Privacy notice

What we collect when you order, why we need it, how long we keep it, and how to make us delete it.

Last updated: [date — not set yet]

Who is responsible for your data

Easy Bite Nutrition, [trading address — not set yet]. We are the data controller — meaning we decide what happens to the information you give us, and we are answerable for it. Contact us at hello@easybitenutrition.com.

What we collect, and why

What	Why	Our lawful basis
Name, email, phone	To take your order, confirm it, and reach you if something goes wrong with it	Performance of a contract
Delivery address and postcode	To work out whether we reach you, what delivery costs, and to actually deliver	Performance of a contract
What you ordered, and what you paid	To cook the right food and keep proper business records	Contract, and legal obligation for accounting records
Allergies and dietary notes	To prepare your food safely	Your explicit consent — see below
Postcode alone, if we don't deliver to you yet	To see where demand is and where to extend the round	Legitimate interests, and your consent if you leave an email with it
Marketing emails	The weekly menu and the occasional offer	Your consent — the tick box is never pre-ticked

Allergy information is health data

Anything you tell us about allergies or intolerances is health data — a special category under UK GDPR Article 9, held to a higher standard than the rest. We ask for it separately, we use it only to prepare your food safely, and you can withdraw that consent at any time by emailing us, without affecting the rest of your order. If you withdraw it we delete the note, and we can no longer cook around it.

Who else sees it

Only the suppliers that make the service work, and only the part each needs:

• Stripe — takes the payment. Your card details go straight to Stripe and never touch our systems.
• Resend — sends your order confirmation and the weekly menu.
• Cloudflare — hosts the site and the database.

Some of these process data outside the UK. Where they do, the transfer is covered by the UK's approved safeguards — an adequacy decision or the International Data Transfer Addendum. We do not sell your data, and we do not share it for anyone else's marketing.

How long we keep it

• Order and payment records — six years after the end of the tax year they fall in, because HMRC requires it.
• Your account details and allergy notes — while you are a customer, then two years, then deleted.
• Marketing consent — until you unsubscribe.
• Out-of-area postcodes — until we reach you, or two years, whichever comes first.

What you can make us do

You have the right to get a copy of what we hold, correct it, have it deleted, restrict what we do with it, take it elsewhere in a portable form, object to us using it, and withdraw any consent you have given. Email us and we will answer within one month. It costs you nothing.

If we get it wrong, you can complain to the Information Commissioner's Office at ico.org.uk or on 0303 123 1113. We would rather you told us first, but you do not have to.

Cookies

We set one cookie, and only in the kitchen admin area, to keep whoever is signed in signed in. It is strictly necessary, so it needs no consent and it is not used to track anyone.

We do not use analytics or advertising cookies. If that changes, you will be asked before anything is set, and declining will cost you nothing.

Questions about any of this? Email hello@easybitenutrition.com.