Manjano Back

Data Processing Agreement

Effective November 13, 2026

This DPA is part of the Terms of Service between Oliver Chibwe, who operates Manjano ("Manjano", the processor / service provider), and the restaurant ("Customer", the controller / business). It applies to personal data of the Customer's guests that Manjano handles for the Customer.

1. What is processed

2. Instructions

Manjano processes guest data only on the Customer's documented instructions (these terms and the settings the Customer chooses in the dashboard), unless the law requires otherwise. Manjano does not sell guest data, does not use it for its own marketing, does not combine it with data from other customers, and does not use it to train AI models.

3. Customer's duties

The Customer is responsible for having a lawful reason to collect and use guest data, for its own privacy notice, for consent to marketing emails and texts, and for answering its guests' requests. Manjano gives the Customer tools to do this.

4. Confidentiality

People at Manjano who can access guest data are bound by confidentiality and access it only when needed to run or support the service.

5. Security

Manjano maintains: encryption in transit; a separate database per restaurant, or logical separation between restaurants; row-level access rules; admin access only for signed-in, invited users; secrets stored outside the code; rate limits on public forms; and regular backups by the database provider.

6. Sub-processors

The Customer authorises the sub-processors listed in section 4 of the Privacy Policy. Manjano has a written agreement with each one that protects the data to the same standard, and remains responsible for their work. Manjano gives at least 30 days' email notice before adding a new sub-processor; the Customer may object on reasonable grounds and, if the objection cannot be resolved, cancel without penalty.

7. Helping with requests

Manjano helps the Customer respond to guests who ask to see, correct, delete or export their data, and with data protection impact assessments, as far as it reasonably can given the data it holds. If a guest contacts Manjano directly, Manjano passes the request to the Customer.

8. Breach notice

If Manjano becomes aware of a breach affecting the Customer's guest data, it tells the Customer without undue delay, and within 72 hours where reasonably possible, with what is known about the cause, the data affected and the steps taken.

9. Return and deletion

On cancellation the Customer can export its data for 30 days. Manjano then deletes it from live systems, and backups expire within a further 30 days, unless the law requires Manjano to keep something.

10. Audits

On written request, no more than once a year, Manjano provides information reasonably needed to show it follows this DPA, including its sub-processors' security reports where available.

11. International transfers

Guest data is stored in the USA. If the Customer is subject to the GDPR or UK GDPR, the EU Standard Contractual Clauses (Module 2, controller to processor) and the UK Addendum apply to the transfer and are incorporated by reference. The details in sections 1, 5 and 6 above serve as their annexes; the Customer is the data exporter and Manjano is the data importer.

12. US state privacy laws

Under the CCPA and similar state laws Manjano acts as a "service provider" / "processor": it uses guest data only for the business purposes in this DPA, does not sell or share it, and tells the Customer if it can no longer meet these duties.

13. Order of documents

If this DPA and the Terms of Service disagree about guest data, this DPA wins. The liability limits in the Terms apply to this DPA.