Privacy Policy

 

Privacy & Cookie Policy

(Last updated 27/08/2025)

1. Introduction

This Privacy & Cookie Policy (“Policy”) explains how Kathmandu Restaurant and Grub Direct (collectively “we,” “us,” or “our”) collect, use, share, and protect your personal data when you use our Service. By accessing or using the Service, you agree to this Policy. If you do not agree, please discontinue use.

1.1 Joint Controllers of Data

Kathmandu Restaurant and Grub Direct act as joint controllers of the personal data collected through the Service.
We jointly determine the purposes and means of processing your personal data.

1.2 Data We Collect

Information You Provide

  • Account Data: Name, email, phone number, delivery address, payment details, etc., which you provide during account creation or while placing an order.

  • Order Information: Items ordered, special instructions, and related transaction details.

  • Marketing Preferences: Whether you have opted in or out of receiving marketing communications.

Information Collected Automatically

  • Technical Data: IP address, device type, device id, browser type, operating system, and usage data such as pages viewed and links clicked.

  • Cookies & Tracking: We use cookies, web beacons, and similar technologies to remember your preferences, enhance user experience, and analyze site traffic.

Information from Third Parties

  • Payment Processors: Transaction confirmations (not full card details).

  • Delivery Services: Minimal information required for delivery (e.g., name, address).

1.3 How We Use Your Information

  • Order Fulfillment: Processing orders, preparing food, and managing deliveries or pickups.

  • Account Management: Creating and maintaining your account, verifying identity, and responding to account inquiries.

  • Analytics & Service Improvement: Understanding usage patterns to improve the Service, troubleshoot technical issues, and develop new features.

  • Marketing & Communications: Sending promotional messages (unless you opt out) and relevant updates about our services or changes to these Terms.

  • Legal Obligations & Security: Complying with applicable laws and protecting our interests (e.g., fraud prevention).

1.4 Legal Basis for Processing (UK GDPR / Data Protection Act 2018)

We rely on one or more of the following legal bases:

  • Contractual Necessity: To fulfill orders and provide the Service.

  • Consent: For sending promotional emails or using non-essential cookies.

  • Legitimate Interests: For improving the Service, detecting fraud, and maintaining security.

  • Legal Obligations: To comply with applicable legal or regulatory requirements.

1.5 How We Share Your Data

  • Between Kathmandu Restaurant and Grub Direct: As joint controllers, we share relevant user data to operate the Service.

  • Service Providers:

    • Payment Processors: To process payments securely.

    • Delivery Partners: To facilitate deliveries.

    • Analytics/Marketing Tools: For analytics or advertising (where permitted by law).

  • Legal or Business Transfers: Data may be disclosed to comply with law or as part of a merger, acquisition, or asset sale.

👉 We do not sell your personal data to third parties for independent marketing.

1.6 Data Retention

We retain personal data only as long as necessary for the purposes outlined in this Policy or as otherwise required by law (e.g., tax or regulatory obligations).

1.7 Your Rights

Depending on your location, you may have rights under data protection law, including:

  • Access & Rectification – Request a copy of your data or ask for corrections.

  • Erasure – Request deletion of your personal data where legally permissible.

  • Objection & Restriction – Object to or restrict certain processing.

  • Portability – Receive your data in a machine-readable format.

  • Withdraw Consent – Opt out of marketing or withdraw consent at any time.

To exercise these rights, contact either Kathmandu Restaurant or Grub Direct using the details in Section 2.3.

1.8 Cookies & Similar Technologies

What Are Cookies?
Small text files stored on your device to save preferences and track how you use our Service.

Types of Cookies We Use

  • Essential Cookies: Required for basic site functionality.

  • Performance Cookies: Help us understand usage patterns.

  • Functional Cookies: Remember user preferences.

  • Targeting/Advertising Cookies: Deliver relevant ads (if used).

Managing Cookies
Most browsers let you refuse or accept cookies. Blocking certain cookies may affect site functionality.

1.9 Data Security

We use reasonable technical and organizational measures to protect your personal data. However, no internet-based service can be 100% secure.

2. International Data Transfers

If you are located outside the UK, your personal data may be transferred and processed in the UK or other jurisdictions with different laws. We ensure adequate protection in line with legal requirements.

2.1 Children’s Privacy

Our Service is not intended for children under 18 without parental/guardian consent. If you believe we have inadvertently collected data from a minor, please contact us so we can delete it.

2.2 Updates to This Policy

We may revise this Policy from time to time. The updated version will be posted on our website with a new “Last Updated” date.

2.3 Contact Us (Privacy & Data Questions)

Kathmandu Restaurant
📍 Solihull ice rink Unit 2, Hobs Moat Road, Solihull, B92 8JN
📞 0121 794 8208
✉️ hello@kathmandu-restaurant.co.uk

Grub Direct
📍 5 South Charlotte Street, Edinburgh, Scotland, EH2 4AN
✉️ info@grubdirect.co.uk