1. Data controller and contact
DROPEAT LTD, company number 17557731, registered office 71–75 Shelton Street, Covent Garden, London, WC2H 9JQ, United Kingdom, is the controller for personal data processed for its own website, business account administration, onboarding and direct marketing. Contact: contact@dropeat.co.uk.
In some services we may act as a processor for data supplied by a partner restaurant. The relevant agreement determines the parties’ roles and any processor instructions.
2. Personal data and sources
We may process names, business roles, restaurant details, contact information, account identifiers, language and currency preferences, support messages, requested services, uploaded menus, business documents, technical logs, IP addresses and website interaction data, depending on your use of the service.
We ordinarily receive this data from you, your restaurant organisation or an authorised representative. Where a business contact is sourced from public business directories, websites or other lawful sources for B2B outreach, we record the source where reasonably available and provide appropriate transparency. Do not provide sensitive personal data unless requested and necessary.
3. Purposes and legal bases
Contract or steps requested before contract: registering and managing an account, responding to service applications, preparing offers, supporting onboarding and delivering contracted services.
Legitimate interests: operating and securing the website, improving customer support, preventing abuse, administering business relationships and proportionate business-to-business communications after a documented balancing assessment.
Legal obligation: maintaining legally required business, accounting and compliance records and responding to lawful requests. Consent: optional marketing or device storage where it is legally required. You can withdraw consent at any time without affecting earlier lawful processing.
4. Marketing and rights to object
Service communications are distinct from optional direct marketing. Business marketing is carried out subject to UK GDPR and the Privacy and Electronic Communications Regulations 2003. The rules differ for companies versus sole traders and other individual subscribers.
You can object to direct marketing at any time, including business-context marketing involving your personal data. We will stop processing that personal data for direct marketing following your objection. Contact us at contact@dropeat.co.uk with “marketing opt-out” in the subject line.
Special onboarding documents provided through sales representatives
With the restaurant operator's permission and a documented lawful basis, authorised sales representatives can submit business registration extracts, identity documents for authorised representatives, business banking evidence and menus to a private DropEat onboarding folder. Identity and banking evidence may contain sensitive personal and financial information and should be requested only when actually necessary for identity verification, contracting or lawful payment administration.
Access to the underlying private files is limited to authorised DropEat administrators and staff who need it to review that purpose. The sales representative can see the category, date and review status, but not retrieve the private identity or banking file through the sales CRM after submission. AI onboarding assistance is supplied only with the list of document categories and non-identifying operational information; identity and banking file contents are not sent to the language model through this workflow.
The company will assess the lawful basis, minimum information needed and suitable retention period for each type of document before relying on it operationally. Please do not upload card numbers, online banking credentials, passwords or access codes. Contact contact@dropeat.co.uk to request access or raise concerns.
5. Recipients and service providers
Only people who need access for business purposes should see your information. We may share appropriate data with contracted hosting, analytics, communications, authentication, business operations and technical support providers; advisers; public authorities where required by law; and relevant independent restaurants or partners for an authorised service request.
Third parties receiving your data for their own independent purposes will have their own legal obligations and privacy notices. We do not claim that every third-party tool described on the marketing site is necessarily in use for every customer.
6. International transfers
Systems and service providers may process data outside the United Kingdom. Where UK GDPR restricted-transfer rules apply, transfers must rely on UK adequacy regulations or appropriate safeguards, such as the UK International Data Transfer Agreement or the UK Addendum to EU standard contractual clauses, as applicable.
You may ask for information about relevant transfer safeguards using the contact above. Specific provider locations are assessed as part of the service configuration.
7. Retention and security
We retain account and business records while reasonably required to provide services, resolve issues and meet relevant legal requirements. Accounting records may be retained for statutory recordkeeping periods. Support correspondence, marketing contacts and technical logs are periodically reviewed and deleted or anonymised when no longer necessary, subject to legal holds.
Access controls, role-based permissions and appropriate technical and organisational safeguards are used in proportion to the risks. No online service can promise absolute security.
8. Your rights
Depending on the processing and legal basis, individuals can request access, correction, deletion, restriction, portability or object to processing; you may also withdraw consent where consent is relied upon. Some rights are subject to statutory exceptions.
You may complain to us through contact@dropeat.co.uk and contact the Information Commissioner’s Office (ICO). We maintain a process for data protection complaints in line with UK requirements, including the Data (Use and Access) Act 2025.
9. Automated tools, children and updates
AI-enabled assistance, estimators or automation may help analyse submitted information or recommend services. Such tools are advisory; we do not intend them to make solely automated decisions with legal or similarly significant effects without appropriate safeguards. Contact us if you believe such a decision has affected you.
The website and services are directed at businesses, not children. We update this notice as practices and legal requirements evolve and identify the update date at the top of the page.