details of processing

  • Subject matter: running the Customer’s meals service in Mealround: orders, menus, kitchen counts, delivery rounds, welfare checks, family updates, invoicing and payments.
  • Duration: the subscription term, plus the deletion period in section 6.
  • Data subjects: the Customer’s meal recipients; their next of kin and family contacts; the Customer’s staff, drivers and volunteers.
  • Personal data: names, addresses, phone numbers and email addresses; delivery days and access notes; orders and menu choices; invoices and payment status; driver sign-in details, rounds, hours and mileage.
  • Special category data: health-related information the Customer chooses to record: diets, allergies, texture-modified meals, medical or mobility notes, and welfare notes.
  • Where processed: United Kingdom (Microsoft Azure, UK South).

Schedule 2: Sub-processors

  • Microsoft (Azure): hosting, database and backups, UK.
  • Microsoft (Microsoft 365): email between Mealround and the Customer.
  • Stripe and GoCardless: card and Direct Debit payments, where the Customer uses online payments.
  • Text message provider: sends driver links and family updates [name to confirm].