Your privacy.

Who is responsible for your information

Rena Cooked It is a Nottingham food business founded by Serena. The data controller is Olufunmilayo Serena Anthony-Aloto, trading as Rena Cooked It. She is responsible for the personal information described on this page.

Address: 136 Gregory Boulevard, Nottingham NG7 5JE

Contact: [email protected]

What we collect

What we hold depends on how you use the site.

When you order takeaway

• your name, email address and phone number
• what you ordered, your collection or courier choice, cutlery, tip, any discount code and any notes
• allergy or dietary information, if you choose to give it (see below)
• payment status and references: the PayPal order and payment IDs PayPal gives us, or for Bank Transfer the amount, the reference, when you said you'd paid and whether Rena confirmed it
• refunds, and copies of the emails we send you about the order
• the version of our Terms and Refund Policy you agreed to, and when

When you make an enquiry or booking

The answers you give on the booking form: your name, email, phone, optional Instagram handle, how you'd like us to reach you, the service, event date, time, location and guest numbers, food choices, spice level, budget, how you found us, any allergy or dietary needs and anything else you tell us.

When you create an account

• your verified email address, and the name and phone number you keep on it
• when the account was created and when you last signed in
• your order history, loyalty progress and any reward codes issued to you
• your marketing choice, and a record of each time you changed it
• sign-in records: a scrambled (hashed) copy of each one-time code and session, never the code or session itself

When you leave feedback or apply to join the team

Feedback: your name if you give it, what you ordered and when, your ratings and comments. Job applications: your contact details, where you're based, your study details if you're a student, the roles and incentives you're interested in and why you'd like to join.

To keep the site safe

To stop abuse, such as someone requesting lots of sign-in codes, we record requests against a scrambled (keyed hash) version of your IP address or email address, not the address itself. Cloudflare, which runs the website, also processes technical information such as IP addresses to deliver and protect it.

We don't store your card number or your PayPal password, and we never need your online banking login.

Allergy and dietary information

Information about allergies, health conditions and some dietary needs (for example halal or kosher) can be sensitive personal information under UK data protection law. We treat it that way.

• We only ask for it as an optional field, and only use it to understand and safely fulfil the order or booking you gave it for.
• If you write something in that field, we ask for your explicit consent in a separate box that's never ticked for you. The order or enquiry can't be sent with the information unless you tick it, and you can remove the information instead.
• It's saved with that order or enquiry, never as part of your customer account, and it isn't reused for later orders.
• It appears in your order confirmation email and in Rena's copy of the order, so it passes through our email providers (listed below).
• While you're filling in the form, it's kept in your browser tab so a refresh doesn't lose it. See Cookies and browser storage.

You can withdraw your consent at any time by emailing [email protected]. If we've already prepared or served the food, we may need to keep a record of what you told us in case of a legal claim about it.

Why we use your information

We use personal information to:

• give quotes and answer enquiries
• take, process and prepare orders
• manage bookings
• take and check payments, including Bank Transfers
• send order confirmations, payment updates and collection reminders
• run customer accounts and sign-in
• handle changes, complaints and refunds
• run discounts and loyalty rewards
• keep business, tax and accounting records
• protect the website and accounts from abuse
• consider job applications
• share feedback as a review, as the feedback form says
• send marketing, only if you've chosen to get it

Our legal bases

UK data protection law needs a reason, called a legal basis, for each use. Depending on the purpose, ours are:

Contract

To take steps you ask for before an agreement, such as a quote, and to process and fulfil your order or booking.

Legal obligation

To keep the records we need for tax, accounting, food safety and other legal duties.

Legitimate interests

To run and protect the business: preventing fraud and abuse, keeping records, resolving disputes, considering job applications, sharing feedback and improving our service, as long as this doesn't override your rights.

Consent

For marketing emails, if you choose to get them.

Explicit consent, for allergy and dietary information you give us.

Your marketing choice is separate from ordering, booking or creating an account.

Payments

PayPal and card payments are handled by PayPal. For UK customers that's PayPal UK Ltd, which is responsible for the information it collects under its own privacy statement. We receive the payment status and PayPal's transaction references, never your PayPal password or full card details.

For Bank Transfer, we record the amount due, the reference, when you told us you'd paid, and whether Rena confirmed the money arrived. Rena's bank shows her the name on the account you paid from and the reference, as with any transfer.

Who we share it with

We don't sell your personal information. We use a small number of services to run the business. They only use your information to provide their service to us:

Cloudflare

Hosts the website and its database and file storage, protects the site and runs the owner sign-in for our admin. Cloudflare, Inc., USA.

Resend

Sends our automated emails: sign-in codes, order confirmations, payment updates and reminders. Plus Five Five, Inc. (Resend), USA. Emails are stored in the United States.

Namecheap Private Email

Hosts our business mailbox, [email protected], where Rena receives your emails and copies of orders and enquiries. Namecheap, Inc., USA.

PayPal

Processes PayPal and card payments, as its own controller (see Payments above).

Creality Studio

Builds and looks after this website, and can access the admin to support it.

If you contact us through WhatsApp, Instagram, TikTok or Snapchat, those services handle your messages under their own terms.

We may also share information if the law requires it, or to protect our rights or someone's safety.

Information outside the UK

Cloudflare, Resend and Namecheap are based in the United States, so information we hold may be processed there.

• Cloudflare and Resend rely on the UK Extension to the EU-US Data Privacy Framework, with the UK International Data Transfer Addendum to the EU standard contractual clauses in their data processing terms as a fallback.
• Namecheap's data processing terms rely on standard contractual clauses.
• PayPal explains its own safeguards in its privacy statement.

How long we keep it

Sign-in codes

Work for 10 minutes and only once. We keep a record that a code was requested (a scrambled copy, never the code itself) until our yearly review, which deletes any more than 30 days old.

Signed-in sessions

End after 30 days, or straight away when you log out.

Abuse-prevention records

Scrambled, and cleared automatically once they're more than a day old (the clearing happens as new ones are recorded).

Order and booking drafts

In your browser tab only, cleared when you finish, close the tab, or after 12 hours.

Orders, payments and refunds

Six years after the order, for tax, accounting, food safety and legal reasons, then deleted or anonymised. Allergy and dietary notes on an order are removed after three years.

Enquiries

While the enquiry is active, then up to two years if it doesn't become a booking. If it does, it's kept like an order.

Job applications

Up to 12 months after we've made a decision.

Feedback

While it's useful to us or shown on the website. Ask us any time to remove it.

Accounts

While you use your account. If there's been no sign-in or order for three years, we may delete it (your order records are kept as above).

Marketing choices

Kept with your account, and for up to two years after you opt out or your account is deleted, so we can show we respected your choice.

The website doesn't delete these records automatically yet. We review what we hold at least once a year and delete or anonymise anything past these periods.

Marketing

Marketing email is optional and off unless you turn it on. Creating an account, making an enquiry or placing an order never signs you up.

If you opt in, we may email you about new takeaway drops and offers. You can change your choice any time in your account or by emailing us.

Emails about your order, such as sign-in codes, confirmations, payment updates and collection reminders, aren't marketing. We send them whatever your marketing choice.

Security

We protect your information with secure (HTTPS) connections, limited access to the admin behind a separate sign-in, one-time sign-in codes, expiring sessions, and payments that are checked with PayPal on our server, never in your browser.

No website can promise to be completely secure, but we work to keep your information safe and will act quickly if something goes wrong.

Your rights

Depending on the situation, UK data protection law gives you the right to:

• get a copy of your personal information
• correct information that's wrong
• ask us to delete it
• ask us to restrict how we use it
• object to some uses, including any marketing
• get certain information in a portable format
• withdraw consent where we rely on it

To make a request, email [email protected]. We may need to check it's really you. We'll reply within one month, or tell you if the law allows us longer.

Some records, such as order and payment records, may need to be kept for legal reasons even after you ask us to delete your account.

Complaints

If you're unhappy with how we've handled your information, please tell us first at [email protected]. We'll acknowledge your complaint within 30 days and respond as soon as we can.

You also have the right to complain to the Information Commissioner's Office (ICO), the UK data protection regulator: ico.org.uk/make-a-complaint.

Automated decisions

We don't make decisions about you based only on automated processing that have legal or similarly significant effects.

The website does apply simple rules automatically, for example whether a discount code is valid, whether pre-orders are open, or whether you've completed enough orders for a loyalty reward. If you think one of those got something wrong, tell us and Rena will look at it.

Changes to this policy

We'll update this policy when the website, our suppliers or the way we use information changes. The latest version is always here, with the date it was updated.