PRIVACY POLICY

This Privacy Policy explains how we collect, use, share, and protect your personal information when you use the Tasty Truck website and services (the “Services”).

1. Who we are (data controller)

The data controller is Tasty Truck (the business details shown above under “Business & Contact”).

2. Information we collect

• Contact details: name, email address, phone number.
• Delivery/collection details: delivery address (if delivery), selected time slot/day, special instructions.
• Order details: items ordered, selected options/add-ons, prices, order notes (including any allergen information you provide).
• Account details (if you create an account): login email and password (stored securely, not in plain text).
• Device/usage data: IP address, basic device/browser information, and logs needed for security and troubleshooting.
• Payment data: payments are processed by our payment provider (Stripe). We do not store full card details on our servers.

3. How we use your information

• To provide the Services (e.g., process orders, take payment, deliver/prepare food, communicate about your order).
• To manage accounts (if you choose to create one).
• To provide customer support and handle issues, refunds, or complaints.
• To improve our Services (fix bugs, improve usability, ensure reliability).
• To keep our Services secure (fraud prevention, abuse prevention, auditing).

4. Lawful bases for processing (UK GDPR)

• Contract: processing necessary to take and fulfil your order.
• Legitimate interests: improving and securing our Services, preventing fraud, and responding to requests.
• Legal obligation: complying with applicable law (e.g., record-keeping).
• Consent: where required (e.g., certain marketing). You can withdraw consent at any time.

5. Sharing your information

We do not sell your personal data. We may share information with trusted service providers (processors) to operate the Services, for example:

• Stripe (payments processing).
• Resend (sending transactional emails, e.g., order confirmations).
• Shipday (delivery logistics, where applicable).
• Hosting and infrastructure providers used to run our website and API.

These providers process data under contractual terms and only as needed to provide their services.

6. International transfers

Some service providers may process data outside the UK. Where this occurs, we take steps to ensure appropriate safeguards are in place (for example, contractual safeguards approved for UK use).

7. Data retention

We keep personal data only as long as necessary for the purposes described above, including to meet legal, accounting, and reporting requirements. Retention periods vary by record type (for example, order records may be retained longer than marketing preferences).

8. Cookies

We use essential cookies to keep the site working (for example, to keep your session and cart active). With your consent, we also use analytics cookies (Google Analytics 4) and marketing cookies (Google Ads and Meta Pixel) to measure performance and improve our ads. You can manage your preferences at any time using “Cookie settings” in the footer or via your browser settings.

9. Security

We use appropriate technical and organisational measures designed to protect personal data. However, no method of transmission or storage is 100% secure.

10. Your rights

Under UK GDPR, you may have rights including access, rectification, erasure, restriction, objection, and data portability. To exercise your rights, contact us using the details shown above.

You also have the right to complain to the UK Information Commissioner’s Office (ICO). See ico.org.uk.

11. Changes to this policy

We may update this Privacy Policy from time to time. Changes will be posted on this page with an updated “Last updated” date.