Legal

Data Processing

Last updated: October 5, 2026

This page describes how MealSecretary — Institutional Meal & Catering Management (“MealSecretary”) processes personal data on behalf of organizations that use MealSecretary (“Customers”). It forms part of the agreement between MealSecretary and each Customer.

Roles

For institutional records—members, memberships, Meal Programs, meal status, serving, charges and payroll records—the Customer is the controller and MealSecretary is the processor. For each person’s own account and personal records, MealSecretary is the controller.

Processing details

  • Subject matter: providing meal, foodservice and nutrition management services.
  • Data subjects: the Customer’s members (employees, students, patients, residents, guests) and authorized users.
  • Categories of data: names, identifiers such as Employee IDs, contact details, organization and location, meal participation, serving and charge records. Health-related data only where the Customer uses modules that require it.
  • Duration: the term of the Customer’s subscription plus any retention period required by law or agreed with the Customer.

Our commitments

  • Process personal data only on the Customer’s documented instructions.
  • Ensure people with access are bound by confidentiality.
  • Apply appropriate technical and organizational security measures, including access control, encryption in transit, hashed credentials and audit logging.
  • Use sub-processors (such as hosting, email and SMS providers) only under written terms that protect the data, and keep the Customer informed of changes.
  • Help the Customer respond to data subject requests and meet its security, breach notification and impact assessment obligations.
  • Notify the Customer without undue delay after becoming aware of a personal data breach.
  • Delete or return personal data at the end of the service, unless retention is legally required.

International transfers

Where data is transferred across borders, MealSecretary uses appropriate safeguards required by applicable law. Customers with data residency requirements can contact us to discuss options.

Contact

For a signed data processing agreement or questions, contact shahid.javir@gmail.com or use the contact form.