Status: Pre-launch draft for professional legal and privacy review. It is not an executed data processing agreement.
1. Roles and scope
For personal information a customer places in its Queux workspace, the intended position is that the customer determines the purpose and authorised use, while Queux processes that information to provide and protect the subscribed service. Applicable law may use different role names or impose additional duties.
These terms are intended to apply for the subscription term and any documented post-termination retention period.
2. Documented instructions
Queux should process customer data only on documented instructions expressed through the agreement, configured product use, authorised support request or other written direction, unless law requires otherwise. Queux should notify the customer if it reasonably believes an instruction is unlawful, subject to legal restrictions.
3. Processing details
- Subject matter: providing a multi-tenant kitchen-operations and recordkeeping service.
- Nature: collection, organisation, calculation, storage, retrieval, display, transmission, export, backup and deletion.
- Purposes: the configured meal-service workflow, security, support, subscription administration and customer-authorised integrations.
- Data subjects: authorised users, staff, service contacts and, only where authorised and necessary, people represented in limited operational dietary information.
- Data types: account and role data, operational counts, audit information, documents, training records, support content and configured integration data.
4. Confidentiality and access
People authorised to process customer data should be bound by confidentiality and receive access appropriate to their role. Queux should maintain administrative controls for support access and audit any elevated or impersonation capability.
5. Security measures
Intended measures include explicit organisation and site scope, policy checks, secure authentication, private uploads, encryption for appropriate data, secret hashing, webhook verification, rate limits, dependency maintenance, logging, backups and recovery procedures.
A final schedule should describe the deployed technical and organisational measures precisely, without claiming controls or certifications that have not been independently verified.
6. Subprocessors
Queux may appoint vetted subprocessors for hosting, email, payment, monitoring, support and customer-enabled integrations. Before launch, the agreement should include an accurate list or maintained register, locations, processing functions, contractual safeguards and a process for notifying customers of material changes.
7. Assistance
Taking account of the service and information available, Queux should reasonably assist the customer with data-subject requests, security incidents, impact assessments and regulator enquiries relating to the processing. Commercial limits and response procedures require final agreement.
8. Security incidents
Queux should notify the customer without undue delay after confirming a security incident affecting customer data, provide available information needed for the customer’s assessment, take reasonable containment and remediation steps, and preserve relevant evidence. The final terms must settle contact paths and any specific notice periods.
9. Return, export and deletion
On termination, the intended process is to provide an agreed export opportunity, then delete or de-identify customer data according to the contract, documented retention schedule, backup cycle and applicable law. An instruction cannot require silent alteration of immutable records during their required retention period.
10. Audit information
Queux should make reasonable information available to demonstrate the agreed controls and may use current independent reports where available. Audit rights, confidentiality, frequency, cost and safeguards against disrupting other tenants must be settled in the final agreement.
11. International transfers
No transfer location or legal mechanism should be assumed. The production region, subprocessor locations and any required contractual transfer safeguards must be confirmed and documented before commercial processing.
12. Order of precedence and contact
The final data-processing agreement should state how it interacts with the order, terms of service, privacy notice and any sector-specific schedule. Questions can be sent to support@queux.com.au.