Privacy Policy

Last updated: [date]. Published at platick.com/privacy and linked from every page footer, the sign-up form and every email.

1. Who we are

Platick is a trading name of Bateren Creative Ltd, a company registered in England and Wales (company number 08740448), registered office 80A Ruskin Ave, London DA16 3QQ. We are the controller of the personal data described in this policy. ICO registration number: ZC138188. Contact: privacy@platick.com.

Businesses decide what goes on their menus. Where a business puts personal data into Platick (for example, a staff member's name in a dish note), the business is responsible for that, and we process it on the business's behalf under section 13A of our Terms of Service.

2. The people we hold data about

Business users (owners, managers and editors with a Platick login)

• What: name, work email, password (stored only as a secure hash), role, business and venue names and addresses, logo and brand colour, the changes you make (dish history shows who confirmed what and when), sign-in times, help messages you send us. If you sign up through a link that names where it came from, such as an advert, we keep that name with your account so we know which adverts work.
• Billing: Stripe handles your card. We see only the card brand, last four digits, expiry and billing history.
• Why: to provide the service you signed up for (contract); to keep an audit trail of allergen confirmations, which protects you and your guests (legitimate interests); to keep accounting records (legal obligation).

Guests (people viewing a venue's allergen menu)

• No account, no name, no email.
• The allergens you tick stay in your browser. They are held in the part of the web address after the # sign, which browsers never send to servers, so they don't reach us or our hosting logs. If you choose "remember my allergens", they are saved in your browser's local storage on your device only. Clear it at any time from the page or your browser settings.
• Your language choice is remembered in your browser's local storage on your device only. It can also be set in the web address (for example ?lang=fr). It doesn't identify you and isn't sent to us as personal data.
• We count page views per venue per day, without cookies and without recording which allergens anyone chose. Venues see these totals only.
• Our hosting provider keeps short-lived technical logs (IP address, browser type, time, page address without the # part) for security and fault-finding.
• Why: legitimate interests in running a secure, reliable service. We do not collect allergy information about guests, so we do not process guest health data.

Guests who report a problem (using "Report this allergen menu" or by email)

• What: your email address, your message and which allergen menu it's about. The form asks you not to include health details about yourself or anyone else.
• Why: to look into the report and pass it on to the venue within one working day (legitimate interests in keeping allergen menus accurate). We may pause an allergen menu while we look into a report.
• Kept for 2 years, then deleted.

Business contacts we approach (people at food businesses we email about Platick)

• What: business name, business address, the person's name and role where public, business email address, the evidence that the business is a company (see below), and whether you replied or unsubscribed. We don't track whether you open our emails.
• Where from: public sources: the Food Standards Agency food hygiene rating register, the business's own website, Google business listings and Companies House.
• Why: legitimate interests in telling food businesses about a service relevant to their legal duties. We only send unsolicited emails to corporate subscribers (limited companies, LLPs, Scottish partnerships and government bodies), and only where we have positive evidence of this: a company number on the venue's website, or a matching name and address at Companies House. We record that evidence for each contact. If we can't tell, we don't email. Emails are sent through Marblism from our own mailboxes. Every email has a one-click unsubscribe, the first email links to this section, and we keep a suppression list so we never contact you again after you opt out.

Website visitors (platick.com)

• We count visits to our website ourselves, without cookies or anything stored on your device. We record only the page, the day and the site that sent you, never your IP address or anything that identifies you.
• If you contact us, we keep your message and email address to reply.

3. Who we share data with

We use trusted providers to run Platick (listed in the table below). They act on our instructions under written contracts. Marblism uses its own sub-processors, listed in its data processing terms. We don't sell personal data, and we don't share it for advertising. We may disclose data if the law requires it, to protect people's safety, or as part of a sale of the business (you'd be told).

4. International transfers

Our main database is hosted in the UK. Some providers are based in, or may access data from, the US or the EU. Where data leaves the UK, we rely on the UK adequacy regulations, the UK–US Data Bridge, or the ICO's International Data Transfer Agreement or Addendum, as appropriate.

5. How long we keep data

See the retention schedule below. In short: business data lasts while your subscription is active plus 90 days after it ends for you to export; sign-ups that never add a card are deleted after 30 days; financial records 6 years; allergen confirmation history 3 years after the business is deleted (to show what was declared at the time if a question arises); support messages and guest reports 2 years; database backups 7 days; outreach data until you opt out (then only your email on our suppression list) or 24 months without engagement.

6. Your rights

You can ask us to: give you a copy of your data; correct it; delete it; restrict or object to how we use it (including stopping marketing at any time, which we always honour); and give it to you in a portable format. Email privacy@platick.com. We'll reply within one month. There's no charge.

Some records we may need to keep even after a deletion request, such as invoices and the allergen confirmation history, because they protect venues and guests if a question arises. We'll explain if this applies.

7. Children

Platick is for businesses and their adult staff. Allergen menus don't collect personal data, so children can view them without us collecting anything about them.

8. Security

Data is encrypted in transit and at rest. Access inside each business is controlled by roles. Database rules stop one business seeing another's data. Our own access is limited, and every action our admins take is recorded in an admin audit log. Database backups are kept for 7 days. If a breach is likely to put you at risk, we will tell you and the ICO as the law requires.

9. Complaints

Please contact us first. You can also complain to the Information Commissioner's Office: ico.org.uk, 0303 123 1113.

10. Changes

We'll post updates here with a new date. If a change significantly affects business users, we'll email business owners at least 30 days before it takes effect.

Service providers

This table is part of this Privacy Policy (sections 3 and 5). Items marked † are being confirmed with the provider.

Retention schedule