UK GDPR privacy policy generator for restaurants, cafes and takeaways
UK food businesses follow the UK GDPR and the Data Protection Act 2018, with marketing and cookies covered by PECR. The ICO expects a clear privacy notice wherever you collect customer data: your website, ordering page, WiFi login and loyalty sign-up.
The generator below covers the situations a UK restaurant or takeaway actually meets, from orders through your own website and delivery partners to CCTV and email marketing.
Your privacy policy
Fill in to finish:
- Trading name
- Registered company name
- Business address
- Contact email
Privacy policy
Last updated: 27 October 2026
This policy explains how our business, trading as our business ("we", "us", "our"), collects, uses, shares and protects your personal data when you visit our outlets, order from us, use our website or join our programmes, and the choices and rights you have.
Who we are and how to contact us
- our business, trading as our business
- Address: , United Kingdom
- Email:
For the purposes of the GDPR, our business is the controller of your personal data.
Laws this policy follows
- UK General Data Protection Regulation and the Data Protection Act 2018
What we collect and why
We only collect what we need. Here is what we collect in each situation, and what we use it for.
When you order from us (online, pickup, delivery or at the table)
What we collect:
- your name, phone number and email address
- your delivery address and any delivery notes
- what you ordered, when, and any special requests
Why we use it:
- to prepare, deliver or hand over your order
- to contact you about your order, for example if an item is unavailable or your rider is on the way
- to issue receipts and handle refunds or complaints
Legal basis under the GDPR: performance of a contract with you (to take and deliver your order).
When you pay
What we collect:
- the amount, payment method and payment status
- payment details you enter are handled by our payment provider; we do not see or store your full card number
Why we use it:
- to take payment and issue refunds
- to detect and prevent fraud
- to keep the tax and accounting records the law requires
Legal basis under the GDPR: performance of a contract with you, and our legal obligations for tax and accounting.
When you agree to hear from us
What we collect:
- your name, phone number (including WhatsApp) and email address
- what you buy and which messages you open or click, so our offers are relevant
Why we use it:
- to send you promotions, new menu items and event news by WhatsApp, SMS or email
Legal basis under the GDPR: your consent; you can withdraw it at any time.
When you visit our website
What we collect:
- cookies and similar technologies on your device
- pages visited, device and browser type, approximate location from your IP address, and how you arrived
Why we use it:
- to make the website work, such as keeping your basket
- with your consent where required, to measure visits and show you relevant ads on other sites (for example Google Analytics and Meta Pixel)
Legal basis under the GDPR: your consent for analytics and advertising cookies; our legitimate interests for cookies strictly needed to run the website.
Allergy and dietary information
If you tell us about an allergy or dietary need, we use it only to prepare your food safely, with your consent, and we do not use it for marketing. Please also tell our staff in person: we cannot guarantee that any dish is free from allergens.
Who we share your data with
We do not sell your personal data. We share it only with:
- payment providers that process your payments
- other service providers that host our website, ordering, messaging and IT systems, under contracts that require them to protect your data and use it only for us
- professional advisers, such as accountants, auditors and lawyers
- the police, regulators, courts or other authorities, when the law requires it or to protect our rights, customers or staff
- a buyer or successor, if our business or part of it is sold or reorganised
Transfers outside your country
Some of our service providers store or process data in other countries. When we transfer your personal data abroad, we make sure it receives a comparable level of protection, for example by using providers in countries with adequate data protection laws or by contract terms that require them to protect it.
For transfers out of the EU or UK, we rely on an adequacy decision or on the standard contractual clauses approved for that purpose. You can ask us for a copy of the safeguards we use.
How long we keep your data
- orders, invoices and payment records: 6 years, because tax and accounting laws require it
- marketing preferences: until you unsubscribe; we keep a record of your opt-out so we do not contact you again
- anything else: only as long as needed for the purpose we collected it for, or as the law requires
How we protect your data
We use reasonable technical and organisational measures to protect your personal data against loss, misuse and unauthorised access, including encrypted connections, access limited to staff who need it, and service providers bound by confidentiality. No system is completely secure, so please keep your account login details private.
If a data breach is likely to put you at risk, we will tell you and the relevant authority as the law requires.
Marketing and how to stop it
We only send marketing messages if you agreed to them or if the law otherwise allows it. You can stop them at any time: use the unsubscribe link in an email, reply STOP to a WhatsApp or SMS message, change your account settings, or contact us. Stopping marketing does not affect messages about your orders.
Cookies
Some cookies are needed for our website to work and cannot be switched off. We only use analytics and advertising cookies with your consent where the law requires it, and you can change your choice at any time in your browser or in our cookie settings.
Your rights
You can:
- access your personal data and receive a copy
- have inaccurate personal data corrected
- have your personal data erased in certain cases
- restrict our processing in certain cases
- receive personal data you gave us in a portable format, or have it sent to another organisation
- object to processing based on our legitimate interests, and to direct marketing at any time
- withdraw your consent at any time
We will reply within one month of receiving your request, or tell you within that month if we need up to two more months.
To use any of these rights, email us at . We may need to confirm your identity before we act on your request. We will not treat you less favourably for using your rights.
Children
Our services are not aimed at children. We do not knowingly collect personal data from children without the consent of a parent or guardian. If you think a child has given us personal data, please contact us and we will delete it.
Complaints
If you are unhappy with how we handled your personal data, please contact us first at so we can try to put it right.
You can also complain to the Information Commissioner's Office (ICO), www.ico.org.uk.
Changes to this policy
We may update this policy from time to time. We will post the new version on this page with a new "Last updated" date, and tell you directly about important changes where the law requires it.
Before you publish
- Read the whole policy and remove anything that does not match what you really do. A policy that describes practices you do not follow is worse than none.
- Have a lawyer qualified in each country you selected review it before you rely on it. This generator is a drafting aid, not legal advice.
- Publish it where customers can find it before they give you data: your website footer, online ordering page, WiFi sign-in page and loyalty sign-up.
- UK: under PECR, non-essential cookies and marketing emails or texts need consent. Add a cookie banner with a real "Reject" choice.
- UK: if you have no establishment in the UK but offer food or delivery to people there, you may need a UK representative.
- UK: check whether you must pay the ICO data protection fee.
Nothing you type here is sent to or saved by EatsVenture: the policy is put together in your browser. This tool is a drafting aid, not legal advice, and does not guarantee compliance with any law.
What UK law means for your restaurant
PECR for marketing
Marketing emails and texts to individuals generally need consent. The soft opt-in can apply to existing customers if you gave them a chance to opt out when they ordered and in every message.
ICO data protection fee
Most businesses that process personal data must pay the ICO data protection fee unless they are exempt. Check your tier on the ICO website.
Cookie consent
Analytics and advertising cookies need consent before they are set. Add a banner where rejecting is as easy as accepting.
Privacy policy generator by country
Questions restaurant owners ask
Do takeaways using Just Eat, Deliveroo or Uber Eats need their own privacy policy?
The platform's policy covers what customers enter in its app. If you receive customer names, phone numbers or addresses to fulfil orders, or run your own website, loyalty or marketing, you need your own notice for that.
How long should a UK restaurant keep CCTV footage?
There is no fixed period. Keep it only as long as needed for its purpose, commonly around 30 days unless an incident is being investigated, and document your choice.
Is this privacy policy generator really free?
Yes. There is no sign-up and no watermark. Copy the text or download it as HTML, Markdown or PDF and use it on your own website.
Do you store the details I type in?
No. The policy is put together in your browser. Your business details are not sent to or saved on our servers.
Which countries does it cover?
It has specific clauses for Malaysia (PDPA), Singapore (PDPA), the European Union (GDPR) and the United Kingdom (UK GDPR). You can also select other countries, which get general clauses and a reminder to check local law.
Is the generated policy legal advice?
No. It is a restaurant-specific draft to save you time. Check that it matches what you actually do, and have it reviewed by a lawyer in each country where you operate.
Keep it up to date without thinking about it
EatsVenture runs your own online ordering, loyalty and WhatsApp marketing, with your privacy policy, terms and refund policy filled in from your business details and published on your ordering site.
Talk to us on WhatsApp