Privacy Policy

Last updated: 13 October 2026

This Privacy Policy explains how TastyMeal.co.UK (“TastyMeal”, “we”, “us”, “our”) collects, uses, and shares personal data when you use the food-ordering website at tastymeal.co.uk and the customer features on that site (account, checkout, live chat, reviews, push notifications, and fingerprint login).

Please also read our Terms & Conditions.

1. Who we are

The controller of your personal data is TastyMeal.co.UK.

To reach us, use live chat or the contact form.

Contact form

TastyMeal is a UK marketplace. Independent restaurants list menus and prepare meals. We provide the ordering site, customer account, the payment methods we offer, order status, Grains of Seasoning, ranks, and customer support.

We serve customers in the UK delivery and collection areas we publish (including Grimsby and listed postcodes).

2. What this policy covers

This policy covers personal data processed for customers and visitors of tastymeal.co.uk. Restaurant kitchen tools (including a restaurant tablet app) are used by restaurants to receive and prepare orders. Those restaurants are separate businesses; they receive the order details they need to fulfil your meal.

UK data protection law applies (UK GDPR and the Data Protection Act 2018). Electronic marketing and cookies also follow the Privacy and Electronic Communications Regulations (PECR).

3. Personal data we collect

We collect the data below. What we hold depends on how you use the site (guest checkout, account, chat, and so on).

Account and profile

Name, email address, telephone number
Password (stored as a hash; we cannot read your password)
Newsletter preference
Saved delivery and billing addresses (including postcode, street, house number, and flat where you give them)
Wishlist
Rank, XP, and Grains of Seasoning on your account
Trusted-device token used to recognise this browser for security

Orders and checkout

Basket contents, quantities, options, kitchen comments, coupons, gift vouchers, and Grains you spend
Fulfilment choice (delivery or collection), delivery address, and the timeslot you pick
Order totals, restaurant(s) in the basket, and order status history
Payment method you chose (for example PayPal card, PayPal wallet, Google Pay, cash on delivery, or cash on collection). We do not store full card numbers or CVV
Guest checkout details if you order without an account

Postcode and location for delivery

To show restaurants that can serve you, we store the delivery postcode you select (and house number / flat when you enter them). We look that postcode up in our own UK postcode tables. Checkout uses stored delivery-fee bands for that restaurant and distance. We do not track your phone’s live GPS to price an order.

Reviews

If you rate an order or leave a restaurant review, we store the rating, title, and comments, linked to the order and restaurant. Review-invite emails use a one-time token so you can rate a delivered order.

Support chat and restaurant messages

Live chat on the site is first-party (run by us, not an embed from another chat company). We store messages, timestamps, and any files you attach, plus the position of the chat launcher on your screen if you move it. You can also leave a message when chat is offline, or contact a restaurant from the shop. Those threads are stored so we and the restaurant can reply.

Fingerprint / Face ID login (WebAuthn)

If you turn on fingerprint or Face ID login, your device keeps the private key in the phone or computer’s own passkey vault (for example Apple Passwords or Google Password Manager). We store only the public key and credential id on your customer account. Browser storage holds on/off flags so the login button can show the right state. We never receive your fingerprint image or Face ID biometric.

Push notifications

If you allow browser push, we store a push subscription for this browser so we can send order and account notices. You can turn this off in the browser or on the site. We send push ourselves using first-party keys. We do not use a third-party marketing-push vendor.

Marketing email

If you opt in, we send newsletters and similar mail from our own mail server (mail.tastymeal.co.uk). Subscription is the newsletter flag on your customer account. Every marketing mail includes a way to unsubscribe. Transactional mail (order confirmations, password reset, review invites) is sent because you used the service.

Contact form, returns, and affiliate

Contact form: name, email, enquiry, and a first-party captcha check
Returns: the details you submit on a return request
Affiliate programme: account and commission records if you register as an affiliate

Security, logs, and cookie acknowledgement

When you tap OK on the cookies notice we store a first-party cookie and may store a one-way hash of your public IP address so we do not keep asking. We do not store the raw IP in that acknowledgement table. Private and loopback addresses are skipped
Web-server access logs (IP address, time, pages requested) for security, debugging, and abuse prevention
A first-party image captcha on register, guest checkout, returns, and contact (not Google reCAPTCHA)

We do not run Google Analytics, advertising pixels, or Facebook Login on this shop.

4. How we use personal data and the legal bases

UK GDPR requires a lawful basis for each use. These are the bases we rely on.

Contract (to provide the service you asked for)

Create and run your account
Take and fulfil orders, including passing the order to the restaurant
Take payment through the method you chose, or record cash on delivery / collection
Show delivery or collection options, timeslots, and order status
Customer support, including live chat about an order or the site
Grains, ranks, coupons, and gift vouchers that are part of the service

Legitimate interests

Keeping the shop secure (CSRF protection, device token, abuse prevention, server logs)
Remembering that you accepted strictly necessary cookies (hashed IP acknowledgement)
Remembering your postcode, theme, cart, and chat-launcher position so the site works as you left it
Detecting fraud, fake reviews, and abuse of Grains or accounts
Internal delivery-distance tools used by us to maintain fee bands (road-distance calculations run on our own servers; checkout uses stored fees)

You can object to processing based on legitimate interests. See section 10.

Consent

Marketing emails (newsletter flag)
Browser push notifications
Fingerprint / Face ID login

You can withdraw consent at any time (unsubscribe, disable push, or turn fingerprint login off). Withdrawal does not affect processing already carried out.

Legal obligation

Tax, accounting, and records we must keep
Responding to a lawful request from a court, regulator, or law-enforcement body

5. Cookies and browser storage

We use cookies and browser storage only so this shop can work: session, cart, delivery postcode, login, theme, and security. There are no advertising, marketing, or optional analytics cookies. We do not sell your data or share it with advertisers.

These items are strictly necessary for the service under PECR. The first-visit notice asks you to tap OK to continue, or leave the site. The Privacy Policy and other information pages can be read without that notice so you can review this text first.

First-party cookies

PHPSESSID — PHP session (logged-in state, basket, checkout, security tokens). HttpOnly
pbdpid_small — the delivery postcode you selected, so we can show shops that serve you
tm_cookie_ok — records that you accepted the cookies notice (about 400 days, Secure, SameSite Lax)
selected_shipping_method — delivery or collection preference used by the cart
tm_ship_by_seller — per-restaurant fulfilment choice in a mixed basket
TMDEVICE — trusted-device token for security. HttpOnly

Browser storage (localStorage / sessionStorage)

tm_theme_v1 — System, Dark, or Light theme
tm_cookie_ok_v1 — same acknowledgement as the cookie, kept in this browser
tm_pbdp_recent_v1 — recent postcodes you picked
tmWebauthnOn, tmWebauthnCredId, tmWebauthnNeedsReset — fingerprint-login flags only
tm_sc_launcher_pos_v5 — where you docked the support-chat launcher
Cart helpers so the shopping cart can restore itself in this browser

You can delete cookies and site storage in your browser. If you do, you will need to choose a postcode again, sign in again, and the cookies notice may return.

6. Payments

Card, PayPal wallet, and Google Pay are processed by PayPal. When you pay by card, PayPal’s hosted fields (their iframe) collect the card details. TastyMeal does not receive or store the full card number or CVV. PayPal’s own privacy statement applies to that processing: PayPal Privacy Statement.

If you choose Google Pay, Google and PayPal process that payment under their terms.

Cash on delivery and cash on collection are paid to the restaurant or driver. We record that you chose cash; we do not take a card for those orders.

If the basket total is £0 (for example a fully covered voucher), checkout can complete without a card payment.

7. Who we share personal data with

We share data only where it is needed to run the order or the site.

Restaurants — name, contact details as needed, delivery or collection address, items, options, comments, timeslot, and payment method (not your full card number) so they can prepare and hand over the meal. Kitchen screens and the restaurant tablet app show the same order data
PayPal (and Google, if you use Google Pay) — payment processing
Our hosting and mail servers — the shop and email run on servers we operate in Switzerland (see section 8)
You — order emails, password reset, review invites, newsletters you opted into, and push if you enabled it

We do not sell personal data. We do not share it with advertising networks, data brokers, or social-media ad platforms. The footer link to our Facebook page is a link to Facebook; we do not run Facebook Login or a Facebook pixel on this shop. If you open that link, Facebook’s own policy applies.

If you click the map link on the contact page, that opens Google Maps in a new tab under Google’s terms.

We may disclose data if the law requires it, or to protect customers, restaurants, or the service (for example fraud or abuse).

8. International transfers

The shop website and our mail server are hosted in Switzerland. The UK treats Switzerland as a country with adequate data protection, so that hosting is an adequacy transfer under UK GDPR.

PayPal (and Google Pay, if you use it) may process payment data in the United States and other countries under PayPal’s and Google’s terms and transfer tools.

Domain-name lookup for tastymeal.co.uk uses Cloudflare DNS. Page traffic itself is served from our origin in Switzerland; Cloudflare is not used as a content-delivery proxy for the shop.

9. How long we keep data

Account — for as long as the account is open, then a short period after closure unless we must keep records
Orders, invoices, and payment records — typically six years, which matches UK tax and accounting practice
Support chat and restaurant contact threads — while needed for support, then routine deletion
Cookie acknowledgement — about 400 days
Push subscription — until you unsubscribe or the subscription dies
WebAuthn public key — until you turn fingerprint login off
Newsletter flag — until you unsubscribe or the account is deleted
Reviews — while published, unless removed
Server logs — a limited period for security and debugging
Review-invite tokens — about 90 days if unused

10. Your rights

Under UK GDPR you can ask us to:

Access the personal data we hold about you
Correct inaccurate data
Erase data (where the law allows — we may keep order records we must retain)
Restrict or object to certain processing, including legitimate-interests processing
Receive a copy of data you provided, in a portable format (data portability, where it applies)
Withdraw consent (newsletter, push, fingerprint login)

To use these rights, use live chat or the contact form. You can also edit much of your account yourself when logged in (details, addresses, password, newsletter, fingerprint login, push).

You can complain to the UK regulator, the Information Commissioner’s Office (ICO): ico.org.uk. We would like the chance to put things right first.

11. Marketing

We send marketing email only if you are subscribed (account newsletter flag). Mail goes out from our own server. Each marketing message includes an unsubscribe link. Turning the flag off in My account → Newsletter stops further marketing mail. Order and account messages still go out when needed to run the service.

12. Security

The site is served over HTTPS. Passwords are hashed. Sessions and the device token use HttpOnly cookies. Card details are entered in PayPal’s hosted fields, not in our forms. Fingerprint private keys stay on your device. We limit staff and restaurant access to order data needed to fulfil or support the order.

No method of transmission or storage is perfectly secure. Please keep your password and device passkeys to yourself and tell us if you think someone else has used your account.

13. Children

TastyMeal is for customers aged 16 or over. We do not knowingly collect personal data from children. If you believe a child has given us data, contact us and we will delete it where we can.

14. Changes to this policy

We will update this page when the service changes (for example a new payment method or a new cookie). The “Last updated” date at the top will change. Continued use of the site after an update means the new policy applies from that date.

15. How to contact us

Use live chat or the contact form.

Contact form

ICO: https://ico.org.uk/