Privacy Policy

This policy applies to the CookUp platform, including the website, the apps and the cook, driver and admin portals. The organisation below is the controller of your personal data under the UK General Data Protection Regulation (UK GDPR) and the Data Protection Act 2018.

Controller

CookUp

Privacy enquiries

Use the contact form

• Account details: your name, username, email address, phone number and password (stored only in hashed form).
• Delivery details: addresses you save, and the delivery area you choose on this device.
• Orders and payments: what you order, delivery and order status, and payment records. Card details are handled by our payment providers, not stored by CookUp.
• Dietary and allergy information: allergens you tell us about, so that dishes can be checked against them. This is health-related information, and we handle it with extra care.
• Communications: messages with cooks and support, reviews you post, and notification preferences.
• Device information: push-notification tokens for devices you have allowed, and the cookies and local storage described in section 8.

We use your personal data for the purposes below, each with a lawful basis under UK GDPR Article 6.

• To provide the service (taking and fulfilling orders, payments, delivery, support): necessary for the contract with you, Article 6(1)(b).
• To meet legal duties (tax and accounting records, food safety records, responding to lawful requests): necessary to comply with a legal obligation, Article 6(1)(c).
• To keep the platform secure and improve it (fraud prevention, account security, service quality): our legitimate interests, Article 6(1)(f). We weigh these against your rights.
• To send marketing messages: your consent, Article 6(1)(a). You can withdraw it at any time.

We do not make decisions that have legal or similarly significant effects on you using automated processing alone. The personalised suggestions you see are based on your order history, and you can pause that use at any time (section 6).

We share personal data only as needed for the purposes above:

• Cooks receive the details they need to prepare your order, including any allergies you have declared for it.
• Delivery drivers receive your name, delivery address and contact number for the delivery.
• Payment providers process payments and refunds.
• Service providers that send our emails, text messages and push notifications, host our systems and provide sign-in. They act on our instructions.
• Authorities where the law requires it.

We keep your account and its personal data while the account is active. When you delete your account, we erase the personal data we hold about you, except records that the law requires us to keep, such as order and payment records for tax purposes. Those records are kept only for as long as the law requires, and then deleted.

Subscriber and campaign records follow the same principle. Where we keep a record only to honour an opt-out, we keep the minimum needed to do so.

Under UK GDPR you have the following rights. You can use most of them yourself, from your profile.

• Access: request a copy of your personal data. Use Profile → Privacy → Data Export.
• Correction: update your details in your profile.
• Erasure: request deletion of your account from Profile → Privacy. You can cancel the request during the grace period shown there.
• Restriction and objection: pause marketing and personalised use of your data from Profile → Privacy. Messages about your orders, payments and account continue while this is on.
• Withdrawing consent: switch off marketing communications at any time, from the same place.
• Complaints: if you are unhappy with how we handle your data, contact us first. You also have the right to complain to the Information Commissioner's Office at ico.org.uk/make-a-complaint.

We send marketing only to people who have opted in. Every marketing email includes an unsubscribe link, and most email clients show a one-click unsubscribe button. Order, payment, delivery and account messages are not marketing and are sent whatever your marketing choice.

We use cookies and similar storage on this device. Essential items keep you signed in and your basket working. Analytics and marketing cookies are off unless you allow them. The Cookie Policy lists each one, and you can change your choice at any time from Cookie settings in the footer.

All traffic to CookUp is encrypted in transit. Access to personal data inside the platform is limited by role and permission, and actions are recorded in audit logs. No system is perfectly secure, so if we become aware of a breach affecting your data, we will tell you and the Information Commissioner's Office where the law requires it.

We will update this policy when our practices change, and we will show the date of the latest update at the top of this page. For a significant change, we will also tell you by email or in the app before it takes effect.