Privacy Policy
MealShift Privacy Policy
Effective date: 9 October 2026
Version: 2.4
Last updated: 9 October 2026
MealShift Ltd (“MealShift”, “we”, “us”, “our”) respects your privacy and is committed to processing personal data lawfully, fairly and transparently under the UK General Data Protection Regulation (UK GDPR), the Data Protection Act 2018, and the Privacy and Electronic Communications Regulations 2003 (PECR).
This policy explains what personal data we collect, why we collect it, how we use it, who we share it with, how long we keep it, and what rights you have over it.
If you have any questions, contact us at [email protected] or by post at MealShift Ltd, 410 Naylor Building West, Assam Street, London E1 7QL, United Kingdom.
1. Who we are
MealShift Ltd is a company registered in England and Wales (company number 12793366) with its registered office at 410 Naylor Building West, Assam Street, London E1 7QL.
We operate a commission-free delivery network for UK independent restaurants. We provide:
- The MealShift web platform and mobile applications used by restaurants and other businesses (“Clients”) and self-employed couriers (“Drivers”)
- Operational dispatch, billing and reporting services to Clients
- A direct sales and marketing function for independent restaurant and food businesses in the UK
We are the data controller for personal data we process about Client contacts, Drivers and Driver applicants, business prospects, visitors to our website and people who contact us.
When a business uses MealShift to deliver its orders, that business is the controller of its customers’ delivery details, and we handle them on its behalf as its processor, under the data processing terms in our Terms and Conditions or in the business’s signed agreement. The same applies to the details of a business’s own drivers when it uses MealShift to run them. If you received a delivery through MealShift, the privacy notice of the business you ordered from applies to your delivery details. You can still contact us, and we will pass your request to that business. We keep a small part of that information as a controller ourselves, to deal with fraud, safety, complaints, claims and our legal duties.
We are registered with the UK Information Commissioner’s Office (ICO).
2. The categories of people we collect data about
| Category | Examples |
|---|---|
| Driver applicants and couriers | Name, contact details, date of birth, driving licence number, vehicle insurance details, vehicle details, right-to-work documents, bank account details for payment, location data while on shift, ratings, in-app activity, communication history |
| Client contacts | Business name, contact name(s), business email, business phone, business address, business activity, in-app activity, communication history, weekly invoicing data |
| End-customers of Clients | Name, delivery address, contact phone number, order details and delivery instructions. We handle these for the business that asked for the delivery (see Section 1), and use them only to carry out and support that delivery. |
| Business prospects | Name and business contact details of named individuals at UK limited-company restaurants, takeaways and food businesses we believe could benefit from our service. Sources: public Companies House records, public business directories, our own website forms, Calendly bookings, inbound WhatsApp, scraped business listings, manual entry by our sales team |
| Website visitors | IP address, browser type, device type, pages visited, referrer, basic analytics |
| Support contacts | Anyone who contacts us via email, WhatsApp, phone or web form |
3. What we collect, why, and the lawful basis we rely on
We process personal data only where we have one of the lawful bases set out in UK GDPR Article 6.
| Purpose | Data | Lawful basis | Retention |
|---|---|---|---|
| Operating the MealShift platform and mobile apps for Drivers and Clients | Account, identity, vehicle, payment, activity, location, and for Clients a record of which version of our Terms and Conditions was accepted and when | Article 6(1)(b): performance of a contract | Active account + 7 years after account closure (tax and HMRC retention requirements) |
| Keeping inactive driver applications on file (drivers who registered but have not driven for us recently) | Account record, contact details, area, last activity timestamps | Article 6(1)(f): legitimate interests (recruitment and re-activation when we expand into the driver’s area) | Until you ask us to remove it. If you have not engaged with us for 30 months, we stop sending you recruitment emails. See “Keeping your record on file” below. |
| Arranging and tracking deliveries for businesses (end-customer delivery details) | Name, address, phone number, delivery instructions, order reference, delivery times, proof-of-delivery photos | We handle this data as the business’s processor, so the business decides the lawful basis. Usually it is that the delivery is needed to perform the business’s contract with its customer. Where we keep a minimised record for fraud, safety, complaints or claims, we do so as a controller under Article 6(1)(f), legitimate interests, as described in the support and fraud rows below. | While the business’s account is open. When the account closes, we return them to the business or delete them, as the business chooses, within 30 days. If a business account has had no deliveries for 24 months, we may close it after giving the business 30 days’ notice. Proof-of-delivery photos are deleted about 10 days after delivery. Any minimised record we keep as a controller is kept only for the periods in the support, fraud and invoicing rows of this table. |
| Processing weekly invoices and payments to Clients and to self-employed Drivers | Bank details, billing address, transaction history | Article 6(1)(b): performance of a contract, and Article 6(1)(c): legal obligation (UK tax and accounting law) | 7 years from end of relevant tax year |
| Recovering unpaid invoices: passing details of an unpaid debt to debt collection agencies, credit reference agencies and the courts | Business name and address, the names of owners or directors, contact details, amounts owed and payment history. If the business is a sole trader or partnership, this is information about the individuals and can appear on their personal credit file. | Article 6(1)(f): legitimate interests in recovering money owed to us and to Drivers. We tell businesses about this in our Terms and Conditions and agreements before any debt arises. We give at least 28 days’ written notice before we report a default about a sole trader or partnership. | With our billing records, 7 years from the end of the relevant tax year. Credit reference agencies keep records for their own periods, usually 6 years. |
| Driver onboarding, identity verification and right-to-work checks | Driving licence, insurance documents, ID documents, DBS certificate where relevant | Article 6(1)(c): legal obligation under UK employment and right-to-work law | Active relationship + 2 years; right-to-work records 2 years after end of work; DBS certificate copies deleted 6 months after the driver last updated their documents, unless a legal hold applies |
| Customer support and complaint handling (across email, WhatsApp and phone) | Communication history, account details | Article 6(1)(b): performance of a contract, and Article 6(1)(f): legitimate interests (resolving disputes, improving service quality) | 3 years from last interaction |
| Sending service messages to Clients, Drivers and Driver applicants (service updates, shift and work availability, statements of earnings, billing reminders, dispatch alerts, and reminders that something on your account is missing, out of date or needs you to act, including right-to-work documents, insurance and licence expiry) | Email, phone, app push tokens | Article 6(1)(b): performance of a contract, or steps taken at your own request before we enter into one. For reminders about right-to-work documents we also rely on Article 6(1)(c): legal obligation. These are messages about your own account, not direct marketing. | Lifetime of the account |
| Sending marketing emails to Clients (newsletter, product updates, and offers on services close to the one they already have) | Business contact name, business email, communication history | Article 6(1)(f): legitimate interests in marketing our services to the businesses we work with and to businesses like them. Under PECR, the rules on marketing email protect individual subscribers, which means people and sole traders. Most of our Clients are limited companies, so those rules do not restrict business-to-business email to them (PECR Regulation 22). Where a Client is a sole trader we rely on the soft opt-in, which applies because we took their details while selling our service to them. Where someone has separately asked to hear from us, for example by signing up to our newsletter or downloading a guide, we rely on Article 6(1)(a): consent, and they can withdraw it at any time. Every marketing email carries an unsubscribe link. | Until you unsubscribe or object. We then keep a record of the opt-out itself indefinitely so that we never email you again. |
| Sending cold business-to-business marketing communications to prospective UK limited-company Client contacts (cold email, Calendly outreach, follow-up calls) | Business name, business contact name, business email, business phone, business address, communication history | Article 6(1)(f): legitimate interests. We have completed a Legitimate Interests Assessment (LIA) confirming this. We rely on the corporate-subscriber exemption under PECR Regulation 22(2) for direct marketing to corporate subscribers by electronic mail. We do not send unsolicited marketing to sole traders or personal email addresses. | Until you ask us to remove it or object to our marketing. If you have not engaged with us for 30 months, we stop sending you marketing. See “Keeping your record on file” below. |
| Website analytics and improvement | IP address, browser, pages visited, referrer | Article 6(1)(f): legitimate interests in understanding how visitors use our site, with cookie consent where required | Google Analytics deletes detailed visit data after 2 months and user-level data after 14 months. Aggregated reports, which do not identify you, may be kept longer. |
| Fraud prevention, abuse detection, and security | Account activity, IP address, device fingerprint, communication metadata | Article 6(1)(f): legitimate interests in protecting MealShift, Drivers, Clients and end-customers from fraud and abuse | 24 months |
| Compliance with legal requests from law enforcement or regulators | Whatever is requested | Article 6(1)(c): legal obligation | As required by the request |
We do not process special category data (Article 9: health, race, religion, sexual orientation, genetic, biometric) other than where a Driver voluntarily discloses it as part of an accessibility request, in which case Article 9(2)(a), explicit consent, applies.
Keeping your record on file (inactive driver applications and business prospects)
We keep two kinds of record on the basis of legitimate interests after activity stops: driver applications from people who registered with us but have not driven recently, and business contact details for restaurants and food businesses we have approached or hope to approach. We keep them because driver and restaurant markets move slowly, and we may have something relevant for you later, for example when we launch in your area.
We follow these rules:
- If you have not engaged with us for 30 months, for example by driving a shift, replying to us or booking a call, we stop sending you recruitment and marketing emails. We contact you again only if you get in touch with us first.
- If you ask us to remove your record, or click an unsubscribe link in any of our emails, we stop all outreach straight away and delete or anonymise your record within one month. We keep only a note that you opted out, so that we never contact you again.
- Any new engagement, for example a driver doing a shift again or a restaurant booking a call, restarts the 30 months.
You can ask us at any time to remove your record by emailing [email protected].
4. Who we share your data with
We only share personal data with third parties where there is a clear purpose, a lawful basis, and an appropriate written data processing agreement in place.
Categories of service providers
- Cloud hosting and infrastructure (EU and US regions, with UK Addendum SCCs where applicable)
- Payment processing
- Business email, document storage, and internal collaboration
- Customer relationship management, email marketing, and helpdesk
- Business telephony
- SMS, WhatsApp and app notification services
- Maps, address lookup and route calculation
- Error reporting, analytics, and search-console tooling
- Internal AI and automation tooling (no live user data used for model training)
Aggregator and platform partners
Where a merchant receives orders through an aggregator or ordering platform (for example FoodHub, Deliverect, Otter, Flipdish, GloriaFood, Nash), that platform sends us the delivery details we need to fulfil the order. The aggregator is an independent controller for its own customer relationship.
Independent couriers
The self-employed Driver assigned to a delivery is the person actually fulfilling it. The Driver app shows them the end-customer details needed for that delivery (name, address, phone where available, order detail).
Businesses and recipients
While a Driver is on a delivery, the business that asked for it can see the Driver’s name, phone number, type of vehicle and live location. The recipient can see the same through the tracking link. The business, and any ordering platform it has connected, may also receive the proof-of-delivery photo.
Statutory and lawful disclosure
HMRC, law-enforcement, and regulatory authorities where we are legally required to disclose.
Debt recovery
Debt collection agencies, credit reference agencies and the courts, if a business does not pay what it owes (see Section 3).
Businesses that use MealShift can ask for the current list of the specific providers that handle their customers’ delivery details, under the data processing terms in our Terms and Conditions or their signed agreement, by writing to [email protected]. We do not sell personal data to any third party for advertising or any other purpose.
5. International data transfers
Some of our service providers are located outside the United Kingdom. Where data is transferred outside the UK, we use one or more of the following safeguards:
- The UK government’s adequacy regulations (covers the EEA, Andorra, Argentina, Canada, Faroe Islands, Guernsey, Isle of Man, Israel, Japan, Jersey, New Zealand, South Korea, Switzerland, Uruguay, and US organisations certified to the UK-US Data Bridge)
- The UK Addendum to the EU Standard Contractual Clauses (UK SCCs)
- Binding Corporate Rules of the recipient organisation, where applicable
We keep a record of the safeguard that applies to each provider. If you would like a copy of the safeguard that applies to a transfer of your data, email [email protected].
6. How long we keep your data
Retention periods are listed against each processing purpose in Section 3.
In addition:
- Communication records (email, WhatsApp, call recordings) are retained for 3 years from last interaction unless subject to a longer statutory requirement
- Marketing suppression lists (records of people who have opted out) are kept indefinitely so that we never re-email them
For inactive driver applications and business prospects, see “Keeping your record on file” in Section 3.
7. Your rights under UK GDPR
You have the following rights in relation to your personal data:
- Right of access: request a copy of the personal data we hold about you
- Right to rectification: ask us to correct inaccurate or incomplete data
- Right to erasure (“right to be forgotten”): ask us to delete your data, subject to legal retention requirements
- Right to restrict processing: ask us to stop a particular use of your data while a dispute is resolved
- Right to data portability: ask for a machine-readable copy of data you provided to us, or have it transferred to another controller
- Right to object: object to processing based on legitimate interests, including a right to object at any time to direct marketing, which we will always honour
- Right to withdraw consent: where we process data based on your consent, you can withdraw it at any time
- Right not to be subject to automated decision-making that produces legal or similarly significant effects, and to ask for a person to review any such decision. See “Automated checks on right to work” below.
Automated checks on right to work. We make one automated decision. When a driver applicant gives us a right-to-work share code, we check it automatically against the government’s right-to-work checking service on gov.uk, using the share code and the applicant’s date of birth. If the check does not confirm a right to work, the application does not go forward, and no person reviews that outcome first. Nobody is ever approved automatically: a member of our team always makes the final approval decision. We do this because we cannot take someone on without a verified right to work, so the check is necessary to decide whether we can enter into a contract with them (Article 22(2)(a)). We do not profile or score applicants in any other way. If a check goes against you we email you to say so. You can ask a person to review it: reply to that email or write to [email protected], tell us what you think we got wrong, and a member of our team will look at the decision personally.
To exercise any of these rights, email [email protected] with “Data subject request” in the subject line. We will respond within one month (extendable to three months for complex requests, with notice).
If you are unhappy with how we have handled your request, you have the right to lodge a complaint with the UK Information Commissioner’s Office:
- Web: https://ico.org.uk/make-a-complaint/
- Phone: 0303 123 1113
- Post: Information Commissioner’s Office, Wycliffe House, Water Lane, Wilmslow, Cheshire SK9 5AF
8. Direct marketing and your right to opt out
If you are receiving marketing email from MealShift, every email contains an unsubscribe link. Clicking it stops all future marketing email immediately. We honour opt-outs within 24 hours.
You can also opt out at any time by emailing [email protected] with “Unsubscribe” in the subject line.
For B2B marketing to corporate subscribers under PECR Regulation 22(2), you have the same right to object. We will treat any “stop” or “unsubscribe” reply as a request to suppress.
9. Cookies and tracking technologies
Our website https://mealshift.co.uk uses a small number of cookies and similar technologies:
- Strictly necessary cookies and tools for site functionality and security, including remembering your cookie choices and a Cloudflare security check that protects our forms from spam and bots. These do not need your consent.
- Analytics cookies (Google Analytics 4): only set if you accept them in the cookie banner. Used to understand aggregate visitor behaviour. Google Analytics 4 does not store IP addresses.
Links to book a call with us open Calendly’s own website, which has its own privacy policy. Our Cookie Policy lists the cookies our website uses.
Our mobile apps do not use browser cookies, but they do use mobile equivalents (an app instance ID and a push notification token) for Firebase Crashlytics (crash reports) and Firebase Cloud Messaging (notifications). Our Android apps also use Firebase Analytics to collect basic usage statistics, such as when the app is opened. Our apps do not collect your device’s advertising ID. You can reset these identifiers in your device settings.
10. Security
We protect personal data using technical and organisational measures appropriate to the risk, including:
- Encryption in transit (HTTPS / TLS) for all web traffic and API calls
- Role-based access control and least-privilege access to internal systems
- A separate production environment, firewall controls and routine security updates
- Regular backups of the production database
- Written confidentiality duties for staff with access to personal data
- Documented breach notification procedure (notification to the ICO within 72 hours of becoming aware of a notifiable breach)
No system can be 100% secure. If you believe your data has been compromised, contact us immediately at [email protected].
11. Children’s data
MealShift’s services are not directed at children. We do not knowingly collect data about anyone under the age of 13. If you are a parent or guardian and believe we hold data about a child, contact us at [email protected] and we will delete it.
12. Links to other sites
Our website and apps may contain links to third-party websites. This policy does not apply to those sites, so please read their own privacy policies.
13. Changes to this policy
We review this policy at least once a year and update it whenever our processing changes materially. Changes are published on this page with an updated Effective date at the top. Where the change is significant, we will notify affected users by email or in-app notice.
Previous versions are kept in our internal records for audit purposes.
Current version: v2.4, effective 9 October 2026. Material change from v2.3: explained that when we deliver for a business we handle its customers’ delivery details, and the details of its own drivers, as its processor; corrected the lawful basis for those details; changed how long we keep those details (while the business’s account is open, then returned or deleted, instead of anonymised after 12 months) and added that we may close a business account after 24 months with no deliveries; added debt recovery, including credit reference agencies, as a purpose; added SMS and maps providers to the categories of service provider; explained what tracking and proof-of-delivery information businesses and recipients see; updated the list of security measures; replaced the 30-month re-permission cycle and 6-year ceiling for inactive driver applications and business prospects with the rules in “Keeping your record on file”; stated the period for DBS certificate copies as 6 months after the driver last updated their documents; corrected how long Google Analytics keeps data; and updated the cookie and app sections to match what our website and apps use. Material change from v2.2: restated the lawful basis for marketing email, and clarified that reminders about your account, including right-to-work documents, are service messages rather than marketing. Material change from v2.1: disclosed the automated right-to-work share-code check as an automated decision under Article 22, and the route to ask a person to review it. Material change from v2.0: introduced the 30-month re-permission cycle and 6-year outer ceiling for inactive driver applications and dormant Client prospects; introduced an explicit 6-month hard cap on DBS certificate copies.
14. Contact us
For all data protection queries, including subject access requests, complaints, or to update your preferences:
MealShift Ltd
410 Naylor Building West
Assam Street
London E1 7QL
United Kingdom
Email: [email protected]
We aim to respond to data protection enquiries within 5 working days and complete formal requests within one month.
This policy was last updated on 9 October 2026.