Last updated: 12 October 2025
Applies to: the Crunch Beckenham website and all sub‑pages (the “Website”).

Quick N Healthy LTD (trading as Crunch Beckenham) ("we", "us", "our") is the data controller for personal data processed via the Website and for related marketing and customer relationship activities described in this Privacy Policy.

• Registered address: Available on request.
• Company number: Available on request.
• ICO registration number: Available on request.
• Contact: Please use the privacy contact details shown in the footer of the Website or write to us marked “FAO: Privacy” using the contact details on our Contact page.

If we appoint a Data Protection Officer (DPO) or privacy lead, you may contact them using the same details.

This Privacy Policy explains how we collect, use, disclose and protect personal data when you visit or interact with the Website, make a booking or purchase with us, sign up for marketing, contact us, or engage with us on social media. It does not cover the privacy practices of third parties we link to.

We process personal data in accordance with the UK General Data Protection Regulation (UK GDPR), the Data Protection Act 2018, and (for cookies and similar technologies) the Privacy and Electronic Communications Regulations 2003 (PECR).

• Contact data: name, email address, telephone number.
• Booking/order data: date/time preferences, party size, table/collection/delivery preferences, dietary notes/allergies (only where you choose to disclose them), order details.
• Account data (if you create an account): username, password (stored in hashed form), preferences.
• Marketing preferences: your opt‑in/opt‑out choices.
• Correspondence: messages you send us by email, forms, or chat; feedback and reviews.
• Competition and survey entries: information you provide when you participate.

Special category data (allergies/dietary needs). Only provide such information if you want us to consider it in your booking or order. We rely on your explicit consent when you submit this information; do not include any health information you are not comfortable sharing.

• Technical data: IP address, device identifiers, browser type/version, operating system, time zone, language settings.
• Usage data: pages visited, referring/exit pages, clicks, scrolls, time on site, error logs.
• Cookie data & similar technologies: as described in §7 (Cookies).

Depending on how you interact with us, we may receive personal data from:

• Booking platforms (e.g., restaurant reservation providers): booking references, contact details, preferences.
• Payment providers: payment status, method, partial card details (last 4 digits), and fraud signals. We do not receive or store full card numbers.
• Delivery/ordering partners: order details, delivery status, contact details.
• Analytics and advertising partners: aggregated or pseudonymised audience/engagement insights.
• Social media platforms: your public profile information when you interact with our content or message us.

We process personal data under the following lawful bases:

• Contract: to provide products/services you request (e.g., bookings, orders, customer support).
• Consent: for email/SMS marketing, optional cookies, and any special category data you choose to share (e.g., allergies). You can withdraw consent at any time.
• Legitimate interests: running and improving our Website, preventing fraud, keeping records, responding to enquiries, and promoting our business. We balance these interests against your rights and will provide details upon request.
• Legal obligation: to comply with laws (e.g., tax, accounting, regulatory requirements).

• To operate, secure and maintain the Website (Contract; Legitimate interests).
• To process bookings, orders, payments, and refunds (Contract; Legal obligation).
• To manage your account and preferences (Contract).
• To communicate with you about bookings, orders, service updates or policy changes (Contract; Legal obligation).
• To provide customer support and respond to enquiries (Contract; Legitimate interests).
• To send marketing communications where permitted (Consent; Legitimate interests for soft‑opt‑in, see §8.2).
• To personalise content, measure performance, and improve our services (Legitimate interests; Consent for analytics cookies where required).
• To detect, prevent and investigate fraud, abuse and security incidents (Legitimate interests; Legal obligation).

We do not sell your personal data.

We do not conduct automated decision‑making or profiling that produces legal or similarly significant effects on you. If this changes, we will inform you and explain the logic involved and consequences.

Cookies are small text files placed on your device to make websites work, improve performance, and provide analytics and advertising features. We may also use local storage, pixels and SDKs.

• Strictly necessary (always on): to deliver the Website, load pages, process transactions, manage consent.
• Functional: to remember preferences (e.g., location, accessibility settings).
• Performance/Analytics: to understand usage and improve the Website. These run only with your consent where required.
• Advertising/Targeting: to measure campaigns and show relevant ads. These run only with your consent.

On your first visit we present a cookie banner and/or preference centre. You can change your choices at any time via the banner link in the Website footer or by adjusting your browser settings. Blocking some cookies may impact site functionality.

For the most current list of cookies in use and their retention periods, please consult our Cookie Preference Centre accessible from the Website footer.

With your consent, we may send you news, offers and updates. You can unsubscribe at any time via the link in our emails or by contacting us.

Where we obtained your email during a sale or negotiation of a sale, we may send you marketing about similar products/services under PECR’s “soft opt‑in”. You can opt out at any time.

We may use hashed contact lists and platform tools to show or exclude ads to existing customers. This is based on consent or legitimate interests, as applicable, and you can object at any time.

We share personal data only with:

• Service providers / processors under contract, including Website hosting, IT support, analytics, payment processing, booking/order platforms, marketing platforms, communications tools, and security providers.
• Professional advisers (lawyers, accountants, insurers) and authorities where required by law or to protect our legal rights.
• Business transfers: if we undergo a sale, merger or reorganisation, personal data may be transferred to the new owner subject to this Policy.

We require processors to protect your data and to process it only on our documented instructions.

Where personal data is transferred outside the UK (for example to cloud services or processors located abroad), we ensure appropriate safeguards such as the UK International Data Transfer Agreement (IDTA), the UK Addendum to the EU Standard Contractual Clauses, or another lawful mechanism. Copies of relevant safeguards can be requested using the contact details above.

We keep personal data only for as long as necessary for the purposes described or as required by law. Typical retention periods are:

• Bookings/orders & related records: up to 6 years (for tax/accounting).
• Customer support enquiries: up to 24 months from last contact.
• Marketing contact data: until you unsubscribe plus up to 24 months to maintain suppression lists.
• Website logs and analytics: typically up to 26 months (or as configured by the provider).

We will anonymise or securely delete data when no longer needed.

We implement appropriate technical and organisational measures, including encryption in transit (HTTPS), access controls, least‑privilege permissions, regular updates/patching, and staff privacy training. However, no system is 100% secure; you are responsible for keeping your account credentials confidential and using unique, strong passwords.

Under UK GDPR you have the right to:

• Access your personal data and receive a copy.
• Rectify inaccurate or incomplete data.
• Erase your data (“right to be forgotten”) in certain circumstances.
• Restrict processing in certain circumstances.
• Object to processing based on legitimate interests or for direct marketing.
• Data portability for data you provided to us with consent or contract.
• Withdraw consent at any time where processing relies on consent.

To exercise your rights, contact us using the details in §1. We may need to verify your identity. We aim to respond within one month, extendable in complex cases as permitted by law.

If you are concerned about our use of your data, please contact us first so we can try to resolve it. You also have the right to lodge a complaint with the UK Information Commissioner’s Office (ICO):
Website: ico.org.uk
Telephone: 0303 123 1113
Address: Wycliffe House, Water Lane, Wilmslow, Cheshire, SK9 5AF

Our Website is not intended for children under 13, and we do not knowingly collect personal data from them. If you believe a child has provided us with personal data, please contact us and we will take appropriate steps.

The Website may include links to, or integrations with, third‑party websites and services (e.g., booking platforms, maps, payment gateways, social media widgets). We are not responsible for their privacy practices. Please review their policies before providing personal data.

We may update this Privacy Policy from time to time. We will post the updated version on this page and revise the “Last updated” date. Significant changes may also be communicated by email or on the Website.

For any privacy questions, requests or complaints, please contact our privacy team using the details provided in the Website footer or via our Contact page (mark your message “FAO: Privacy”). If contacting by post, address your letter to Privacy, Quick N Healthy LTD (trading as Crunch Beckenham).