Terms and Conditions

1. Our agreement with your business

These terms govern business use of JAWA MENU by the business named during setup ("you" or "the business"). The service provider ("we", "us" or "JAWA MENU") is the legal operator identified in Provider and contact details. The person completing setup confirms that they have authority to bind the business.

The agreement consists of these service terms, the Data Processing Schedule and any expressly agreed written order or service schedule. The Data Processing Schedule takes priority for personal data processing. Mandatory legal rights and obligations continue to apply.

The agreement begins when setup is successfully completed after explicit acceptance at the final step. We record the accepting account, business, time and edition of the terms. Acceptance is contractual agreement, not consent on behalf of customers or staff.

2. Accounts, security and acceptable use

Provide accurate business and account information and keep it current. Give access only to authorised people, use appropriate roles, protect passwords and PINs, and tell us promptly if you suspect unauthorised access. You are responsible for instructions given by people you authorise; our own security duties remain unchanged.

Use the service lawfully for your business. Do not access another business's records without authority, circumvent access controls, introduce malicious code, disrupt the service, or upload material you have no right to use. You remain responsible for your products, prices, tax treatment, food safety, order accuracy and customer communications.

3. Service, plans and charges

JAWA MENU provides the functions made available to your business, subject to its plan and documented limits. Features marked as previews or coming soon are not contractual commitments. Telephone provisioning may require platform approval.

Current plan information is shown on the Pricing page. Free setup does not authorise a paid subscription. Paid service requires a separate confirmed order setting out charges, taxes, billing frequency, renewal and cancellation arrangements before any payment obligation begins. Displayed future prices do not authorise charging your account.

We will use reasonable care and skill to provide the service. Maintenance, network failures and third-party services can affect availability. No uninterrupted-service guarantee or service-level commitment applies unless expressly agreed in writing. Keep appropriate operational contingency arrangements and authorised copies of essential records.

4. Your records and lawful use of data

You retain your rights in the business content you provide. You grant us permission to handle it only as needed to provide the service, follow your lawful instructions and meet applicable legal obligations. We retain rights in our software and branding and grant you a limited right to use them as part of the service during this agreement.

Your business must identify and document a lawful basis for each use of personal data and give customers and staff appropriate privacy information when required. Collect only information necessary for a defined purpose, keep it accurate, restrict access and set justified retention periods. Names, phone numbers, addresses, identifiable order histories and precise locations are personal data; replacing a name with an ID does not automatically make them anonymous.

Necessary order processing and transactional messages do not automatically authorise promotions, profiling or indefinite retention. Promotional email and SMS must meet applicable UK GDPR and PECR rules, with separate consent where required or a valid statutory exception. Customers must be able to exercise their applicable marketing opt-out rights.

Allergy notes may reveal health information. Record such information only when necessary, with both a lawful basis and a valid special-category condition, and limit it to people who need it for preparation or delivery. The owner's acceptance of these terms is not a customer's explicit consent.

These terms do not authorise a global customer directory, cross-business disclosure or sale of customer data. Any such future purpose needs its own legal assessment, transparency and controls before it is enabled. Reporting should use appropriately assessed anonymous aggregates wherever practicable; identifiable or pseudonymous reports remain protected personal data.

5. Suspension, ending the service and responsibility

Either party may end a free service by written notice using the contact details below. Any agreed paid order must specify its notice period and cancellation rules. We may restrict or suspend access where reasonably necessary to contain a security incident, comply with law or address a material breach. Where practicable, we will explain the reason and allow a reasonable opportunity to remedy it.

Ending or suspending access does not itself delete personal data. The return, deletion and any legally required retention of business data are governed by the Data Processing Schedule. Agree an export and closure process before ending use where business records are needed.

Each party is responsible for loss caused by its breach of this agreement, subject to applicable law. Neither party excludes liability for fraud, death or personal injury caused by negligence, or any liability that cannot lawfully be excluded. Nothing limits individuals' statutory data protection rights, regulatory powers or either party's direct obligations under data protection law. Any further commercial liability limits must be expressly agreed in writing.

6. Changes, questions and governing law

We will identify revised terms by a new version and communicate material changes before they take effect. The version accepted by your business remains the record of that agreement; a page update alone is not evidence of renewed acceptance. A materially different processing purpose requires its own lawful basis, information and arrangements.

Contact us first about a service or contractual concern. This business agreement is governed by the law of England and Wales and its courts have jurisdiction, subject to mandatory applicable law. This does not restrict a person's right to complain to a competent data protection authority or exercise statutory rights.

7. Data Processing Schedule

This schedule forms part of the agreement for processing covered by Article 28 of the UK GDPR and, where applicable, the EU GDPR. References to data protection law include the UK GDPR, the Data Protection Act 2018 as amended, and applicable electronic communications rules.

7.1 Roles, scope and duration

Your business is the controller of the customer, order, delivery and staff information it determines how and why to use. We act as processor when handling that information on your behalf. Actual purposes and decisions determine the parties' roles; these labels do not authorise us to decide unrelated purposes for your customers' data.

Subject matter and purpose

Providing and supporting the business's MENU, order fulfilment, receipts, authorised communications and business reporting.

Processing operations

Collection, recording, storage, organisation, retrieval, authorised disclosure, correction, export, restriction and deletion as instructed for available service functions.

People concerned

Customers, delivery recipients, business owners, staff and other authorised business contacts.

Data categories

Necessary names and contact details, delivery addresses and location information where used, order and transaction records, permitted preparation instructions (including allergy or other health information only where lawfully instructed under section 4), staff access records, call metadata, device/session information and support records. Do not submit full card credentials or unnecessary sensitive information.

Duration

The service period and the limited period needed to complete the business's return/deletion instructions, subject to documented legal retention duties and the confirmed retention schedule below.

7.2 Instructions and confidentiality

We will process business personal data only on your documented lawful instructions, including for international transfers, unless UK law requires otherwise (or Union or Member State law where EU GDPR applies). Where legally permitted, we will inform you of that requirement before processing. We will inform you immediately if we consider an instruction to infringe applicable data protection law.

Access must be limited to authorised people who need it for the service and who are bound by appropriate confidentiality obligations. Your business remains responsible for lawful instructions, suitable access permissions, privacy information and responding to individuals, with our assistance as set out below.

7.3 Security

We will implement and maintain technical and organisational measures appropriate to the risk, taking account of the nature of the data and processing. These must address confidentiality, integrity, availability, access control, recovery and regular assessment of their effectiveness. The confirmed security schedule below must describe the measures actually operated for the deployment; this agreement does not represent that unimplemented controls are already in place.

7.4 Subprocessors and international transfers

Your business gives general written authorisation only for subprocessors identified in the confirmed supplier schedule below. Before adding or replacing a subprocessor, we will give advance written notice sufficient to allow a reasonable data protection objection and resolve it before the new processing begins. If no acceptable solution is available, the affected processing must not proceed and the parties may end the affected service.

We will impose equivalent data protection duties on each subprocessor through a written contract and remain responsible to you for its performance of those duties. Restricted international transfers require a valid applicable mechanism, required assessments and safeguards. We will make information about locations and safeguards available to you; no UK-only hosting assurance is implied.

7.5 Rights, incidents and compliance assistance

Taking account of the nature of processing, we will assist you through appropriate measures to respond to requests for access, correction, erasure, restriction, portability and objection where those rights apply. We will forward relevant requests received directly to your nominated contact and follow lawful instructions, unless law requires us to act otherwise.

We will notify your business without undue delay after becoming aware of a personal data breach affecting data processed on your behalf, provide available information as it is established, and reasonably assist containment, assessment and required notifications. Your business remains responsible for assessing its own regulator and individual notification obligations.

Taking account of the processing and information available to us, we will assist with security duties, breach notifications, data protection impact assessments and consultation with regulators where required. We will make compliance information available and allow and contribute to audits and inspections by you or your appointed auditor, subject to proportionate confidentiality and security arrangements that do not frustrate these rights.

7.6 Retention, return and deletion

Your business must set justified retention instructions by purpose and record category. On ending the service, we will, at your choice, return or delete personal data and delete existing copies unless UK law requires storage (or Union or Member State law where EU GDPR applies). Where retention is legally required, we will identify the requirement where permitted, restrict further use and protect the retained information.

Erasure instructions must consider historical order snapshots, delivery details, free-text instructions, call data, email copies, logs, caches and managed exports, as well as directory records. Deleting an address-book entry alone does not erase all order records. Backup data awaiting scheduled expiry must be protected and put beyond operational use, with erased information prevented from being reintroduced during restoration.

Financial recordkeeping may justify retaining particular transaction information; it does not automatically justify keeping every delivery address or health instruction for the same period. The agreed schedule must specify retention criteria or periods, backup expiry and the practical request/export process. An automated erasure or export tool is not promised by these terms.

7.7 Deployment schedules

The following details must be confirmed with your business before production personal data is processed. A missing schedule does not authorise unspecified suppliers, transfers or indefinite retention.

Subprocessors, purposes and locations

Pending confirmation before production use.

International transfers and safeguards

Pending confirmation before production use.

Retention, backup expiry and return/deletion process

Pending confirmation before production use.

Technical and organisational security measures

Pending confirmation before production use.

8. Account privacy information

The operator identified below acts as controller for its own account administration, service security, contractual acceptance evidence, support and legal records. This is distinct from processing your customers' data on your business's behalf.

We collect the account and business details you submit, password authentication records, session/device information, security events, acceptance details and any support correspondence you provide. We use necessary details to establish and perform the service contract, comply with legal obligations where they apply, and pursue legitimate interests in securing the service, preventing misuse and handling business support. Where an account represents a company, handling its representative's contact details is based on those legitimate business administration interests unless another basis applies.

Required signup fields are needed to create and secure your account and business; without them setup cannot complete. Credentials must be protected and are not used for advertising. This onboarding flow does not make solely automated decisions producing legal or similarly significant effects about individuals.

Authorised service personnel and relevant hosting, database, communications and support providers may receive only data needed for their role; disclosures may also be made where law requires. The confirmed schedules above set out actual suppliers, locations, safeguards and retention. Account and acceptance records are kept only while needed for the service, justified security purposes, legal duties or establishing and defending legal claims, according to the confirmed retention schedule.

You may request access, correction, erasure, restriction or portability where applicable. You may object to processing based on legitimate interests, and to direct marketing at any time. Where any separate processing relies on consent, you may withdraw it without affecting earlier lawful processing. Rights have legal conditions and exceptions. Contact the operator below; identity checks may be needed. We will respond within the applicable statutory period, normally one month, subject to permitted timing rules and extensions.

You may also complain to the Information Commissioner's Office or another competent supervisory authority. Customers with questions about a takeaway's use of their information should contact that business as controller; we will assist the business where required.

The service uses session cookies needed for authentication and access security, and may store your chosen interface theme locally. These terms do not authorise optional tracking or marketing cookies. Any future optional processing requires appropriate notice and any legally required separate choice.

9. Provider and contact details

Legal service provider

JAWA AI LTD

Company number

15815826

Business / registered address

53 Dorcas Avenue, Newcastle Upon Tyne, United Kingdom, NE15 6SL

Service and privacy enquiries

[email protected]