Privacy
Policy

1/ Background and Definitions

La Boîte à Encas UK (“Foodles”) is a company incorporated in England and Wales, registered at Companies House under number 13746097, with its registered office at 8th Floor South, 11 Old Jewry, London EC2R 8DU. Foodles is registered as a data controller with the Information Commissioner’s Office (“ICO”).

Foodles operates a digital Marketplace that connects employees (“Customers”) of corporate partner organisations (“Companies”) with food and beverage operators (“Partner Restaurants”), enabling Customers to place Group Orders for delivery to their workplace premises.

This Privacy Policy explains how Foodles, as UK data controller, collects, uses, stores, and shares personal data when you use Foodles’ Marketplace or related services (together, the “Service”). It also explains your rights under the UK General Data Protection Regulation (“UK GDPR”) and the Data Protection Act 2018 (“DPA 2018”).

Please read this Privacy Policy carefully before using the Service. By accessing or using the Foodles Marketplace, you acknowledge that you have read and understood this Privacy Policy.

Key definitions used in this Policy:

• UK GDPR: the UK General Data Protection Regulation as it forms part of UK law by virtue of section 3 of the European Union (Withdrawal) Act 2018, as amended.
• Data Controller: the entity that determines the purposes and means of processing personal data. Foodles is the data controller for data processed in connection with your use of the Marketplace.
• Data Processor: an entity that processes personal data on behalf of a data controller.
• Personal Data: any information relating to an identified or identifiable natural person.
• Group Order: a consolidated food and/or beverage order placed by one or more Customers at the same Company during an Order Window, combined by Partner Restaurant.
• Allowance: employer-funded credit made available to you by your Company for use on the Marketplace, the administration of which involves your Company as a separate data controller.
• Order Window: the period during which Customers at a Company location may submit individual selections that are aggregated into a Group Order.

‍

‍

2/ Information We Collect About You

2.1 Information you provide directly

When you register for an account, place a Group Order, or contact us, we collect:

• Your name and work email address (used to link you to your Company account and to communicate with you about orders);
• Your dietary preferences, allergen profile, and food choices, which you voluntarily enter to help personalise your experience;
• Payment information: if you use a personal Top-Up card to pay for the portion of an order exceeding your Allowance, payment card details are handled by our third-party payment processor (Stripe) and are not stored by Foodles directly;
• Communications you send to us (e.g. support requests, complaints);
• Any other information you choose to provide to us.

2.2 Information we collect automatically

When you use the Marketplace, we automatically collect:

• Technical data: IP address, browser type and version, operating system, device identifiers;
• Usage data: pages visited, features used, search queries, order history, time and date of access;
•  Cookie and tracking data: please see Section 9 (Cookies and Tracking Technologies) for full details.

2.3 Information we receive from third parties

We may receive information about you from:

• Your Company (employer): when your Company registers you as an Authorised User, they provide your name, work email address, and Allowance entitlement. Your Company acts as a separate, independent data controller in respect of this registration and Allowance administration; Foodles processes this data on the basis of its legitimate interests in facilitating access to the Service.
• Once a Group Order is submitted, Partner Restaurants receive the order content necessary to prepare it. We may receive order fulfilment confirmation from Partner Restaurants in connection with delivery status or dispute resolution. See Section 5.1 for details of what is, and is not, shared with Partner Restaurants.
• Stripe provides Foodles with tokenised payment confirmation data (e.g. payment status, last 4 digits of card) but does not share full card details with Foodles.

2.4 Mandatory and optional data

Certain personal data is necessary for us to provide the Service. Your name and work email address are required to create your account and link it to your Company; without them we cannot provide you with access to the Marketplace. Where you choose to pay a Top-Up amount, provision of payment card details to Stripe is required to complete that transaction.

Other data is optional. Your dietary preferences and allergen information are not required to use the Marketplace but, if not provided, we will not be able to highlight Products that may suit your dietary needs. You may add, update, or delete this information at any time in your account settings.

‍

‍

3/ Legal Bases for Processing

Foodles relies on the following legal bases under UK GDPR Article 6 to process your personal data:

(a) Performance of a contract (Article 6(1)(b)): to provide the Service to you, including processing your Group Order, handling your Allowance balance, communicating with you about your order, and enabling Partner Restaurants to deliver your food.

(b) Compliance with a legal obligation (Article 6(1)(c)): to comply with applicable UK laws, including food safety regulations, financial record-keeping obligations, and responding to lawful requests from regulatory authorities.

(c) Legitimate interests (Article 6(1)(f)): to operate and improve the Marketplace, prevent fraud, ensure security, analyse usage patterns, and communicate service updates. We have conducted legitimate interests assessments to confirm that our interests are not overridden by your rights and freedoms.

(d) Consent (Article 6(1)(a)): where we send you marketing communications or use non-essential cookies, we will ask for your consent, which you may withdraw at any time.

Where we process special category data (such as dietary requirements and allergen information that may reveal health conditions), we rely on your explicit consent (UK GDPR Article 9(2)(a)). You may withdraw this consent at any time by updating or deleting your dietary profile in the Marketplace, but this may affect our ability to tailor the Service to your needs.

‍

‍

4/ How We Use Your Information

We use your personal data for the following purposes:

• Service provision: to register your account, process Group Orders during Order Windows, manage your Allowance balance (including Top-Up payments), and communicate with you regarding your orders.
• Customer support: to respond to your enquiries, complaints, and requests.
• Dietary personalisation: to store your dietary preferences and allergen information so that the Marketplace can help highlight Products that may be suitable for your requirements. Foodles does not transmit your dietary or allergen data to Partner Restaurants. If you have a food allergy or intolerance, you must contact the Partner Restaurant directly before placing your Order; please see the allergen guidance in our Customer Terms and Conditions.
• Fraud prevention and security: to detect and prevent fraudulent activity, unauthorised access, and abuse of the Marketplace.
• Service improvement and analytics: to analyse how the Marketplace is used (including aggregate Group Order patterns) in order to improve the Service. Analytical data shared with your Company will be anonymised or aggregated and will not identify you individually.
• Legal compliance: to meet our legal and regulatory obligations, including under applicable UK food safety, consumer protection, and financial record-keeping laws.
• Marketing (with your consent): to send you promotional communications about Foodles or Partner Restaurants where you have opted in. You can unsubscribe at any time.

‍

‍

5/ Sharing Your Information

We share your personal data only as described below. We do not sell your personal data to third parties.

5.1 Partner Restaurants (independent data controllers)

Partner Restaurants receive only the information strictly necessary to prepare and fulfil your Group Order:

• the items and quantities included in your Group Order, and the relevant Order Window time slot;
• Foodles provides Partner Restaurants with labels bearing each employee's name, which the Partner Restaurant uses to label individual portions to facilitate distribution at your Company's premises;
• the Company premises delivery address (not your personal home address).

Partner Restaurants do not receive your allergen profile, dietary preferences, personal contact details (email or phone), or payment card information from Foodles. If you have a food allergy, intolerance, or dietary requirement, you must contact the Partner Restaurant directly before placing your Order; please refer to the allergen guidance in our Customer Terms and Conditions, available at grouporder.foodles.co.

Partner Restaurants act as independent data controllers for their own processing of this order data, including for food safety record-keeping purposes under the Food Information Regulations 2014 and applicable food safety legislation. Foodles is not responsible for Partner Restaurants’ privacy practices.

5.2 Your Company (employer)

Your Company may have visibility of:

• Your participation in Group Orders (i.e. whether you have placed an order on a given day), for the purposes of Allowance administration and budget management;
• Aggregate order data linked to your Allowance usage (e.g. the amount debited from your Allowance per order), but not the specific food items you ordered unless you expressly consent or your Company’s use of the Marketplace is configured to include item-level data.
• Your Company will not receive your Top-Up payment card details.

Your Company acts as a separate independent data controller in relation to Allowance administration. Please refer to your Company’s own privacy policy for information about how it processes your personal data in that context.

5.3 Service providers (data processors)

We use trusted third-party service providers to support the operation of the Marketplace, including:

• Stripe: payment processing for Top-Up transactions.
• Cloud hosting providers: secure storage and infrastructure.
• Analytics providers: anonymised usage analytics (see Section 4).
• Email service providers: transactional and marketing communications.

All service providers act as data processors under written data processing agreements and are prohibited from using your data for their own purposes.

5.4 Legal and regulatory disclosures

We may disclose personal data to law enforcement, regulatory bodies (including the ICO), or courts where required by applicable UK law, or where necessary to protect our legal rights or the safety of our users.

5.5 Business transfers

In the event of a merger, acquisition, or sale of all or substantially all of our assets, personal data held by Foodles may be transferred to the relevant third party, subject to equivalent data protection obligations. We will notify you before your personal data is transferred and becomes subject to a materially different privacy policy.

‍

‍

6/ Data Security

We implement appropriate technical and organisational security measures to protect your personal data against unauthorised access, disclosure, alteration, or destruction, including:

• personal data is transmitted over encrypted connections (TLS/HTTPS);
• access to personal data within Foodles is restricted to authorised personnel on a need-to-know basis;
• all third-party service providers acting as data processors on our behalf are bound by contractual data protection obligations;
• we regularly review our data processing practices and security controls to maintain appropriate standards.

No internet transmission or electronic storage system is completely secure. If you believe that your account has been compromised, or that your personal data has been accessed without authorisation, please contact us immediately at privacy@foodles.co.

In the event of a personal data breach that is likely to result in a risk to your rights and freedoms, Foodles will report the breach to the ICO within 72 hours in accordance with UK GDPR Article 33, and will notify you directly where required under Article 34.

‍

‍

7/ Data Retention

We retain your personal data only for as long as necessary for the purposes set out in this Privacy Policy, or as required by law:

• Account data: retained for the duration of your active account, plus 6 years after account closure (to comply with legal and contractual record-keeping obligations).
• Order data: retained for 6 years from the date of the relevant Group Order, in line with statutory limitation periods and UK food safety record-keeping requirements.
• Dietary and allergen data: retained for the duration of your active account. This data is deleted promptly upon account closure or upon your withdrawal of consent.
• Payment records: retained for at least 6 years to comply with HMRC requirements.
• Marketing preferences: retained until you withdraw consent or opt out.
• may be retained indefinitely as it can no longer identify you.

When data is no longer required, we will delete or anonymise it securely. Where immediate deletion is not technically possible, we will ensure the data is securely isolated until deletion is feasible.

‍

‍

8/ International Data Transfers

Your personal data is primarily stored and processed within the United Kingdom. In certain circumstances, your data may be transferred to countries outside the UK, for example where our service providers operate data centres or offices internationally.

We will only transfer your personal data to countries outside the UK where one of the following safeguards applies:

• The destination country benefits from a UK “adequacy regulation” under section 17A DPA 2018 (i.e. the UK Secretary of State has determined that the country provides an adequate level of data protection);
• The transfer is governed by a UK International Data Transfer Agreement (“IDTA”) or the International Data Transfer Addendum to the European Commission’s Standard Contractual Clauses (“SCC Addendum”), as approved by the ICO;
• Another appropriate safeguard applies under UK GDPR Chapter V.

You may request details of the specific safeguards applicable to any transfer of your personal data by contacting us at the address in Section 13.

‍

‍

9/ Your Rights

Under the UK GDPR and DPA 2018, you have the following rights in relation to your personal data:

• Right of access (Article 15): to request a copy of the personal data we hold about you (a “data subject access request” or “DSAR”).
• Right to rectification (Article 16): to ask us to correct inaccurate or incomplete data.
• Right to erasure (Article 17): to ask us to delete your personal data where there is no compelling reason for its continued processing.
• Right to restrict processing (Article 18): to ask us to suspend processing of your personal data in certain circumstances.
• Right to data portability (Article 20): to receive your personal data in a structured, commonly used, machine-readable format, and to transmit it to another controller, where processing is based on consent or contract and is carried out by automated means.
• Right to object (Article 21): to object to processing based on legitimate interests (Article 6(1)(f)) or for direct marketing purposes. Where you object to processing for direct marketing, we will stop processing immediately.
• not to be subject to a decision based solely on automated processing (including profiling) that produces legal or similarly significant effects. We do not currently use automated decision-making in a way that produces such effects, but we will inform you if this changes and provide you with the right to request human review.
• Right to withdraw consent: where processing is based on your consent, you may withdraw it at any time. Withdrawal does not affect the lawfulness of processing carried out before withdrawal.

To exercise any of these rights, please contact us at privacy@foodles.co. We will respond within one month in accordance with UK GDPR Article 12(3). We may need to verify your identity before processing your request.

If you are dissatisfied with our response, you have the right to lodge a complaint with the Information Commissioner’s Office (ICO): ico.org.uk, helpline 0303 123 1113.

‍

‍

10/ Cookies and Tracking Technologies

We use cookies and similar tracking technologies on the Marketplace. Cookies are small text files placed on your device that help us operate the Marketplace and improve your experience.

10.1 Types of cookies we use

We use the following categories of cookies:

• essential for the Marketplace to function (e.g. session authentication). These cannot be disabled.
• remember your preferences (e.g. language, dietary filters) to improve your experience. You may disable these via your browser settings.
• collect anonymised data about how visitors use the Marketplace (e.g. pages visited, time spent). We use analytics tools subject to data processing agreements. You may opt out via your browser settings or our cookie consent tool.
• used only with your consent to serve relevant promotional content. You may withdraw consent at any time via our cookie preference centre.

A full list of the cookies we use, their purposes, and their retention periods is available in our Cookie Notice at grouporder.foodles.co/cookie-policy.

10.2 Managing cookies

You can configure cookies through your browser settings. Note that disabling certain cookies may affect the functionality of the Marketplace. For more information on managing cookies, visit www.allaboutcookies.org.

‍

‍

11/ Children’s Privacy

The Marketplace is intended solely for use by adult employees of registered Companies. We do not knowingly collect personal data from individuals under the age of 18. If you believe we have inadvertently collected such data, please contact us immediately at privacy@foodles.co and we will delete it promptly.

‍

‍

12/ Changes to this Privacy Policy

We may update this Privacy Policy from time to time. We will publish any changes on this page and, where the changes are significant, provide you with more prominent notice (such as an email notification). The “effective date” at the top of this page indicates when this Privacy Policy was last revised. Your continued use of the Service after any changes constitutes your acceptance of the updated Privacy Policy.

If we wish to use your personal data for a new purpose not covered by this Privacy Policy, we will provide you with a new privacy notice explaining the new use prior to commencing the processing and, where required by law, seek your consent.

‍

‍

13/ Contact Us

If you have any questions, concerns, or requests regarding this Privacy Policy or our processing of your personal data, please contact us:

Data Controller:

‍

8th Floor South, 11 Old Jewry, London EC2R 8DU

miam@foodles.co

Website: grouporder.foodles.co

You may also contact our Data Protection representative at the address above.

You also have the right to lodge a complaint with the supervisory authority:

Information Commissioner’s Office (ICO)

‍