Legal
Last updated: 26 October 2026
This Schedule forms part of the Isenta Menu Terms of Service between ISENTA LIMITED (company number 17534346, registered office 1a Silver Street, Wellingborough, England, NN8 1BQ) ("Isenta", "we") and the business holding the account ("you").
1.1 It applies only when we process personal data on your behalf to provide Isenta Menu ("Your Personal Data"). For that processing, you are the controller and we are your processor.
1.2 Ordinary menu content (dishes, prices, ingredients, allergen labels, food photos) is not personal data. If your content contains no information about identifiable people, there is nothing for this Schedule to cover.
1.3 It does not cover personal data we use for our own purposes as controller, such as account sign-in, billing, support, email records and website security. Our Privacy Policy covers those.
1.4 "Data protection law" means the UK GDPR and the Data Protection Act 2018, as amended.
| Subject matter | Personal data that you include in your menus, restaurant profile, photos and imported files |
|---|---|
| Duration | While you have an account, then until deletion under section 9 |
| Nature | Storing, organising, editing, AI extraction, suggestions, image descriptions and translation when you request them, publishing, transmission to the sub-processors in section 6, and deletion |
| Purpose | Hosting, preparing and publishing your menus and restaurant information |
| People concerned | Owners, chefs and staff you choose to name or show; sole traders whose business contact details you publish; other people in photos you upload; and anyone captured by accident in imported files |
| Types of data | Names, roles, short descriptions, business contact details, images in which people can be recognised, and any personal data that happens to be in imported text or files |
| Not permitted without our written agreement | Information about your guests or customers, special category or criminal offence data, staff employment records, identity documents and payment card details (Terms section 9) |
You decide why and how Your Personal Data is used. You confirm that, for anything you upload, you have a lawful basis, any permission the law requires and any notice the law requires, and that you include only what is needed.
4.1 Instructions. We process Your Personal Data only on your documented instructions, including about transfers outside the UK, unless UK law requires otherwise. If it does, we will tell you first unless the law forbids that. Your instructions are these Terms, this Schedule, and your use of the service's features. For example, using an AI feature instructs us to send the submitted content to the AI providers in section 6, and publishing instructs us to make the selected content public.
4.2 Unlawful instructions. We will tell you immediately if we believe an instruction breaks data protection law.
4.3 Confidentiality. Everyone we authorise to process Your Personal Data is under a duty of confidentiality.
4.4 Security. We take appropriate technical and organisational measures for the risk involved. These currently include:
We may change these measures as long as overall protection is not reduced. We do not claim any security certification.
4.5 Help with requests. Taking into account the nature of the processing, we will help you respond to people exercising their data protection rights. If someone contacts us about Your Personal Data, we will pass the request to you and will not answer it ourselves unless you ask us to.
4.6 Help with your other obligations. Taking into account the information available to us, we will reasonably help you with:
4.7 Breaches. We will tell you without undue delay after becoming aware of a personal data breach affecting Your Personal Data. We will share what we know, in stages if necessary.
4.8 Information and audits. We will make available the information needed to show we meet these obligations, and will allow and contribute to audits, including inspections, by you or an auditor you appoint. This is subject to reasonable notice, confidentiality, and protecting other customers' data and our systems. We will normally answer with documents and written answers first. You pay your own audit costs.
When you use AI import, suggestions, image descriptions or translation, the content you submit, including any personal data in it, is sent to the AI providers in section 6. We do not use Your Personal Data to train AI models ourselves, and we do not sell it. We do not make commitments here about the AI providers' own retention, training or processing locations beyond what their terms provide.
6.1 You give general authorisation for us to use these sub-processors:
| Sub-processor | What it does |
|---|---|
| Lovable (with the infrastructure it uses for our database; our main database is in Ireland) | Hosting, database, file storage, sign-in, sending emails, and the AI gateway |
| Google (Gemini models, through Lovable's AI gateway) | AI import, suggestions, image descriptions and translation, when you use them |
| Cloudflare (through Lovable's hosting) | Delivering the site and protecting it from abuse |
6.2 We will impose data protection obligations on each sub-processor by contract, as required by data protection law, and we remain responsible to you for its performance.
6.3 We will tell you in advance, by email or in the app, before adding or replacing a sub-processor that will process Your Personal Data, so you have a reasonable opportunity to object. If you object on reasonable data protection grounds and we cannot address your concern, you may stop using the feature concerned or close your account.
We will not transfer Your Personal Data outside the UK unless the transfer is permitted under data protection law, for example to a country covered by UK adequacy regulations or with the UK International Data Transfer Agreement or the UK Addendum to the EU Standard Contractual Clauses in place.
Each party's liability under this Schedule is governed by the Terms (sections 11 and 12). Nothing in this Schedule limits the rights of individuals or the powers of the ICO.
When your account closes, at your choice, we will return Your Personal Data to you in a commonly used format or delete it, unless UK law requires us to keep it. Return is done on request, because there is no automatic export tool. Deletion from live systems happens within a reasonable period. Backups are overwritten on our hosting provider's schedule and are not used in the meantime except to restore the service. We cannot recall copies that guests or others have already saved.