Data processing terms
Last updated 26 October 2026
How Platewell looks after your residents' information on your behalf, as your data processor under UK GDPR.
- Who this applies to
- What we process
- Your instructions
- Confidentiality
- Security
- Sub-processors
- International transfers
- Helping you
- When you leave
- Checks and audits
1. Who this applies to
These terms apply when a care home ("you", the controller) uses Platewell, provided by Teddys Ventures Limited (company number 17175500), registered office Suite 6, The Workshop, Wharf Road, Eastbourne, East Sussex, BN21 3FG ("we", the processor). They form part of our terms of service and are intended to meet the requirements of Article 28 of the UK GDPR. If you'd like a signed copy for your records, email hello@platewell.co.uk.
2. What we process
| Subject matter and purpose | Providing Platewell to you: recording residents' meal choices; printing menus, kitchen sheets and labels; planning orders; working out food costs. |
|---|---|
| Duration | For as long as you use Platewell, then until deletion as described in section 9. |
| People | Your residents, and your staff who use Platewell. |
| Types of personal data | Residents: title, name, room number, date of birth, meal choices, notes, likes and dislikes, and whether they are away or have left. Staff: name and email address. |
| Special category data | Health information about residents: food allergies, food texture needs (IDDSI levels) and dietary needs such as diabetic, low salt or fortified diets, plus anything you write in notes. Some diets (for example halal or vegetarian) can indicate religious or philosophical belief. |
3. Your instructions
We will only process this data on your documented instructions, which are these terms and your use of Platewell's features, unless UK law requires otherwise (in which case we will tell you, if the law allows). We will tell you if we think an instruction breaks data protection law. You are responsible for having a lawful basis to process your residents' information. For health information this is usually the provision of health or social care (UK GDPR Article 9(2)(h)).
4. Confidentiality
Everyone at Platewell who can access your data is bound by confidentiality, and only accesses it where needed to provide or support the service, or when you ask us to.
5. Security
We use appropriate technical and organisational measures to protect your data, including:
- encryption in transit (HTTPS) and at rest
- database-level rules (row level security) so each care home can only access its own records
- hashed passwords and email-confirmed accounts
- access to production systems limited to named people, using two-step login
- hosting in the UK (London) with a provider that holds recognised security certifications
- regular review of these measures
6. Sub-processors
You give us general permission to use these sub-processors:
| Sub-processor | Service | Location |
|---|---|---|
| Supabase Inc. | Database hosting and logins | Data stored in London, UK (eu-west-2) |
| Netlify Inc. | Hosting of the Platewell app (serves the app; your residents' data is not stored there) | USA and worldwide |
| Sendinblue SAS (Brevo) | Account emails to your staff (no resident data) | EU |
We will tell you at least 30 days before we add or replace a sub-processor that handles your residents' data, so you can object. We have written terms with each sub-processor that protect your data to the same standard as these terms, and we remain responsible to you for them.
7. International transfers
Your residents' data is stored in the UK. If a sub-processor accesses it from outside the UK (for example for support), we make sure there is a lawful transfer mechanism in place, such as UK adequacy regulations or the International Data Transfer Addendum.
8. Helping you
- Requests from residents or families: if we receive one, we will pass it to you promptly and won't respond ourselves. Platewell lets you view, correct, export and delete residents' information yourself, and we will help further if you need it.
- Data breaches: we will tell you without undue delay, and in any case within 48 hours, after becoming aware of a breach affecting your data. We will give you the information you need to assess it and to notify the ICO if required.
- Impact assessments and the regulator: we will give you reasonable help with data protection impact assessments and any consultation with the ICO.
9. When you leave
You can export your data at any time from Settings. When your account closes we delete your data within 30 days, and it drops out of backups within a further 90 days, unless UK law requires us to keep it.
10. Checks and audits
We will give you the information you reasonably need to show that we meet these terms, and answer reasonable questions about our security. If that isn't enough, you may carry out an audit (or appoint an auditor) with at least 30 days' notice, no more than once a year unless there has been a breach, at your own cost.