This policy explains what personal information FoodDirect collects through fooddirect.net, why, how long we keep it and what your rights are. We've written it in plain English. If anything is unclear, email [email protected].
The short version
- We don't sell your information, and we don't use advertising or tracking cookies.
- When you order from a venue, your order goes to that venue's own till. The venue is responsible for it, and we don't keep a copy on our server.
- We collect only what we need to run the site: to reply to you, to list venues, and to keep everything secure.
Who we are
FoodDirect is run by David Herbert, a sole trader trading as FoodDirect, in the United Kingdom. Email: [email protected]. In this policy "we", "us" and "FoodDirect" mean David Herbert trading as FoodDirect.
We're registered with the Information Commissioner's Office (ICO), the UK's data protection regulator. Our registration number is ZC275255, and you can check it on the ICO's public register.
For most of what's described here we are the controller: we decide why and how the information is used. The exception is ordering from a venue (see Ordering from a venue), where the venue is the controller and we only pass your order on to them.
What this policy covers
fooddirect.net and its pages: the venue directory, the pages for venue owners, the contact form, venues' web addresses (like yourvenue.fooddirect.net) and the menus shown there, the online demo of the till at try.fooddirect.net, and the emails we send.
It doesn't cover the FoodDirectPos till software. A venue's sales, customer list, staff and other records are kept on the venue's own computer, not by us. The privacy notice for the till is in its user guide.
What we collect, why, and for how long
Visiting the site
Like every website, our server and Cloudflare (which protects and speeds up the site) see your IP address, your browser type and the pages you ask for. We use this to deliver pages, keep the site secure and fix problems. Our lawful basis is legitimate interests: running a safe, working site. Our server's logs are deleted after 14 days.
Searching for somewhere to eat
When you type a postcode or a place, your browser looks it up with postcodes.io (UK postcodes) or OpenStreetMap's Nominatim (place names). Those services see your search and your IP address. The map images come from OpenStreetMap. We use your search only to show venues near you and don't store it on our server. If you agree, your browser remembers the place for your next visit (see our cookie policy).
To show venue owners how their listing is doing, we count how many times each venue's card is seen in the directory, how many times its page or card is opened, and how many times its Call, Directions, Website and Menu buttons are tapped. These are plain daily totals for each venue. We don't record who you are, set a cookie or store your IP address with them. To stop one person reloading a page from counting twice, a scrambled form of your IP address is held in our server's memory for up to 30 minutes and then forgotten. Lawful basis: legitimate interests (telling venues how their listing is used).
The contact form and emails to us
Your name, email address, phone number (if you give it) and your message. We use them only to reply to you. Lawful basis: legitimate interests (answering you). The form sends us an email; we keep emails for as long as we need them to deal with your enquiry, then delete them.
Claiming, adding or reporting a venue, and the waiting list
If you ask to claim a venue, add one, or report a listing that's wrong, we collect your name, email address, phone number (if you give it), your message and the venue details you send. We use them to deal with your request and to contact you about it. Lawful basis: legitimate interests, or taking steps you've asked for before an agreement. Requests are deleted automatically 12 months after you send them.
If you ask to be told when FoodDirect opens in your country, we keep your email address, country and business name (if given) to tell you. They're deleted automatically after 24 months. You can ask us to remove them at any time.
Trying the FoodDirectPos demo
To try the demo at try.fooddirect.net you give us your name and email address, and if you like your venue's name and phone number. We use them to:
- check your email address is yours and send you the link that opens your demo;
- run your demo for 30 days: a reminder before it ends, a note when it has, and, if every place is taken, telling you when one comes free;
- send you news and offers about FoodDirectPos, unless you ticked Don't send me news and offers. Every one of these emails has an unsubscribe link, and you can unsubscribe at any time.
Lawful basis: providing the demo you asked for (contract), and for news and offers, legitimate interests. The law allows us to email people who've signed up to try our product about it, as long as they could say no when they signed up and can unsubscribe whenever they like. We also note the IP address you signed up from, to stop abuse.
Your demo café, and anything you type into it, is kept on our server only for your demo and deleted when it ends. A sign-up that's never confirmed is deleted after 30 days. Otherwise your details are deleted 24 months after your demo ends, or sooner if you ask. If you unsubscribe, we keep your email address on a list of people not to email, so we can make sure we don't.
Venue owners
- Signing in: your email address, to send you a sign-in link, and a record of your sign-in so you stay signed in (30 days, or until you sign out).
- Your venue's listing and menu: the business details, opening hours, photos and menu you or your till send us. They're published on the directory and your venue's web address, which is the point of them.
- Venues using FoodDirectPos: your web address, a scrambled copy of your recovery code (we can't read the code itself), whether your till is connected, and a daily count of how many times your menu was opened (just a number, with nothing about the visitors).
- How your listing is doing: the daily totals described under Searching for somewhere to eat, shown on your owner page and in your emails.
- Emails to you: the weekly summary of menu views for venues using FoodDirectPos, the monthly summary of how your listing did for claimed listings (you can turn either off), an email asking if your details are still right when OpenStreetMap's phone number or opening hours for your claimed listing change (you can turn this off too), news about software updates, and reminders about Featured Ranking.
Lawful basis: providing the service you asked for (contract) and legitimate interests. We keep this for as long as your venue is listed, and delete it when the listing is removed, apart from anything the law says we must keep.
Featured Ranking payments
Payments are taken by Stripe. We never see or store card details. Stripe tells us which venue paid and whether the payment went through. We keep payment records for 6 years because tax law requires it. Stripe's own use of your information is covered by Stripe's privacy policy.
Venues in the directory
The directory lists food businesses and places to stay (hotels, B&Bs, guest houses, campsites and similar) using information from OpenStreetMap (© OpenStreetMap contributors), Food Standards Agency hygiene ratings, and what venues send us: business name, address, phone number, website, opening hours and hygiene rating. Usually this is about a business, not a person. But where a business is run by one person under their own name, or from their home (a small B&B or holiday let, say), it can be personal information. We list it in our legitimate interests (helping people find local food and places to stay) and the public's. If you'd like a listing corrected or removed, use Report a problem on the listing or email us.
Ordering from a venue
When you order or book at a venue's web address (like yourvenue.fooddirect.net), the venue is responsible for your information: it is the controller. FoodDirect is a processor that passes your order to the venue for them.
- Your name, phone number, email address, delivery address, what you order and any notes (including allergies you tell them about) go through our server to the venue's own till, where they're kept. We don't keep a copy of your order on our server.
- Event tickets and private party enquiries work the same way: your name, email, phone number, meal choices and notes go to the venue's till, which keeps the guest list.
- We send emails on the venue's behalf: your order or booking confirmation, gift cards, event tickets and reminders, and marketing emails if you agreed to them. Every marketing email has an unsubscribe link. We keep the list of people who've unsubscribed, so you don't hear from that venue again.
- Card payments are taken by Stripe through the venue's own Stripe account. Neither FoodDirect nor the venue sees your full card number.
- If you agree, your browser remembers your details and past orders for next time. They're stored on your device, not on our server or the venue's till.
For questions about an order, or to see, correct or delete what a venue holds about you, contact the venue. Their details are at the bottom of their menu. We'll help them answer if they need us to.
Who else sees your information
We never sell your information. We use these services to run the site:
| Who | What for | Where |
|---|---|---|
| Hostnet B.V. | The server the site runs on | Netherlands |
| Cloudflare | Security and delivering pages quickly | Worldwide, including the USA |
| Stripe | Card payments | UK, EU and USA |
| postcodes.io and OpenStreetMap | Looking up places you search for, and map images | UK and EU |
| jsDelivr | Delivers the software that draws the map and QR codes | Worldwide |
Our emails are sent from our own mail server. We'll share information if the law requires it, for example with the police under a court order, or to protect people from fraud or harm.
Information outside the UK
Our server is in the Netherlands, which the UK recognises as protecting personal information properly. Where Cloudflare or Stripe handle information in the USA, they're covered by the UK–US data bridge or standard contract terms approved for UK transfers.
Your rights
You can ask us to:
- give you a copy of the information we hold about you;
- correct anything that's wrong;
- delete your information;
- stop or limit using it, or object to how we use it;
- give you your information in a form you can take elsewhere.
Where we rely on your consent, you can withdraw it at any time. For cookies, use Cookie settings. Email [email protected] and we'll reply within one month. It's free.
If you're unhappy with how we've handled your information, please tell us first. You can also complain to the Information Commissioner's Office: ico.org.uk/make-a-complaint, phone 0303 123 1113.
Cookies
We only use the cookies the site needs to work, plus, if you agree, storage that remembers things on your device to save you time. Our cookie policy lists them all.
Keeping it safe
The site is only available over an encrypted connection (HTTPS). Sign-in codes and recovery codes are stored scrambled, access to the server is restricted, and venues' business records stay on their own computers rather than with us.
Children
fooddirect.net isn't aimed at children under 13, and we don't knowingly collect their information.
Changes to this policy
We'll update this page if anything changes, and the date at the bottom shows when it last did. If a change is significant, we'll say so on the site, and tell venue owners by email.