Privacy matters. So does transparency.

This website is operated by SAUCE & SPICE (UK) LTD, a company registered in England and Wales under company number 16605216. In this policy, “we”, “us” and “our” refer to the company.

We are responsible for deciding why and how personal information is processed for the purposes described in this notice, where we act as the data controller.

The information we collect depends on how you use the website, whether you place an order and what you choose to provide. It may include the following categories.

Information you provide

• Your name and contact details, such as email address and telephone number.
• Order details, including selected items, quantities, order reference and relevant order instructions.
• Collection or delivery details, including an address where delivery is requested.
• Information you include in messages, feedback, complaints or other enquiries.
• Information you choose to provide when asking us to clarify ingredients or allergen information.

Technical and usage information

When you browse the website, certain technical information may be processed by the website or its hosting and security services. Depending on the configuration in use, this may include your IP address, browser type, device information, pages visited, approximate access times and technical logs.

Order and transaction records

Where an order is placed, relevant order and transaction records may be generated or received through the website’s ordering process and the services used to operate it. We do not intentionally request more personal information than is reasonably necessary for the relevant purpose.

We may use personal information for the following purposes:

• Order management: to receive, process, confirm and manage orders, including collection or delivery arrangements.
• Customer communication: to respond to questions, clarify order details and provide information about an existing order.
• Food-related enquiries: to respond to questions about menu items, ingredients and allergen information using the details available to us.
• Customer support: to investigate missing items, incorrect orders, complaints and other concerns.
• Website operation: to maintain functionality, troubleshoot errors and protect the website from misuse.
• Legal and record-keeping duties: to maintain records and comply with applicable accounting, tax, consumer protection and other legal requirements.
• Service improvement: where appropriate, to understand website performance and improve usability, subject to applicable privacy and cookie requirements.

We do not describe these purposes as permission to use personal information for unrelated activities. If we intend to use information for a new purpose, we will consider compatibility with the original purpose and provide further information where required by law.

Under applicable UK data protection law, we must have a lawful basis for processing personal information. Depending on the circumstances, we may rely on the following bases:

Contract

Processing may be necessary to take steps at your request before entering into a contract, manage an order or perform the arrangements associated with that order.

Legal obligation

We may process and retain relevant records where necessary to comply with legal duties, including applicable accounting, tax and record-keeping requirements.

Legitimate interests

We may process information where necessary for legitimate business interests, such as maintaining website security, preventing misuse, handling enquiries and improving website operation. We consider the impact on individuals and their rights before relying on this basis.

Consent

Where consent is required, including for certain optional cookies or marketing activities, we will seek it before carrying out the relevant processing. You may withdraw consent at any time, although this does not affect processing that took place lawfully before withdrawal.

The lawful basis depends on the specific activity. We do not rely on a single basis for every use of personal information.

We do not make personal information available indiscriminately. Where necessary for the purposes described in this policy, information may be shared with the following categories of recipients:

• Website and hosting providers: to host, maintain, secure and support the website.
• Ordering and website software providers: where the systems used to operate the website process relevant order or contact information.
• Delivery or fulfilment providers: where applicable, to fulfil a requested delivery and provide necessary delivery details.
• Professional advisers: such as accountants, legal advisers or insurers, where reasonably necessary.
• Public authorities: where disclosure is required by law or is necessary for the establishment, exercise or defence of legal claims.

Service providers should receive only information reasonably required for their role and, where applicable, must process personal information under appropriate contractual and security arrangements.

We do not state that every category above is used for every order. The actual recipients depend on the website configuration and the services involved in a particular interaction or order.

Cookies are small files stored on your device. The website may use cookies or similar technologies to support essential functions, remember preferences, maintain website security and, where configured, understand website usage.

Some cookies may be necessary for functions you request or for the website to operate. Other cookies, including certain analytics or advertising cookies, may require your consent before they are placed or accessed.

Where consent is required, the website should provide a suitable way to accept or reject optional cookies and to change your preferences later. You can also manage cookies through your browser settings, although blocking certain cookies may affect website functionality.

For further details about the cookies actually used on this website and how to manage your preferences, please read our Cookie Policy.

We keep personal information only for as long as reasonably necessary for the purpose for which it was collected, including to fulfil orders, address enquiries, meet legal obligations and resolve disputes.

Retention periods depend on the type of information and the circumstances. Our intended approach is as follows:

• General enquiries: normally up to 12 months after the enquiry has been resolved, unless a longer period is needed to address an ongoing matter or meet a legal obligation.
• Order and accounting records: retained for the applicable statutory and accounting period. Certain UK tax and accounting records may need to be retained for at least 6 years, depending on the record and applicable requirements.
• Complaints and order disputes: retained for as long as reasonably necessary to investigate the matter, document the outcome and address any related legal or regulatory requirements.
• Technical and security logs: retained for a proportionate period based on operational, security and troubleshooting needs, subject to the settings of the relevant service.
• Cookie records and preferences: retained according to the purpose of the cookie, the consent-management configuration and applicable requirements.

These periods are guidelines rather than a promise that every record will be deleted on a particular day. Information may be kept longer where legally required or reasonably necessary for a specific dispute, and will be securely deleted or anonymised when it is no longer needed.

We take reasonable technical and organisational measures intended to protect personal information against unauthorised access, accidental loss, alteration or disclosure.

Depending on the systems used, measures may include access controls, software updates, secure website connections, appropriate account permissions and the use of service providers with relevant security arrangements.

No method of transmitting or storing information can be guaranteed to be completely secure. You should avoid sending unnecessary sensitive information through general enquiry forms or ordinary email.

Depending on the circumstances and the applicable legal requirements, you may have the right to:

• Access personal information we hold about you.
• Rectify inaccurate or incomplete personal information.
• Erase personal information where the legal conditions for erasure are met.
• Restrict certain processing in circumstances provided by law.
• Object to processing based on legitimate interests or to certain other processing where the right applies.
• Data portability where the right applies to information processed by automated means on the basis of consent or contract.
• Withdraw consent where processing is based on consent.
• Raise a complaint with the relevant supervisory authority.

These rights are not absolute in every situation. For example, we may need to retain certain records to comply with legal obligations or establish, exercise or defend legal claims.

To make a request, contact us using the details in the Contact us section. Please tell us what you would like to access or change so that we can identify the relevant information. We may need to verify your identity before responding.

We will respond without undue delay and generally within one month of receiving a valid request. Where a request is particularly complex or multiple requests have been made, the law may permit an extension; if applicable, we will explain this within the initial response period.

You can find independent guidance through the Information Commissioner’s Office (ICO).

This website is intended for people who are able to use its ordering and enquiry functions lawfully. Where a person is not legally able to enter into the relevant arrangement independently, a parent, guardian or other appropriate responsible adult should assist as required.

We do not knowingly seek to collect children’s personal information beyond what is necessary for a legitimate interaction or order. If you believe a child has provided personal information inappropriately, please contact us so that we can review the matter.

Some website, hosting, communications or technical service providers may process information in countries outside the United Kingdom. Whether this occurs depends on the services and configurations actually used.

Where personal information is transferred internationally, we will take steps required by applicable data protection law. Depending on the circumstances, this may include relying on an adequacy regulation or decision, using appropriate contractual safeguards, or applying another lawful transfer mechanism.

If you would like further information about an applicable international transfer or its safeguards, please contact us.

We do not intend to make decisions about you solely by automated processing that produce legal effects or similarly significant effects as part of the ordinary operation described in this policy.

Website systems may automatically process technical data or order information to perform routine functions. If our practices change to include automated decision-making requiring additional notice under applicable law, we will provide the relevant information.

We may update this Privacy Policy when our website, operational practices or legal obligations change. The current version will be published on this page.

If a change introduces a new purpose for processing personal information, we will provide further information before carrying out that processing where required by law.

If you have a question about this policy, want to exercise a data protection right or have a concern about how your information has been handled, please contact us first.

You also have the right to raise a concern with the Information Commissioner’s Office (ICO), the UK’s independent data protection regulator. Further information is available at ico.org.uk/make-a-complaint/.