Website Privacy Policy

1. Introduction

1.1 Important information and who we are

Welcome to Eat Cheffie UK Limited’s Privacy and Data Protection Policy (“Privacy Policy”).

At Eat Cheffie UK Limited (“we”, “us”, or “our”) we are committed to protecting and respecting your privacy and Personal Data in compliance with the United Kingdom General Data Protection Regulation (“UK GDPR”), the Data Protection Act 2018 and all other mandatory laws and regulations of the United Kingdom.

Eat Cheffie is a marketplace and business management platform for independent food businesses in the UK. Two distinct groups of people use the platform, and this policy applies to both:

• Vendors — independent kitchen owners and food entrepreneurs who use Eat Cheffie to manage their menu, orders, delivery, pricing and (optionally) a public storefront.
• Customers — people who browse a vendor’s public storefront and place an order for food.

This Privacy Policy explains how we collect, process and keep data safe for both groups, tells you about your privacy rights, and how the law protects you. It also applies to any other individuals we process data about in the course of running the business — such as suppliers to Eat Cheffie itself (distinct from the “Suppliers” a vendor may record in their own kitchen management tools, which is the vendor’s data, not ours) and our own employees and staff members.

1.2 Your Data Controller

Eat Cheffie UK Limited is your Data Controller and responsible for your Personal Data, except where stated otherwise in section 3.4 below (order-parsing data, where we may act as a processor on a vendor’s behalf). We are not obliged by the GDPR to appoint a data protection officer and have not voluntarily appointed one at this time. Any inquiries about your data should be sent to us by email to privacy@eatcheffie.com.

You have the right to make a complaint at any time to the Information Commissioner’s Office (ICO), the UK supervisory authority for data protection issues (www.ico.org.uk). We would, however, appreciate the chance to deal with your concerns before you approach the ICO, so please contact us in the first instance.

1.3 Processing data on behalf of a Controller and processors’ responsibility to you

In discharging our responsibilities as a Data Controller we have employees and sub-processors who deal with data on our behalf (“Processors”). Our processors and their responsibilities are set out in section 5 (Your data and third parties) and section 8 (International transfer of data) below. Our processors are required to:

• Ensure that all processing of Personal Data is governed by one of the legal bases laid out in the GDPR (see 2.2 below);
• Commit to confidentiality or be under an appropriate statutory obligation of confidentiality;
• Implement appropriate technical and organisational measures appropriate to the risk of the processing;
• Obtain our prior authorisation before engaging a sub-processor of their own;
• Assist us in responding to requests from you to exercise your data subject rights;
• Make available to us all information necessary to demonstrate compliance with the GDPR;
• Maintain a record of processing activities carried out on our behalf; and
• Notify us without undue delay after becoming aware of a Personal Data Breach.

2. Legal Basis for Data Collection

2.1 Types of data we collect

“Personal Data” means any information about an individual from which that person can be identified. It does not include anonymous data. Not all of the following will be collected from every person — it depends on whether you are a customer or a vendor, and which features you use.

• Identity Data: first name, last name, and (for vendors only, as part of identity verification) date of birth.
• Government ID Data (vendors only): a copy of a passport, driving licence or biometric residence permit, uploaded during vendor sign-up so we can verify who is operating a food business on the platform. This is more sensitive than most of the data we hold and is treated accordingly — see section 4.3.
• Business Data (vendors only): business/kitchen name, registered company name and number (where applicable), business address and phone number, and food safety documentation — council registration confirmation, food hygiene certificates, and allergen awareness certificates. Vendors are not required to upload every document to use the platform; documents may be added incrementally.
• Contact Data: phone number, email address, and (for customers) delivery address.
• Order Data: the meals, quantities, delivery date and any notes (including allergen or dietary information a customer chooses to share) attached to an order placed through a vendor’s storefront.
• Communications Data: where a vendor uses our order-parsing tool to convert a message they received on WhatsApp, Instagram or elsewhere into a structured order, the text of that message (which may include a customer’s name, order details and address) is processed by us on the vendor’s behalf. See section 3.4 for how this is different from other data on this list.
• Billing and Financial Data: payment card details are entered directly into our payment processor, Stripe, and are not stored on our own servers. Vendor payout details (bank account used to receive payouts) are collected and held by Stripe Connect on the vendor’s behalf, not by us directly.
• Marketing and Communications Data: your preferences in receiving marketing information from us.
• Technical Data: IP address, browser type and version, device and operating system information, and similar data generated by using our website and application.
• Usage Data: information about how you use our website, product and services.
• Customer Support Data: feedback, support requests and survey responses.

2.2 The legal basis for collecting that data

There are a number of justifiable reasons under the GDPR that allow collection and processing of Personal Data. The main ones we rely on are:

• “Consent”: for example, when you opt in to marketing communications.
• “Contractual Obligations”: we require certain information from vendors and customers in order to provide the service — for example, we cannot process an order without a delivery address, and we cannot verify a vendor without identity documents.
• “Legal Compliance”: we are required to collect certain data to comply with our own legal obligations, including anti-fraud checks and, for vendors, confirming they are entitled to operate a food business in the UK.
• “Legitimate Interest”: for aspects reasonably necessary to run the business that do not materially impact your rights and freedoms — for example, technical data used to keep the platform secure and working.

3. How We Use Your Personal Data

3.1 Our data uses

We will only use your Personal Data when the law allows us to. The table below is indicative, not exhaustive — contact us for more detail on any specific use.

3.2 How we use Artificial Intelligence

Eat Cheffie uses one or more third-party AI providers to power certain features. The specific providers and underlying models we use may change over time as the technology and our needs evolve, so this section describes categories of use rather than naming a provider that may not remain current:

• Order parsing — when a vendor pastes the text of a customer message (from WhatsApp, Instagram, or elsewhere) into the platform, that text is sent to a third-party AI provider to be converted into a structured order (meal, quantity, delivery date, etc.).
• Other business tools — certain more complex features may send relevant data to a third-party AI provider for processing.

No AI provider we use is used to make fully automated decisions about a person that produce a legal or similarly significant effect. A vendor always reviews the parsed output before it becomes a real order. A current list of the AI providers we use, and where they are located, is available on request at privacy@eatcheffie.com and is reflected in section 8 (International transfer of data).

3.3 Marketing and content updates

You will receive marketing and new content communications from us if you have created an account and chosen to opt into receiving those communications. From time to time we may make suggestions and recommendations to you about goods or services that may be of interest to you.

3.4 Data a vendor gives us about someone else

Our order-parsing tool involves an unusual data flow worth calling out on its own: a vendor may paste in the text of a message from a customer that was sent on a third-party platform (WhatsApp, Instagram, etc.), which we then process to create a structured order. In that specific flow, we are acting as a processor on the vendor’s behalfin relation to the customer’s data within that message, not as the controller. The vendor remains responsible for having a lawful basis to share that message with us (for example, because the customer sent it to them directly to request an order).

3.5 Change of purpose

We will only use your Personal Data for the purposes for which we collected it, unless we reasonably consider that we need to use it for another reason that is compatible with the original purpose. If you wish to get an explanation as to how the processing for a new purpose is compatible with the original purpose, please contact us. If we need to use your Personal Data for an unrelated purpose, we will notify you and explain the legal basis for doing so.

4. Your Rights and How You Are Protected by Us

4.1 Your legal rights

Under certain circumstances, you have the following rights under data protection law in relation to your personal data:

• Right to be informed about how we process your personal data — this policy is how we do that.
• Right of access to a copy of the personal data we hold about you (“data subject access request”). See section 4.5.
• Right to rectification of incomplete or inaccurate data we hold about you.
• Right to erasure of your personal data where there is no good reason for us to continue processing it, subject to legal exceptions we will explain to you at the time.
• Right to object to processing based on legitimate interest or for direct marketing purposes.
• Right to restrict processing in certain circumstances, for example while we verify the accuracy of contested data.
• Right to data portability for data you provided to us and that we process by consent or to perform a contract with you.

To exercise any of these rights, contact us at privacy@eatcheffie.com.

4.2 Your control over your account

You may delete your account at any time. Deleting a vendor account does not automatically delete records we are required to keep for tax, accounting or food-safety-related compliance reasons — see section 6 (retention).

You can access information associated with your account by logging in. Your account is protected by a password; you are responsible for keeping it confidential and for signing out of shared or public devices.

California Privacy Rights: Under California Civil Code sections 1798.83-1798.84, California residents are entitled to ask us for a notice identifying the categories of personal information we share with affiliates and/or third parties for marketing purposes.

4.3 How we protect your data

We implement technical and organisational measures appropriate to the risk of the data involved. Government ID documents and business compliance documents are held with more restrictive access than general account data, and access is limited to employees and systems that need it to verify a vendor or respond to a regulatory request. Payment card data is never processed or stored on our own servers — it is handled directly by Stripe. No transmission of data over the internet can be guaranteed completely secure, and any transmission is at your own risk.

4.4 Opting out of marketing promotions

You can ask us to stop sending you marketing messages at any time via your account settings. Where you opt out, we will continue to retain other Personal Data provided as a result of your use of the platform that is unrelated to marketing.

4.5 How to request your data

There is no fee to access your Personal Data or exercise your other rights, unless a request is clearly unfounded or excessive. We may need to verify your identity before responding to a request.

5. Your Data and Third Parties

5.1 The processors we use

We share Personal Data with the following categories of third-party processor, each engaged under a data processing agreement, to provide the service:

• Supabase — our database, authentication and file storage provider. Vendor and customer account data, order data, and uploaded documents (including Government ID Data) are stored with Supabase in the UK (London/eu-west-2 region).
• Stripe — our payment processor. Handles all card payment data directly, and (via Stripe Connect) holds vendor bank account details in order to pay vendors out for completed orders.
• AI providers — one or more third-party providers used to power features such as order parsing and other business tools (see section 3.2). We choose providers based on capability and data protection standards, and the specific providers in use may change over time.
• Resend — our transactional email provider, used to send order confirmation, status update and account emails.
• Vercel — our hosting provider.
• PostHog — our analytics provider (EU-hosted), used to understand product usage. Only active if you consent to analytics cookies — see section 5.3.

5.3 Cookies and Tracking

We use a first-party cookie to remember your choice, and (only if you consent) an analytics cookie set by PostHog. No analytics cookie is set, and no analytics network request is made, until you accept via the cookie banner shown on your first visit. Full detail on the cookies and local browser storage we use is in our Cookie Policy.

5.4 Other sharing

We may share Personal Data in the event of a sale, merger, or transfer of all or part of our business, in which case the acquiring entity’s privacy policy may govern further use of your data. We may also share Personal Data where required by law or to enforce our Terms or this Privacy Policy.

6. How Long We Retain Your Data

We retain Personal Data for as long as reasonably necessary for the purpose it was collected for. As a general guide: order and transaction records are likely to need retention for UK tax and accounting purposes (typically around six years); vendor compliance documents (food hygiene, allergen certification) are likely to need retention for at least the duration a vendor is active on the platform and for a period afterward in case of a food-safety dispute.

7. Age Limit for Our Users

You must not use Eat Cheffie unless you are aged 18 or older. If you are under 18 and access Eat Cheffie by misrepresenting your age, you must stop using it immediately. Eat Cheffie is not intended for children and we do not knowingly collect data relating to children.

8. International Transfer of Data

Where we or our processors transfer your Personal Data outside the UK, we rely on an appropriate safeguard recognised under UK GDPR (such as an adequacy decision or Standard Contractual Clauses with UK-specific addenda). The approximate locations involved today are:

• Supabase: UK (London).
• Stripe: UK/EU and US.
• Resend: US.
• Vercel: US, with content also served from edge locations globally.
• AI providers: this varies by provider and may include the UK, EU, US or other jurisdictions, including some without a UK adequacy decision. A current list is available on request at privacy@eatcheffie.com.

9. Notification of Changes and Acceptance of Policy

We keep our Privacy Policy under review and will place any updates here. By using Eat Cheffie, you consent to the collection and use of data as set out in this Privacy Policy. Continued use of Eat Cheffie after changes are posted constitutes acceptance of those changes.

10. Interpretation

All uses of the word “including” mean “including but not limited to”. Any email addresses set out in this policy may be used solely for the purpose stated, and unrelated correspondence may be ignored. Our staff are not authorised to contract on behalf of Eat Cheffie UK Limited, waive rights, or make representations, and nothing in an email from an Eat Cheffie address overrides this policy, our Terms, or an official public announcement, except genuine correspondence from Eat Cheffie’s legal function.