Data Processing Agreement

Last updated: June 2026. This summary forms part of our Terms of Service and applies whenever you use Mendmate to process personal data.

1. Roles

You (the repair shop) are the data controller of your customers' personal data. Showday Tickets Ltd, trading as Mendmate, is the data processor, processing that data only on your documented instructions to provide the service. We are neither a controller nor a joint controller of your customer data.

2. Scope of processing

Subject matter: provision of repair-shop management software. Duration: for the life of your account plus the retention window below. Nature: storage, organisation and transmission of data you enter. Categories of data subject: your customers and staff. Categories of personal data: names, contact details, device and repair records, and payment metadata (we never store full card numbers — those go directly to Stripe).

3. Our obligations

• Process personal data only on your instructions and for the agreed purpose.
• Ensure persons authorised to process data are bound by confidentiality.
• Implement appropriate technical and organisational security measures (see our Security page).
• Assist you with data-subject requests, breach notification and DPIAs so far as reasonably possible.
• Notify you without undue delay on becoming aware of a personal-data breach.

4. Sub-processors

We use the following sub-processors to deliver the service. We will give you reasonable notice of any intended change so you can object.

Sub-processor	Purpose	Region
MongoDB Atlas	Primary database	UK / EU
Render	Application hosting	EU
Stripe	Card payments & Connect payouts	UK / EU / US (SCCs)
GoCardless	Direct Debit for maintenance contracts	UK
Brevo	Transactional email	EU
Twilio	Transactional SMS	EU / US (SCCs)
Cloudinary	Image storage (device photos, logos)	EU / US (SCCs)

5. International transfers

Where a sub-processor transfers data outside the UK, that transfer is covered by the UK International Data Transfer Agreement or Addendum to the EU Standard Contractual Clauses.

6. Data export and deletion

You can export your entire shop's data (CSV per collection plus full JSON) at any time from the dashboard. On termination, we delete or return your personal data within 30 days, save where retention is required by law.

7. Contact

Data protection enquiries: privacy@mendmate.co.uk. Showday Tickets Ltd, Bristol, UK. Company No. [PENDING], ICO registration [PENDING].

← All legal documents