Processing agreement

[to confirm: draft] Draft of 23 October 2026, written to article 28 of the General Data Protection Regulation (GDPR). Before publication the points marked [to confirm] are filled in and the text is checked by a lawyer. The Dutch version (verwerkersovereenkomst) prevails; this translation is for convenience.

1. Parties and scope

1. This agreement is made between you, the business customer of Mealbooks (controller), and Sevenhills Software, a sole trader (eenmanszaak) of Subhashini Sivasubramani, Saturnus 16, 1188 EC Amstelveen, Netherlands, KVK 42162009 (processor, “we”).
2. It is part of the agreement about Mealbooks (terms of use). You accept it together with the terms when you sign up, by ticking the box on the sign-up form; we record when and which version.
3. It covers the personal data you keep in Mealbooks about others. For the data about you as our customer we are the controller ourselves; see the privacy policy. If this agreement and the terms of use conflict on data protection, this agreement prevails.

2. Subject, nature, purpose and duration

1. We process personal data on your behalf only to provide Mealbooks to you: storing it, showing it to your users, making invoices, credit notes, PDFs, e-invoice files and printouts, sending the e-mails you have Mealbooks send (such as order confirmations and payment reminders), looking up delivery addresses when you use Route Planning, backups, and support you ask for.
2. This agreement lasts as long as you use Mealbooks and ends when all personal data we process for you has been deleted (article 10).

3. Data subjects and personal data

Mealbooks is not meant for special categories of personal data (article 9 GDPR), such as data about a person’s health. You will not enter them; allergens are recorded per dish, not per person.

4. Your instructions

1. We process the data only on your documented instructions: this agreement, the terms of use, the use of Mealbooks as you set it up, and what you ask us in writing. This includes transfers to a third country (article 7).
2. We do not use the data for our own purposes. If we think an instruction breaks the GDPR or other data protection law, we tell you immediately.
3. We process data without your instruction only when EU or Dutch law requires it; we then tell you first, unless that law forbids it.

5. Confidentiality

Everyone who has access to the data for us is bound to confidentiality. Today that is only Sevenhills Software’s owner. We look at your data only when needed for support you ask for, for security, or because the law requires it.

6. Security (article 32 GDPR)

We take appropriate technical and organisational measures, among them:

• every company sees only its own data; access only after signing in; passwords stored only as a one-way hash;
• an account lock after 5 wrong passwords, optional two-step sign-in with a code by e-mail, limits on requests;
• encrypted connections (HTTPS) and hosting in the EU or EEA;
• nightly backups, removed within 30 days;
• uploaded photos made smaller and stripped of hidden details (such as location);
• a chained record per company of every issued invoice, credit note, payment and payment reversal and of the monthly and yearly closings: each entry holds a SHA-256 fingerprint of the one before it, so a later change or removal shows up when the chain is checked; issued invoices, credit notes and payments are not changed or deleted afterwards;
• logging of security events, and changes to the software tested before they go live.

We review these measures regularly and may change them, as long as the level of security does not go down.

7. Sub-processors and transfers

1. You give general written permission for these sub-processors:

2. Mollie handles the payment of your own subscription as an independent controller and receives none of your customers’ data.
3. We tell you by e-mail at least 30 days before we add or replace a sub-processor. You can object within that period, with reasons; if we cannot meet the objection, you can end the agreement before the change, without costs.
4. We impose the same data protection obligations on every sub-processor by contract. We remain fully liable to you for their performance (article 28(4) GDPR).
5. Personal data is transferred outside the European Economic Area only with a safeguard from chapter V GDPR (such as an adequacy decision or standard contractual clauses).

8. Assistance

1. Requests from data subjects: you can view, correct, export (CSV) and delete most data in Mealbooks yourself. Where you cannot, we help within a reasonable time. A request we receive directly we forward to you without answering it ourselves. Issued invoices, credit notes and payments cannot be changed or deleted in Mealbooks, and their chained record (article 6) is kept as long as your account exists; the right to erasure does not apply to data you must keep by law (article 17(3)(b) GDPR).
2. We help you, taking into account the information we have, with security, data protection impact assessments and prior consultation of a supervisory authority (articles 32 to 36 GDPR), and we cooperate with the supervisory authority.
3. We keep a record of the processing we carry out for our customers (article 30(2) GDPR).

9. Personal data breaches

1. If we discover a personal data breach affecting your data, we notify you without undue delay and at the latest within 48 hours after discovering it, by e-mail to the address in your account.
2. We tell you what we know and add to it as we learn more: what happened, which categories and approximate number of people and records may be affected, the likely consequences, and what we have done and will do about it.
3. You decide whether to report the breach to the supervisory authority (within 72 hours, article 33 GDPR) and the people concerned; we help you with that. We document every breach.

10. End of the agreement: return and deletion

1. When your account is switched off, you can download all data of your company with Download my data for at least 30 days (at most 50) before it is deleted; that is how we return the data to you.
2. After that period we delete all personal data we process for you, and backups are overwritten within 30 days. We keep data only where EU or Dutch law requires it; the data about your customers is not among it.
3. On request we confirm the deletion in writing.

11. Information and audits

1. We give you all information needed to show that we comply with article 28 GDPR and this agreement.
2. You may have an audit carried out by an independent expert bound to confidentiality, at most once a year, with at least 30 days’ notice, during business hours and without access to other customers’ data. You bear its costs, unless the audit shows that we seriously failed to meet this agreement.

12. Liability and other terms

1. The limits of liability in the terms of use also apply to this agreement, except where article 82 GDPR or other mandatory law does not allow it. They do not limit the rights of data subjects.
2. Dutch law applies; disputes go to the court named in the terms of use.

Version 2026-10-26 (draft).