Privacy Policy

FoodoZone Limited ("FoodoZone", "we", "us" or "our") respects your privacy and is committed to protecting your personal data.

This Privacy Policy explains how we collect, use, store, share and protect personal data when you access or use our website, mobile application, food-ordering platform or related services.

For the purposes of UK data protection legislation, including the UK GDPR and Data Protection Act 2018, the data controller is FoodoZone Limited (Company Number: 17155371), 34 Longcroft Road, Luton, LU1 5RX, United Kingdom.

Privacy enquiries: food@foodozone.com

This policy applies to personal data we process relating to:

• customers;
• website and app visitors;
• registered users;
• prospective customers;
• restaurant partners and their representatives;
• individuals contacting customer support; and
• people receiving marketing communications from us.

What we collect from restaurant partners is explained in the "Restaurant partners" section below.

You must be 18 or over to create a FoodoZone account or place an order.

We do not knowingly collect personal data from anyone under 18. If we learn that we have, we will delete it. If you believe a child has given us their information, please contact food@foodozone.com.

Depending on your interaction with FoodoZone, we may collect:

• Identity and account information

  Name, account ID, login details and account preferences.

• Contact information

  Email address, telephone number, delivery address and billing address.

• Order information

  Restaurant selected, items ordered, order value, date and time, delivery instructions, order history, cancellations, refunds and complaints.

• Payment and transaction information

  Payment method, transaction reference, payment status, billing details, refunds and related transaction information.

  Payments are processed by Stripe. We do not store your full card number or card security code. For saved cards we keep only the card brand, the last four digits and the expiry date, so you can recognise the card.

• Points and vouchers

  Your points balance and history, points you use at checkout, and any vouchers our support team gives you.

• Photos

  Your profile picture, if you add one, and any photos you attach to a support ticket. Photos attached to a support ticket are seen by our support team.

• Reviews

  Ratings and reviews you leave for an order. Reviews are shown publicly on the restaurant's page together with your name.

• Location information

  Your delivery address and postcode.

  In the app, if you allow it, your device location, used only while the app is open to fill in your address and show restaurants near you.

  On the website, if you allow it, your browser location, used to show how far restaurants are from you.

  You can turn location access off at any time in your device or browser settings.

• Device and notification information

  If you allow notifications in the app, a device token that lets us send you order updates. See "Push notifications" below.

• Technical information

  IP address, browser, operating system, device type, device identifiers, app version, security logs, error reports and similar technical information.

• Usage information

  Pages viewed, restaurants viewed, searches, interactions, session information and how you use our website or application. On the website this is only collected if you accept analytics cookies.

• Communications

  Customer-support enquiries, complaints, feedback, emails and other correspondence.

• Marketing information

  Marketing preferences, consent records and opt-out choices.

We may collect personal data:

• Directly from you

  When you register, order food, make a payment, leave a review, contact us, submit information or change your preferences.

• Automatically

  When you use our website or app, through cookies, software development kits (SDKs), logs and similar technologies.

• From sign-in providers

  If you sign in with Google or Apple. See "Signing in with Google or Apple" below.

• From other organisations

  Including restaurants, Stripe and the other service providers listed in "Who we share information with".

You can create an account or sign in with your Google account or with Sign in with Apple instead of a password.

• Google: we receive your name, email address and Google account ID.
• Apple: we receive your name and email address. If you choose Apple's "Hide My Email", we receive a private relay address created by Apple instead of your real email address, and emails we send to it are forwarded to you by Apple.

We do not receive your Google or Apple password. You can remove FoodoZone's access from your Google or Apple account settings at any time.

When you verify your phone number, we send you a one-time code by text message. The code is sent by Google Firebase, so Google processes your phone number to deliver it.

On the website, Google's reCAPTCHA check runs at the same time to stop automated abuse of this service.

If you allow notifications in the app, we store a device token so we can send you updates about your orders.

Notifications are delivered through Expo and through Google (Firebase Cloud Messaging) on Android or Apple (Apple Push Notification service) on iPhone.

You can turn notifications off at any time in your device settings.

We only process personal data where we have an appropriate lawful basis.

• Providing FoodoZone services — Contract

  We process information necessary to:

  • register and manage accounts;
  • accept and process orders;
  • send orders to restaurants;
  • arrange or facilitate delivery;
  • process payments and refunds;
  • manage points and vouchers;
  • provide order updates, including push notifications you have allowed; and
  • provide order-related customer support.

  The lawful basis will generally be that processing is necessary to perform our contract with you or take steps at your request before entering into a contract.

• Legal and regulatory requirements — Legal obligation

  We may process information to comply with tax, accounting, regulatory, court or other applicable legal obligations.

• Security, fraud prevention and business operations — Legitimate interests

  We may process information where necessary for legitimate interests such as:

  • preventing fraud;
  • securing accounts;
  • protecting our systems;
  • investigating misuse;
  • finding and fixing errors;
  • improving our services;
  • showing reviews to other customers;
  • managing disputes; and
  • establishing, exercising or defending legal claims.

  Where we rely on legitimate interests, we consider the necessity of the processing and its effect on your privacy rights.

• Consent

  We rely on your consent for:

  • analytics cookies on our website;
  • marketing communications, where consent is required;
  • device location; and
  • push notifications.

  You can withdraw consent at any time.

FoodoZone uses Stripe to process payments.

When you make a payment, Stripe may process information including payment credentials, transaction information, billing information and information used for fraud detection and authentication.

Stripe may act as a processor and/or independent controller depending on the particular processing activity.

Stripe's own privacy terms may therefore apply to information it processes.

FoodoZone does not receive or store complete card security credentials where payment information is handled directly by Stripe.

To fulfil an order, we may provide the selected restaurant with information including:

• customer name;
• order details;
• relevant contact information;
• delivery address;
• delivery instructions; and
• other information reasonably required to prepare or fulfil the order.

Restaurants may have their own legal responsibilities regarding personal data they receive.

Initially, deliveries available through FoodoZone may be fulfilled by the relevant restaurant or its delivery personnel.

FoodoZone may later provide or facilitate delivery using its own delivery partners, riders or third-party delivery providers.

Where this occurs, we may share information reasonably necessary to complete the delivery, such as your name, address, telephone/contact information, order reference and delivery instructions.

We use PostHog to understand how people use our website, for example which pages are viewed and where people leave a page. This helps us find and fix problems and improve the service.

PostHog only runs after you accept analytics cookies. If you reject them, or withdraw your consent later, it does not collect anything.

We use PostHog's EU servers. We identify signed-in users by their account ID only, and do not send your name, email address or phone number to PostHog.

You can change your choice at any time using Cookie preferences in the website footer.

We use Sentry to receive reports when something goes wrong on the website, so we can fix it.

An error report contains technical information such as the page, the error, and your browser and device type. We have set Sentry not to attach personal information, such as your name, email address or cookies, to error reports, and we do not record screen replays of your visits.

We use error reports because we have a legitimate interest in keeping FoodoZone working and secure.

FoodoZone uses cookies and similar technologies for:

• keeping you signed in;
• remembering your basket and your cookie choices;
• payment security;
• protecting phone verification from abuse; and
• analytics, only if you accept analytics cookies.

We do not currently use advertising or marketing cookies.

More information is provided in our Cookie Policy at foodozone.com/cookies.

Subject to applicable law, FoodoZone may send information about:

• promotions;
• discount codes;
• restaurant offers;
• new features;
• competitions; and
• FoodoZone services.

Where consent is required, marketing will only be sent after appropriate consent has been obtained.

You can unsubscribe using the link in a marketing communication or by contacting food@foodozone.com.

Opting out of marketing does not stop essential transactional communications relating to orders, payments, security or your account.

We share information with the restaurant you order from, and with the service providers below, who process it on our behalf or provide part of the service:

• Stripe

  Payments, saved cards and refunds.

• Google Firebase

  Sending phone verification codes.

• Supabase

  Our database and stored photos, hosted in London.

• Railway and Vercel

  Hosting for our servers and website.

• Resend

  Sending account emails, such as password resets.

• PostHog

  Website analytics, on EU servers, only if you accept analytics cookies.

• Sentry

  Error reports.

• Google Maps

  Address search and suggestions when you enter an address, and restaurant maps.

• Expo, Google and Apple

  Delivering push notifications in the app.

We may also share information, where necessary, with professional advisers, regulators, courts, law-enforcement and government authorities where legally required.

We may also disclose information in connection with a genuine corporate restructuring, acquisition, investment, merger or sale, subject to applicable legal requirements.

FoodoZone does not sell customer personal data.

Some of the providers above are based in, or may process personal data in, countries outside the United Kingdom, in particular the United States (for example Google, Vercel, Resend, Sentry and Expo).

Where UK personal data is transferred internationally, we will use an appropriate transfer mechanism required by applicable UK data protection law.

Depending on the circumstances, this may include an applicable UK adequacy regulation (including the UK Extension to the EU–US Data Privacy Framework), the UK International Data Transfer Agreement, the UK Addendum to approved contractual clauses or another lawful safeguard.

You may contact food@foodozone.com for information about relevant safeguards.

We keep personal data only for as long as we need it:

• Account details

  Until you delete your account.

• Order and payment records

  6 years after the order, because UK tax law (HMRC) requires us to keep them. This applies even if you delete your account.

• Support tickets

  2 years after the ticket is closed.

• Error logs

  90 days.

• Analytics data

  Only collected with your consent, and deleted in line with our analytics provider's retention settings.

When information is no longer needed, we delete or anonymise it.

You can delete your account at any time:

• in the app: Profile → Delete account; or
• on the website: foodozone.com/delete-account.

You can't delete your account while an order is in progress.

When you delete your account, we delete your name, email address, phone number and profile photo, your saved delivery addresses and favourite restaurants, your saved cards (which are also removed from Stripe), your notifications, and the link to your Google or Apple sign-in.

We keep:

• order and payment records, for 6 years, because UK tax law requires it;
• reviews you posted, shown as "Deleted customer" without your name or photo; and
• messages you sent to our support team, for the period set out above.

If you apply to become a FoodoZone restaurant partner, we collect information about your business and the people who run it, including:

• business name, address, contact details and the owner's or manager's name;
• the owner's or director's identity document;
• bank account details and a bank confirmation letter, so we can pay you;
• business documents such as your business registration and food hygiene certificates; and
• your menu and logo.

We use this information to review your application, verify your identity and your business, prevent fraud, set up your restaurant on FoodoZone and pay you.

We keep it for as long as you are a partner, and afterwards for as long as UK tax and accounting law requires.

We use appropriate technical and organisational measures designed to protect personal data from accidental or unlawful:

• access;
• loss;
• disclosure;
• alteration;
• destruction; and
• misuse.

Measures may include access controls, authentication, encryption where appropriate, secure infrastructure, monitoring, backups and restrictions on staff access.

No internet service can guarantee absolute security.

We maintain procedures for identifying, investigating and responding to suspected personal data breaches.

Where applicable law requires notification to the Information Commissioner's Office or affected individuals, we will make the required notification.

Depending on the circumstances, UK data protection law may give you rights including:

• access to your personal data;
• correction of inaccurate data;
• deletion in certain circumstances;
• restriction of processing;
• data portability where applicable;
• objection to certain processing;
• withdrawal of consent; and
• rights relating to certain automated decision-making.

You have the right to object to processing of your personal data for direct marketing purposes.

Rights are subject to applicable legal conditions and exemptions.

Requests can be sent to food@foodozone.com.

We may ask for reasonable information to verify your identity before acting on a request.

FoodoZone or its service providers may use automated technologies to support fraud prevention and security.

If we introduce solely automated decision-making that produces legal or similarly significant effects on an individual, we will provide the information and safeguards required by applicable law.

For privacy concerns, please contact food@foodozone.com.

You also have the right to make a complaint to the Information Commissioner's Office (ICO), the UK's data protection regulator.

We may update this Privacy Policy when our services, technology, providers or legal obligations change.

The latest version will be displayed on FoodoZone with an updated revision date.

Where required, material changes will be brought to users' attention.