Last Updated: July 24, 2026
This Data Processing Agreement ("DPA") forms part of the agreement between you (the "Customer") and STARTAPP SOLUTIONS LIMITED ("StartApp", "we") for your use of the StartApp platform. It governs our processing of personal data relating to your customers (for example, the diners who order or book through your StartApp website or app) and reflects the requirements of Article 28 of the EU General Data Protection Regulation (GDPR). Where this DPA conflicts with our Terms of Service on the subject of data protection, this DPA prevails.
"Personal data", "processing", "controller", "processor", "data subject", and "sub-processor" have the meanings given in the GDPR. "Customer Personal Data" means personal data that StartApp processes on the Customer's behalf under the agreement.
For Customer Personal Data, the Customer is the controller and StartApp is the processor. Where StartApp engages another company to process Customer Personal Data, that company acts as a sub-processor. StartApp is an independent controller of the account data of the Customer itself, which is governed by our Privacy Policy rather than this DPA.
StartApp processes Customer Personal Data only to provide the platform. The details of the processing are:
StartApp processes Customer Personal Data only on the Customer's documented instructions, including as set out in the agreement and as given through the platform's features, unless required to do otherwise by EU or member-state law (in which case we will inform you, unless the law prohibits it). StartApp will not sell Customer Personal Data or use it for its own purposes.
StartApp ensures that personnel authorised to process Customer Personal Data are bound by an appropriate duty of confidentiality and process the data only as necessary to provide the service.
StartApp implements appropriate technical and organisational measures to protect Customer Personal Data, including encryption in transit, encrypted storage of sensitive credentials, access controls, isolation of stored files, and regular backups. These measures are described in our Privacy Policy and are kept under review.
The Customer authorises StartApp to engage the sub-processors listed in our Privacy Policy (including Stripe, Anthropic, Zoho, DigitalOcean, and Google Firebase). StartApp imposes data-protection obligations on each sub-processor no less protective than those in this DPA and remains responsible for their performance. We will give notice of any intended change of sub-processors so the Customer has the opportunity to object on reasonable data-protection grounds.
Taking into account the nature of the processing, StartApp will assist the Customer by appropriate technical and organisational measures — including self-service tools in the dashboard — to respond to requests from data subjects exercising their rights under the GDPR. If a data subject contacts StartApp directly, we will forward the request to the Customer.
StartApp will notify the Customer without undue delay after becoming aware of a personal data breach affecting Customer Personal Data, and will provide the information reasonably needed for the Customer to meet its own breach-notification obligations.
Where a sub-processor processes Customer Personal Data outside the European Economic Area, StartApp ensures an appropriate transfer mechanism is in place — primarily the European Commission's Standard Contractual Clauses.
StartApp makes available to the Customer the information reasonably necessary to demonstrate compliance with Article 28 GDPR and allows for and contributes to audits, conducted on reasonable prior notice and subject to confidentiality.
On termination of the agreement, StartApp will, at the Customer's choice, delete or return Customer Personal Data and delete existing copies, unless EU or member-state law requires continued storage. Residual copies in backups are deleted in the ordinary course, within 12 months.
This DPA is governed by the law of Ireland. Each party's liability under this DPA is subject to the limitations of liability in the Terms of Service. If any provision is found unenforceable, the remainder stays in effect.
For any question about this DPA or to exercise a right under it, contact us at support@startapp.solutions. See our Privacy Policy for the full list of sub-processors and security measures.