Privacy Policy
Food Whisperer UK Limited
Last Updated: 29-09-2026
Food Whisperer UK Limited (“Food Whisperer”, “we”, “us” or “our”) respects your privacy and is committed to protecting your personal data.
This Privacy Policy explains how we collect, use, disclose, retain and protect personal data when you use our website, mobile application, products and services, place an order, contact us, or otherwise interact with us.
We process personal data in accordance with applicable data protection and privacy laws, including the UK General Data Protection Regulation (UK GDPR) and the Data Protection Act 2018, together with applicable requirements relating to electronic communications and cookies.
This Privacy Policy should be read together with our Cookie Policy and any other privacy information or notices provided to you at the point at which we collect your personal data.
Who We Are
Food Whisperer UK Limited provides food delivery and related services to student housing and co-living accommodation providers.
In providing these services, Food Whisperer may process personal data relating to residents, students, customers and other individuals on behalf of the student housing or co-living organisation that engages our services.
For such processing, Food Whisperer UK Limited acts as a Data Processor under applicable data protection laws, including the UK GDPR. The relevant student housing or co-living organisation acts as the Data Controller and determines the purposes and means for which personal data is processed.
Food Whisperer processes personal data only in accordance with the applicable contractual arrangements and the documented instructions of the relevant Data Controller, except where we are required to process personal data by applicable law.
We maintain appropriate technical and organisational measures designed to protect personal data against unauthorised access, loss, alteration, disclosure or other unlawful processing.
Our details
Food Whisperer UK Limited
2 London Wall Place
London
EC2Y 5AU
United Kingdom
Support enquiries: support@foodwhisperer.co.uk
Data Protection contact: dpo@foodwhisperer.co.uk
ICO Registration Number: ZC040546
Where another organisation processes personal data on our behalf, that organisation may act as a data processor or, depending on the circumstances, as a separate or joint controller.
What Personal Data We Collect
The personal data we collect depends on how you use our services.
We may collect the following categories of information:
Identity and contact information
This may include:
- Name;
- Email address;
- Telephone/mobile number;
- Delivery or billing address;
- Account information;
We do not normally store your full payment card details where payment processing is performed by an external payment service provider.
Order and transaction information
When you place an order, we may collect:
- Order details;
- Items purchased;
- Order date and time;
- Delivery information;
- Order status;
- Refund or cancellation information;
- Transaction references; and
- Relevant customer-service correspondence.
Payment information
Payments is processed through third-party payment service providers.
Depending on the payment method used, we may receive information such as:
- Payment status;
- Transaction/reference number;
- Payment method;
- Refund information; and
We do not generally require or store complete payment card details ourselves where the payment is handled directly by a third-party payment provider.
Communications and support information
If you contact us, we may collect:
- Your name and contact details;
- The content of your enquiry;
- Complaint or support information;
- Order-related information;
- Correspondence history; and
- Information necessary to resolve your enquiry.
Usage and analytics information
Where permitted, we may collect information about how users interact with our website, application and services to understand usage, improve functionality and maintain service performance.
Where consent is required for analytics or similar technologies, we will obtain consent before using them.
How We Use Your Personal Data
We use personal data only where we have a lawful basis to do so.
Depending on the circumstances, we may use personal data to:
- Create and manage customer accounts;
- Process and fulfil food orders;
- Arrange delivery services;
- Process payments, refunds and cancellations;
- Communicate with you regarding your orders or account;
- Provide customer support;
- Respond to enquiries and complaints;
- Maintain and improve our website, application and services;
- Monitor service performance and security;
- Detect and prevent fraud, misuse and unauthorised activity;
- Maintain appropriate business and operational records;
- Comply with legal and regulatory obligations;
- Send promotional communications where permitted and where required, with your consent;
- Conduct analytics and service improvement activities where permitted;
- Manage cookies and similar technologies in accordance with our Cookie Policy; and
- Exercise or defend our legal rights.
We will not use your personal data for purposes that are incompatible with the purposes described in this Privacy Policy unless permitted or required by applicable law.
Our Lawful Bases for Processing
Under the UK GDPR, we must have a lawful basis for processing personal data.
Depending on the purpose, we may rely on one or more of the following lawful bases:
| Purpose | Lawful basis |
|---|---|
| Creating and managing your account | Article 6(1)(b) – Contract |
| Processing and fulfilling orders | Article 6(1)(b) – Contract |
| Processing payments and refunds | Article 6(1)(b) – Contract and, where applicable, Article 6(1)(c) – Legal obligation |
| Providing service-related communications | Article 6(1)(b) – Contract |
| Customer support and complaint handling | Article 6(1)(f) – Legitimate interests |
| Improving our website, application and services | Article 6(1)(f) – Legitimate interests |
| Fraud prevention and security | Article 6(1)(f) – Legitimate interests and, where applicable, Article 6(1)(c) – Legal obligation |
| Compliance with legal obligations | Article 6(1)(c) – Legal obligation |
| Promotional communications where consent is required | Article 6(1)(a) – Consent |
| Non-essential cookies and similar technologies where consent is required | Article 6(1)(a) – Consent |
Consent
Where we rely on your consent as the lawful basis for processing your personal data, we will ask you to provide consent through a clear and affirmative action.
Consent will be:
- Freely given;
- Specific to the relevant purpose;
- Informed;
- Unambiguous; and
- Capable of being withdrawn.
We will not treat silence, inactivity or simply continuing to use our website as consent where applicable law requires an affirmative action.
You are free to refuse consent where consent is requested.
Withdrawal of consent
Where processing is based on consent, you may withdraw your consent at any time.
Withdrawal of consent will not affect the lawfulness of processing carried out before the withdrawal.
For example, if you have consented to receive optional marketing communications, you may withdraw your consent by using the unsubscribe mechanism included in the communication or by contacting us.
Where consent is required for non-essential cookies or similar technologies, you can manage your preferences through our cookie consent mechanism.
We will maintain appropriate records of consent where necessary to demonstrate that valid consent was obtained.
The ICO requires consent to involve a clear positive action and notes that non-essential cookies should not be set before the required consent has been obtained.
Marketing Communications
We may send you service-related communications that are necessary for your account or orders, such as:
- Order confirmations;
- Delivery updates;
- Account notifications;
- Security notifications; and
- Important service communications.
These are different from promotional communications.
Where applicable law requires consent for direct marketing, we will obtain the appropriate consent before sending promotional communications.
You can unsubscribe from promotional communications at any time.
Unsubscribing from marketing communications will not normally stop essential service or transactional communications.
Who We Share Your Personal Data With
We may share personal data where necessary to provide our services, operate our business, comply with legal obligations, or protect our rights.
Depending on the circumstances, recipients may include:
Service providers and processors
Third parties that provide services to us, such as:
- Hosting and cloud service providers;
- Payment processors;
- Customer-support platforms;
- Email and communication providers;
- Analytics providers;
Food preparation and delivery partners
Where necessary to fulfil an order, relevant information may be shared with food preparation, fulfilment or delivery partners.
Our current arrangements include AQ Cuisine Limited where applicable to the relevant service.
Regulators and authorities
We may disclose personal data where required to:
- Comply with applicable law;
- Respond to lawful requests;
- Meet regulatory requirements;
- Prevent or investigate fraud or other unlawful activity; or
- Protect our rights, property or safety.
We will not sell your personal data to third parties.
International Transfers
Some of our service providers or technology providers may process personal data outside the United Kingdom.
Where personal data is transferred outside the UK, we will take appropriate steps to ensure that the transfer is lawful and that appropriate safeguards are in place.
Depending on the circumstances, these safeguards may include:
- A UK adequacy regulation or applicable adequacy decision;
- The UK International Data Transfer Agreement (IDTA);
- The UK Addendum to EU Standard Contractual Clauses;
- Appropriate contractual, technical and organisational safeguards; or
- Another lawful transfer mechanism permitted by applicable data protection law.
Where required, further information about applicable safeguards may be obtained by contacting us.
How Long We Keep Your Personal Data
We retain personal data only for as long as reasonably necessary for the purposes for which it was collected, including to meet legal, accounting, regulatory, dispute-resolution and reporting requirements.
Our current retention approach includes:
| Type of information | Typical retention period |
|---|---|
| Account/registration information | Duration of the account and up to 3 years after closure, where required |
| Order history | Up to 6 years |
| Payment/transaction references | Up to 8 years |
| Customer support and complaint records | Up to 3 years |
| Usage and analytics information | Generally, up to 13 months, subject to the relevant technology and purpose |
| Marketing consent records | For the duration of consent and for an appropriate period afterwards to demonstrate compliance |
Retention periods may vary where a longer period is required by law, necessary to establish or defend legal claims, or justified by another lawful purpose.
When personal data is no longer required, we will securely delete, anonymise or otherwise dispose of it in accordance with our applicable retention procedures.
Cookies
Our website and application may use cookies. Cookies may be used for purposes including:
- Essential website functionality;
- Security;
- Session management;
- Remembering preferences;
- Analytics;
- Performance monitoring; and
- Other optional functionality.
Where consent is required for non-essential cookies or similar technologies, we will obtain consent before using them.
Our Cookie Policy provides further information about the cookies and similar technologies we use and how you can manage your preferences.
The ICO requires organisations to provide clear information about cookies and obtain consent for cookies that are not covered by an applicable exemption.
Your Data Protection Rights
Subject to applicable law and certain conditions or exemptions, you may have the following rights:
- Right of access: You have the right to request access to the personal information we hold about you.
- Right to rectification: You can request that we correct inaccurate or incomplete personal information.
- Right to erasure: You have the right to request the deletion of your personal information under certain circumstances.
- Right to restriction: You have right to request to restrict the processing of your personal data in certain circumstances.
- Right to object: You can object to the processing of your personal information for specific purposes.
- Right to data portability: You have the right to receive your personal information in a structured, commonly used, and machine-readable format.
- Right to withdraw consent: If we rely on your consent for processing your data, you can withdraw that consent at any time.
- Automated Decision-Making and Profiling: We do not carry out automated decision-making or profiling that produces legal or similarly significant effects on you.
To exercise any of these rights, please contact us using the information provided in the “Contact Us” section below, or by emailing support@foodwhisperer.co.uk or dpo@foodwhisperer.co.uk. We will respond to your request within one calendar month. However, if the request is complex, then the timeline may be extended by two additional months and this extension and the reason for the same shall be communicated to you.
Complaints
If you have concerns about how we have handled your personal data, we encourage you to contact us first so that we can investigate and attempt to resolve the matter.
You also have the right to lodge a complaint with the UK’s data protection supervisory authority:
Information Commissioner’s Office (ICO) United Kingdom
You can find information about making a complaint on the ICO’s website:
Information Commissioner’s Office (ICO)
The right to complain to a supervisory authority is part of the information that should be provided to individuals under the UK GDPR transparency requirements.
Data Security
We take reasonable and appropriate technical and organisational measures to protect personal data against:
- Unauthorised access;
- Unauthorised disclosure;
- Accidental loss;
- Destruction;
- Alteration; and
- Other unlawful or unauthorised processing.
Security measures may include access controls, authentication mechanisms, encryption, monitoring, security testing, incident management and other appropriate safeguards, depending on the nature and risk of the processing.
However, no method of transmitting or storing information can be guaranteed to be completely secure.
Data Breaches and Security Incidents
We maintain processes for identifying, assessing, managing and responding to personal-data and information-security incidents.
Where a personal data breach is likely to result in a risk to individuals’ rights and freedoms, we will take appropriate action in accordance with applicable data protection requirements, including notifying the ICO and affected individuals where legally required.
Children’s Privacy
Our services are not intended to knowingly collect personal data from children where such collection is not appropriate or permitted.
Where we become aware that personal data has been collected from a child in circumstances where appropriate consent or another lawful basis is required but was not obtained, we will take reasonable steps to address the situation.
Where services are directed at or likely to be used by children, we will provide privacy information in a manner appropriate to the intended audience and comply with applicable requirements relating to children’s personal data.
Third-Party Websites and Services
Our website or application may contain links to websites, applications or services operated by third parties.
If you follow a third-party link or use a third-party service, that organisation may process your personal data under its own privacy policy.
We are not responsible for the privacy practices, security or content of third-party websites or services.
We recommend reviewing the relevant third party’s privacy information before providing personal data to them.
Changes to This Privacy Policy
We may update this Privacy Policy from time to time to reflect:
- Changes to our services;
- Changes to how we process personal data;
- Changes to technology;
- Changes to legal or regulatory requirements; or
- Improvements to our privacy practices.
When we make changes, we will update the “Last Updated” date at the beginning of this Privacy Policy.
Where changes are significant and applicable law requires us to do so, we will take reasonable steps to bring the changes to your attention before they take effect.
We will regularly review our privacy information to ensure that it remains accurate, relevant and transparent. This reflects the ICO’s guidance that privacy information should be reviewed and updated when processing changes.
Contact Us
If you have any questions about this Privacy Policy, our processing of personal data, or your privacy rights, please contact us at support@foodwhisperer.co.uk or dpo@foodwhisperer.co.uk
Food Whisperer UK Limited
6th Floor
2 London Wall Place
London EC2Y 5AU
United Kingdom