Privacy Policy

What data we collect

When you place an order. To take and deliver your order we ask you for:

• Your first name and last name
• Your company name
• Your email address and phone number
• The delivery address and postcode, plus the date and time you want the food delivered
• A billing address and postcode, if it differs from the delivery address
• Any delivery notes or dietary information you choose to give us
• The items you ordered and the amount you paid

We never see or store your card details.Payment is taken on Stripe's own secure checkout page. We receive only a confirmation that payment succeeded, along with a reference number for the transaction.

When you contact us. If you email or call us, we will hold whatever you choose to tell us — typically your name, contact details and the content of your enquiry — so that we can answer it.

Technical information. Like almost every website, our hosting provider automatically records basic technical details of each visit, such as your IP address, the pages requested and your browser type. These logs are used to keep the site running securely and are not used to build a profile of you.

How we use your data, and why we are allowed to

We only use your personal data where the law gives us a basis to do so. In practice that means:

• To fulfil your order — preparing your food, delivering it to the right place at the right time, taking payment and sending you a confirmation email. Lawful basis: performance of a contract with you.
• To meet our legal obligations — raising a VAT invoice and keeping accounting records for as long as HMRC and company law require. Lawful basis: compliance with a legal obligation.
• To answer your enquiries and deal with any issues with an order, including complaints and refunds. Lawful basis: our legitimate interests in running and supporting our catering business.
• To keep the website secure and prevent fraudulent or abusive use. Lawful basis: our legitimate interests in protecting our business and our customers.

Marketing. We do not add you to a marketing list simply because you have placed an order, and this website has no newsletter sign-up. If that ever changes we will ask for your consent first, and every marketing email we send will contain a one-click unsubscribe link.

We do not sell your personal data, and we do not use it to make automated decisions or to profile you.

Cookies and storage on your device

This website does not use analytics, advertising or tracking cookies. We do not use Google Analytics, Google Ads, Meta Pixel or any similar tool, and no third party tracks you across other websites as a result of visiting ours. That is why you are not greeted by a cookie banner.

The only information we store on your device is:

Both are “strictly necessary” for a service you have asked for, so under the Privacy and Electronic Communications Regulations (PECR) they do not require your consent.

When you are sent to Stripe to pay, Stripe sets its own cookies on its own checkout page to process the payment securely and prevent fraud. That is covered by Stripe's privacy policy.

The fonts used on this site are served from our own servers, so visiting this website sends no request to Google or any other font provider.

Who we share your data with

We do not sell or rent your personal data to anyone. We do share it with a small number of suppliers who process it on our behalf and only on our instructions, under contracts that require them to keep it secure:

We may also disclose your data where we are legally required to do so — for example to HMRC, or in response to a valid request from a law enforcement body or court.

Transfers outside the UK.Some of the suppliers above are based in, or store data in, the United States. Where personal data is transferred outside the UK, that transfer is protected by appropriate safeguards — the UK Government's adequacy regulations, the UK Addendum to the EU Standard Contractual Clauses, or equivalent measures set out in our contracts with them.

How long we keep your data

• Order and invoice records — six years from the end of the financial year they relate to. We are required to keep these for VAT and company accounting purposes, so we cannot delete them on request before that period is up.
• Email and phone enquiries that do not lead to an order — up to two years from your last contact with us, so we can pick up the thread if you come back to us.
• Website technical logs — a short rolling period set by our hosting provider, typically no more than 30 days.

When data reaches the end of these periods it is deleted or anonymised.

How we keep your data safe

All traffic to and from this website is encrypted (HTTPS). Order data is held in an access-controlled database, and the admin area that can view orders is restricted to named members of our team who each sign in with their own account. Card payments are handled entirely by Stripe, a PCI-DSS Level 1 certified payment provider, so card numbers never reach our systems.

If a personal data breach occurs that is likely to result in a risk to your rights and freedoms, we will report it to the Information Commissioner's Office within 72 hours of becoming aware of it, and tell you directly where the law requires us to.

Your rights

Under UK data protection law you have the right to:

• Ask for a copy of the personal data we hold about you
• Ask us to correct data that is inaccurate or incomplete
• Ask us to delete your data, where we have no continuing legal reason to keep it
• Ask us to restrict how we use your data, or object to our using it
• Ask us to transfer your data to you or another provider in a portable format
• Withdraw your consent at any time, where we rely on consent

To exercise any of these rights, email letsdo@lunched.co.uk with your name and details of your request. We will respond within one month. There is no charge.

If you are unhappy with how we have handled your data, you can complain to the Information Commissioner's Office at ico.org.uk or on 0303 123 1113. We would appreciate the chance to put things right first.

Links to other websites

This website contains links to other websites, including our payment provider. This policy applies only to this website — a link is not an endorsement of another site's privacy practices, and we are not responsible for how those sites handle your data. We would encourage you to read the privacy policy of any site you visit from here.

Children

This website is aimed at businesses ordering catering and is not directed at children. We do not knowingly collect personal data from anyone under 18.

Changes to this policy

We review this policy from time to time and may update it as our website and suppliers change. The current version always appears on this page, with the date it was last updated shown at the top. If we make a significant change to how we use your data, we will take reasonable steps to tell you.

Contact us

More ways to get in touch →