Privacy Notice.

This Privacy Notice explains what personal data Stacked Foods Ltd collects, why we collect it, how we use it and your rights under the UK GDPR and the Data Protection Act 2018. It applies to stackeduk.com, our kiosks and any forms or services we operate.

1. Who we are

Stacked Foods Ltd ("we", "us", "our") is the data controller for the personal information we collect.

Company: Stacked Foods Ltd · Registered office: 35 Helen Thompson Close, Iwade, Sittingbourne, Kent ME9 8FX · Company No. 09443129.

Contact: kane@stackeduk.com

2. What we collect

Depending on how you interact with us, we may collect:

• Contact info — name, email, phone number, postal address (when you sign up to the Stack Club, submit a catering enquiry or apply for a franchise/job).
• Order data — items ordered, kiosk location, time, payment confirmation (we don't see your full card number — that's handled by our PSPs Stripe/Adyen).
• Marketing preferences — opt-in/opt-out status, the campaigns you've engaged with.
• Technical data — IP address, device type, browser, referring page, behaviour on our site (via cookies — see our Cookie Policy).
• CCTV — at our kiosks, for safety and loss prevention. Footage is retained for 30 days.

3. How we use it

Purpose	What we use	Lawful basis
Fulfilling orders & bookings	Contact, order data	Contract
Replying to enquiries	Contact, message content	Legitimate interests
Stack Club newsletter	Email, preferences	Consent
Improving the website & service	Technical, behavioural	Legitimate interests (with consent for non-essential cookies)
Safety & security at kiosks	CCTV footage	Legitimate interests
Legal & tax record-keeping	Order data, contracts	Legal obligation

4. Who we share it with

We share personal data only when necessary, with:

• Service providers who process data on our behalf (hosting, email delivery, payments, analytics, customer support) — bound by data processing agreements.
• Authorities when required by law, regulation or court order.

We do not sell your personal data. We do not transfer personal data outside the UK/EEA without appropriate safeguards (Standard Contractual Clauses or adequacy decisions).

5. Lawful basis

We rely on one of the six lawful bases under UK GDPR for every processing activity, as set out in the table above. Where we rely on consent, you can withdraw it at any time by emailing kane@stackeduk.com or using the unsubscribe link in any marketing message.

6. How long we keep it

• Order & financial records: 7 years (HMRC requirement)
• Stack Club subscriptions: until you unsubscribe
• Catering & franchise enquiries: 2 years from last contact
• Job applications: 6 months (or longer with your consent)
• CCTV footage: 30 days
• Website analytics: 14 months

7. Your rights

Under UK GDPR you have the right to: access your data; rectify inaccuracies; ask us to erase it; restrict or object to processing; ask for portability; withdraw consent; and not be subject to solely automated decisions. To exercise any of these, email kane@stackeduk.com. We'll respond within one month.

8. Contact & complaints

Data Protection enquiries: kane@stackeduk.com

If we don't resolve a complaint to your satisfaction, you can complain to the Information Commissioner's Office (ICO) at ico.org.uk or 0303 123 1113.

We may update this notice from time to time — the "Last updated" date will reflect any changes. Material changes will be flagged on the homepage for 30 days.