This policy explains how Lookumades Franchising Ltd handles personal information about customers, website visitors, applicants, franchise partners, suppliers and business contacts.
1. Who we are
Lookumades Franchising Ltd operates our Canterbury store and is the controller of the personal data described in this policy.
- Company number
- 15663451 (England and Wales)
- Registered office
- 29a St Margarets Street, Canterbury, Kent, CT1 2TG
- ICO registration
- ZC228405
- Privacy enquiries
- privacy@lookumades.uk
- Complaints
- complaints@lookumades.uk
- Franchise enquiries
- franchising@lookumades.uk
2. What this policy covers
This policy covers our websites, applications, forms and digital tools; the Canterbury store and other directly operated locations; franchise recruitment and network management; and our marketing, recruitment and supplier relationships.
Independent franchisees are separate businesses and are responsible for their own store customers’ data. Their own privacy notices explain their practices. Where a central system is used, responsibility depends on who determines how and why the information is processed. Contact us if you need help identifying the right business for a privacy request.
This notice is not a contract, and using our services does not itself constitute consent. Where we rely on consent for a particular activity, we ask separately and you can withdraw it.
3. Information we handle
- Contact and identity details: names, email addresses, telephone numbers, postal addresses and, where relevant, dates of birth.
- Orders and payments: items ordered, order value, store, collection or delivery details, transaction references, card type, last four digits and payment outcome. Payment providers process card details; we do not store full card numbers.
- Loyalty and accounts: account details, preferences, rewards and redemptions.
- Communications: enquiries, complaints, reviews, survey responses, competition entries and photographs you send us.
- Job applications: CVs, employment history, education, references and right-to-work information.
- Franchise applications: business background, operating experience, available funds, proof of funds, company details and references.
- Technical information: IP address, browser and device information handled when services deliver pages or protect access. Our wider digital services may also handle usage and approximate location information. Section 8 explains this website specifically.
- CCTV: video images in and immediately outside our directly operated premises.
Information may also come from franchisees, delivery platforms, payment providers, banks, referees, previous employers, recruitment platforms, credit-reference and business-information agencies, and public sources such as Companies House for franchise due diligence.
Our website enquiry forms prepare an email for you to review and send through your email application. Form details are not submitted to Lookumades until you send that email.
4. Why we use information
| Purpose | Lawful basis |
|---|---|
| Preparing orders, taking payments, issuing refunds and operating accounts or loyalty schemes | Performance of a contract; legal obligations for relevant financial records |
| Answering enquiries and resolving complaints | Legitimate interests in running a responsive business |
| Handling an allergy request for a particular order | Explicit consent where personal health information is processed; see section 5 |
| Preventing fraud and protecting people, premises and systems, including CCTV | Applicable legitimate interests in safety and security |
| Assessing job and franchise applications | Steps before entering a contract and legitimate interests in assessing suitability |
| Franchise management, royalty reporting and audits | Contractual obligations and legitimate interests in managing the network |
| Accounting, tax, food safety, employment and health and safety obligations | Legal obligation |
| Email and SMS marketing | Consent, or legitimate interests where the permitted existing-customer “soft opt-in” applies under electronic-marketing rules |
| Advertising and remarketing, where used in our wider services | Consent |
| Aggregate analytics in our wider digital services | Legitimate interests in improving services, subject to applicable cookie rules; this website has no analytics scripts |
| Legal claims and corporate transactions | Legitimate interests and, where applicable, legal obligation |
Where we rely on legitimate interests, you can contact us for more information and exercise your right to object. We do not claim that using our services gives blanket consent to these activities.
5. Allergy information and application declarations
We do not retain personal allergy details. Please speak to the team before ordering so we can discuss ingredients and cross-contact risks for your order. Where you provide personal health information for that conversation, it is used to address your request and is not saved to a loyalty account or marketing profile.
Our published allergen guide describes products and ingredients and contains no customer personal data.
We do not request criminal-conviction declarations through this website’s application forms. Please do not send criminal-record documents with a website enquiry. If a separate recruitment process requires such information, its purpose and applicable privacy information must be explained before it is requested.
6. CCTV
We use CCTV for the safety of customers and staff, crime prevention and the investigation of incidents and disputes. Our lawful basis is legitimate interests in protecting people and premises.
- Clear signs identify the operator and a contact point.
- Footage is automatically overwritten after 30 days unless retained for a specific incident, insurance claim, disciplinary matter or police request.
- We do not record audio or use covert cameras. Cameras are not placed in toilets, changing areas or staff rest areas.
You may request footage of yourself by providing the date, approximate time and location. Other identifiable people will need to be protected when footage is released. Independently operated franchise locations have their own CCTV notices.
7. Marketing
We send email or text marketing where you have opted in, or where the existing-customer soft opt-in permits messages about similar products and you were offered an opt-out when your details were collected.
You can unsubscribe using the link in a marketing message or contact privacy@lookumades.uk. Unsubscribing is free. It does not stop necessary service messages such as order confirmations or safety notices. We do not sell your information for third-party marketing or knowingly send marketing to under-18s.
8. This website, cookies and external services
The website’s own code does not set cookies. If you save franchise locations, their names are stored in this browser’s local storage until you clear your shortlist or browser data. Your starting location and budget are not saved in browser storage. It does not include analytics scripts, advertising pixels, remarketing tags or embedded social-media tracking. There is therefore no cookie-settings panel for optional tracking on this website.
The hosting and access-control services may process technical information and use cookies needed to deliver, secure or authenticate access to the site. This statement about the website’s code does not mean the hosting platform or services you visit separately use no cookies.
Fonts load from Google Fonts, so your browser makes requests to Google when displaying them. Ordering links open Toast or Deliveroo; the Find Us street map loads map tiles from OpenStreetMap, which receives technical information such as your IP address and browser details when those tiles load. When you submit a UK postcode or an unlisted UK place in the franchise finder, the query is sent to Postcodes.io, which also receives technical connection information such as your IP address. Listed-town searches are processed within the page. Budget preferences are included in the enquiry-page link only when you choose to enquire. Directions and social links open external services. Those services have their own privacy and cookie notices. Social icons on this site are links, not embedded feeds.
If we introduce optional tracking, we will update this notice and provide the choices required before it operates. Browser settings can also control cookies, although blocking essential cookies may affect access to some services.
9. Who we share information with
We share information needed for the services and purposes described in this policy. Providers used across our business include:
- Toast: point of sale, ordering and transaction records.
- Xero: accounting and payroll.
- Sling: staff scheduling.
- Google: Workspace, forms, storage and analytics in relevant wider services; Google Fonts on this website.
- Supabase: application databases and synchronisation.
- Netlify and Cloudflare: application hosting, delivery and access control across our services.
- OpenAI Sites: hosting and access to this website.
- DocuSign: electronic signatures.
- Payment processors, delivery platforms and professional legal, accounting, HR and insurance advisers.
Providers’ roles depend on the service: some act on our instructions, while others determine purposes of their own, as explained in their privacy notices.
We may also share relevant information with franchisees, credit-reference agencies, regulators, tax authorities, law enforcement, insurers, legal advisers or parties to a business sale or investment where necessary and lawful. We do not sell your personal data.
10. How long we keep information
| Information | Retention period |
|---|---|
| Order and transaction records | 6 years from the end of the financial year of the transaction |
| Loyalty accounts | While active, plus 24 months from the last transaction |
| Marketing contact details | Until consent is withdrawn or you object; reviewed after 24 months without engagement |
| Personal allergy details | Not retained |
| Customer service correspondence | 24 months from resolution |
| CCTV | 30 days, unless retained for a specific incident |
| Unsuccessful job applications | 6 months from the decision |
| Employee records | 6 years after employment ends; payroll and pension records longer where legally required |
| Unsuccessful franchise applications | 12 months from the decision |
| Franchise agreements and associated records | Agreement term plus 7 years |
| Financial and accounting records | 6 years plus the current year |
| Analytics records in wider digital services | 26 months; this website has no analytics scripts |
| Records relating to a live or anticipated legal claim | Until the claim is resolved and applicable limitation periods expire |
Where a shorter period is possible, we apply it. Information that no longer needs to identify anyone may be anonymised for aggregate use.
11. International transfers
Some providers store or access information outside the UK, principally in the European Economic Area and the United States. Transfers require an applicable UK adequacy decision or other appropriate safeguards, such as the UK International Data Transfer Agreement or UK Addendum to EU standard contractual clauses. The UK extension to the EU–US Data Privacy Framework may apply where the recipient is certified.
We do not currently transfer personal data to the United Arab Emirates or other Gulf states. Contact us for information about the safeguards relevant to a particular service or transfer.
12. Protecting information
We are responsible for protecting the personal data we handle. If you have a concern about its security, contact privacy@lookumades.uk.
No system is completely secure. If a personal data breach occurs, we will assess it and make notifications to the ICO and affected people where required by applicable data-protection law.
13. Your rights
Depending on the circumstances, you can request access, correction, deletion, restriction of processing or a portable copy of information you have provided. You may object to processing based on legitimate interests, and you have an absolute right to object to direct marketing. Where we rely on consent, you can withdraw it without affecting earlier lawful processing.
We do not make solely automated decisions with legal or similarly significant effects about you. Job and franchise applications are assessed by people.
Email privacy@lookumades.uk or write to our registered office. We may need information to verify your identity or written authority if someone acts for you. We normally respond within one month; permitted extensions or requests for clarification will be explained to you. Requests are normally free of charge.
14. Complaints
To raise a data-protection complaint, email complaints@lookumades.uk or write to our registered office. Please explain your concern and how we can contact you. Privacy enquiries and rights requests can also be sent to privacy@lookumades.uk.
We will acknowledge a data-protection complaint within 30 days, investigate it and communicate the outcome without undue delay.
You can also complain to the Information Commissioner’s Office. Its helpline is 0303 123 1113, and its postal address is Wycliffe House, Water Lane, Wilmslow, Cheshire, SK9 5AF. You also have the right to seek a judicial remedy.
15. Children
Our online services are not directed at children under 13. We do not knowingly collect their personal information without parental consent or offer accounts, loyalty membership or marketing to anyone we know is under 13. Where parental consent is required for an online service, it must come from the person with parental responsibility. Contact our privacy inbox if you believe we hold a child’s information without the necessary consent.
16. Third-party websites
Ordering platforms, payment providers, maps and social-media websites have their own privacy practices. Read their notices before supplying information. This policy describes Lookumades’ processing, not every activity of those services.
17. Changes to this policy
We review this policy at least annually and when our processing or the law changes materially. The version and date at the top identify the current issue. Where a change materially affects you, we will notify you directly where appropriate.
18. Contact us
Privacy: privacy@lookumades.uk
Complaints: complaints@lookumades.uk
Franchise enquiries: franchising@lookumades.uk
Data Protection, Lookumades Franchising Ltd
29A & 29B St Margaret’s Street, Canterbury, Kent, CT1 2TG