Privacy Policy
Introduction
At Food and Board (“we”, “us”, “our”), we respect your privacy. This Privacy Policy explains what personal data we collect on foodandboard.co.uk, how we use it, and the choices you have.
We comply with UK data protection law, including the UK GDPR, the Data Protection Act 2018 and other relevant UK privacy rules. You can learn more about your rights on the Information Commissioner’s Office (ICO) website.
Who We Are (Data Controller)
Food and Board is the data controller for personal data processed via this Website.
- Website: foodandboard.co.uk
- Contact Page: foodandboard.co.uk/contact/
Personal Data We Collect
- Contact Data: Details you submit, such as your name, email address, phone number and message, when you use forms or contact us.
- Messaging Data (If You Contact Us via WhatsApp): If you choose to message us on WhatsApp, we will receive your phone number and the contents of your message, plus any profile details you choose to share. WhatsApp processes this data under its own privacy policy.
- Usage Data: IP address, device, browser type, pages viewed, time on page, clicks and other diagnostic data, collected via analytics if you consent.
- Security & Anti-Spam Data: Cloudflare Turnstile collects limited technical data, such as IP address and browser characteristics, to verify legitimate traffic and block bots.
- Transactional/Service Data (If Applicable): Records of enquiries, quotes, bookings, invoices and support requests.
- Cookies and Similar Technologies: See our Cookie Policy for specific cookies and controls.
How We Use Personal Data & Lawful Bases
We only use your data when we have a lawful basis. The table below shows typical uses across our default site setup.
| Purpose | Examples | Lawful Basis | Retention |
|---|---|---|---|
| Respond To Enquiries | Reply to contact forms, emails and calls | Legitimate Interests (to respond); Pre-contractual Steps | Up to 24 months after last contact, unless you become a customer |
| Respond To WhatsApp Messages (If Used) | Reply to WhatsApp chats started by you | Legitimate Interests (to respond); Pre-contractual Steps | Up to 24 months after last contact, unless you become a customer |
| Provide Services (If Applicable) | Project delivery, account management, billing and support | Contract; Legal Obligation (tax records) | Contracts: usually 6 years; Tax records: 6 years minimum |
| Analytics (Consent) | Google Analytics 4 via Consent Mode | Consent, which you can withdraw at any time | As per Cookie Policy, usually up to 2 years for _ga cookies |
| Advertising & Conversions (Consent, If Installed) | Google Ads conversions; Meta Pixel; LinkedIn Ads; Reddit Ads; TikTok Ads | Consent | As per Cookie Policy and platform settings |
| Security & Anti-Spam | Cloudflare Turnstile bot protection and server logs | Legitimate Interests (to keep the Website secure) | Up to 12 months, unless needed to investigate an issue |
| Handle Data Protection Requests Or Complaints | Responding to privacy rights requests, data concerns or complaints | Legal Obligation; Legitimate Interests | For as long as reasonably needed to handle the request or complaint and keep appropriate records |
Where We Get Data From
- Directly From You: When you submit a form, email us, call us or message us.
- Automated: Cookies, analytics, log files and security tools.
- Third Parties (If Applicable): Payment providers, advertising platforms, partners or other organisations you have interacted with.
Who We Share Data With
We share data only when necessary.
- Website & Hosting: Our hosting provider(s) and SiteGround CDN for secure, fast delivery of content.
- Security & Bot Protection: Cloudflare Turnstile to verify legitimate traffic and prevent spam submissions.
- Forms & Email Delivery (If Used): WPForms for form handling and Postmark for transactional email.
- Analytics (If You Consent): Google Analytics 4 via Consent Mode.
- Ads/Attribution (If You Consent): Google Ads conversions, Meta Pixel, LinkedIn Ads, Reddit Ads and TikTok Ads.
- Messaging (If You Choose It): WhatsApp, a Meta company, when you start a chat with us via the WhatsApp button.
- Professional Services: Our accountants, legal advisers or auditors where required.
- Legal/Compliance: Law enforcement, regulators or other authorities where the law requires.
We do not sell your personal data.
International Transfers
Some providers, including CDN services such as SiteGround and Cloudflare, may process data outside the UK/EEA. Where this happens, we rely on recognised safeguards such as international data transfer agreements or standard contractual clauses, together with risk assessments and technical measures where appropriate.
If you contact us via WhatsApp, Meta/WhatsApp may process data outside the UK/EEA in line with its own policies and safeguards.
How We Keep Data Secure
We use administrative, technical and physical safeguards to protect personal data. This includes:
- HTTPS encryption on all pages
- CDN protection and caching via SiteGround
- Bot protection using Cloudflare Turnstile
- Access controls and regular security reviews
No method of transmission or storage is 100% secure, but we work to reduce risk.
How Long We Keep Data
We keep data only as long as necessary for the purposes described in this policy, or to meet legal requirements. Typical periods are shown in the table above. For invoices, contracts and tax records, we usually retain data for at least 6 years.
Your Privacy Rights
You have rights over your personal data, including:
- Access, rectification and erasure
- Restriction or objection to processing
- Data portability
- Withdrawal of consent, where consent is the lawful basis
To exercise these rights, please use the Contact Page. We may need to verify your identity before responding.
Data Protection Complaints
If you’re unhappy with how we’ve handled your personal data, you can make a data protection complaint to us.
This might include concerns about how we collect, use, store, share, update or delete your personal information.
Please contact us using the details on this Website and include Data protection complaint in your message.
Please include:
- Your name
- Your contact details
- A clear description of your concern
- Any relevant dates, emails, forms, screenshots or other information
- What you’d like us to do to help resolve it
Please do not send sensitive personal information unless it is needed for your complaint.
We’ll acknowledge your complaint within 30 days. We’ll then look into it and respond without undue delay. If the matter is complex, we’ll let you know and keep you updated.
We may keep a record of your complaint, our investigation, our response and any action we take. We’ll only keep complaint records for as long as we reasonably need them for legal, regulatory and business purposes.
Cookies
For details of cookies and how to manage your preferences, see our Cookie Policy. Analytics and advertising tags only load after you consent via the banner.
Children’s Data
Our Website is not intended for children. We do not knowingly collect children’s personal data. If you believe a child has provided data, please contact us so we can delete it.
Automated Decision-Making
We do not use automated decision-making or profiling that produces legal or similarly significant effects about you.
Contact Us
If you have any questions about this policy, your privacy rights or how we use your data, please visit our Contact Page.
Your Right To Complain To The ICO
If you’re not satisfied with our response to a data protection complaint, you can complain to the UK data protection regulator, the Information Commissioner’s Office (ICO).
Visit ico.org.uk/make-a-complaint or call 0303 123 1113.
Changes To This Policy
We may update this policy to reflect changes in our processing or legal requirements. We will update the “Last Updated” date below and, where appropriate, notify you via the Website.
Last Updated
May 12, 2026
Food and Board (foodandboard.co.uk)