These terms are written plainly and in our own words. They have not yet been reviewed by a solicitor. If anything here matters to a decision you are making, tell us and we will answer it directly.
1. Who we are, and what this is
CaterPad is a record keeping service for food businesses, operated by Hotline Labs Ltd. In these terms "we" and "us" mean Hotline Labs Ltd, and "you" means the business that holds the CaterPad account.
- Company
- Hotline Labs Ltd
- Company number
- 11873778
- Registered office
- Enterprise Centre, Tonypandy Enterprise Park
Llwynypia Road, Tonypandy
CF40 2ET - support@caterpad.app
CaterPad helps you keep your own food safety records. It is not a certification, no authority has approved or endorsed it, it is not an inspection, and nothing in it is legal advice. Deciding what your business must do to keep food safe, and doing it, remains yours.
2. Your account
You are responsible for who you give access to, for keeping sign-in details private, and for the accuracy of what is recorded in your account. The account owner must use two factor authentication.
You must not use CaterPad to break the law, to store material you have no right to store, or to attempt to reach another business's data.
3. Payment
Plans and prices are on the pricing page. No VAT is charged. Every plan starts with a 14 day trial. We take card details when you sign up, nothing is charged during the trial, and cancelling inside the trial costs nothing.
After the trial we charge monthly or annually in advance, through our payment provider. Annual is charged at ten months for twelve. Plan limits are enforced by the software: going over a limit blocks the action and offers you a larger plan rather than charging you silently, except on the Group plan where units beyond the eighth are allowed and billed at the rate shown on the pricing page.
If a payment fails, our payment provider retries it. Your account stays usable while that happens.
4. Cancelling, and what happens to your records
You can cancel at any time from inside your account. When you cancel:
- Your account stays readable for 90 days and you can export everything in it.
- We email you at 60 and 80 days with a one click download of the whole account.
- At the end of the 90 days the account and its records and files are deleted.
We do this because a caterer who cancels in a quiet January may be asked for records in March, and because we should not be the long term keeper of a closed business's health and food safety records.
5. Data processing terms
This section is our processor agreement with you under Article 28 of the UK GDPR. It applies for as long as we hold personal data for you.
5.1 Roles
For the personal data you put into CaterPad, such as your staff's names and records, you are the controller and we are the processor. You decide what is recorded and why. We process it to run the service for you.
For a small amount of data we are the controller ourselves: your account holder's contact details, billing records, and our own service logs. Our privacy notice covers that.
5.2 What we process, and why
- Subject matter and purpose: providing CaterPad to you, so that you can keep, read, export and share your own food safety records.
- Duration: for as long as your account is open, plus the 90 day period in section 4.
- Nature of the processing: storing, organising, retrieving, rendering, exporting and, on your instruction, deleting.
- Types of personal data: names, contact details, roles and training records of your staff; signatures on records; the content of documents you upload; and, if you choose to record it, fitness to work information, which is health data.
- Categories of data subject: your staff and anyone else you choose to record, and the people you send a guest link to.
5.3 Our commitments
- We process your data only on your documented instructions. Using CaterPad as it is built is an instruction. If a law requires us to do something else, we tell you first unless the law forbids that.
- Everyone who can reach your data is under a duty of confidentiality.
- We keep appropriate security measures, including encryption in transit, encryption of fitness to work symptom text at rest, access control by role, and audit logging. Read access to a fitness to work record is itself logged.
- We help you answer requests from the people whose data it is, and we help you with security incidents, impact assessments and prior consultations, so far as is reasonable and relevant to what we do.
- We tell you without undue delay if we become aware of a personal data breach affecting your data, with what we know at the time.
- We give you the information you reasonably need to show that we are meeting this section, and we allow audits, which in practice means answering your questions and showing our arrangements rather than opening our offices to a random visit.
5.4 Sub-processors
We use a small number of other companies to run the service, currently for hosting, file storage and email delivery. They are listed in the privacy notice, which is where we keep that list current. You give us general authorisation to use them. We will tell you before we add or replace one, and you may object; if we cannot resolve an objection you may cancel and take the 90 day export.
Each sub-processor is under written terms no weaker than this section, and we remain responsible to you for what they do.
5.5 Where the data is
Your data is stored in the United Kingdom or the European Economic Area. If that ever has to change we will tell you before it does, and we will use a lawful transfer mechanism.
5.6 Deletion and return
You can export everything at any time while the account is open, and during the 90 day period after you cancel. At the end of that period we delete your data, including from file storage, unless a law requires us to keep something, in which case we keep only that and keep it protected.
5.7 Your side
You are responsible for having a lawful basis for what you record, for telling your staff what you record about them, and for setting your own retention choice for fitness to work records where we offer one. We provide a template appropriate policy document as part of setting up, clearly marked as a template rather than legal advice.
6. Availability
We work to keep CaterPad available and we do not promise it will never be down. We do not offer a service level agreement. Keeping your own copy of anything you would be in trouble without is sensible, and the export is there for that.
7. What we are not liable for
We are not liable for a food safety outcome, an inspection outcome, a decision by an authority, an event organiser's decision, or any loss arising from records that are incomplete or inaccurate because of what was entered. We do not limit liability for death or personal injury caused by our negligence, for fraud, or for anything else that cannot lawfully be limited.
8. Changing these terms
We will tell you by email before we make a material change, and give you a reasonable period to cancel if you do not accept it.
9. Law
These terms are governed by the law of England and Wales, and the courts of England and Wales have jurisdiction.