This policy explains how Lookumades Franchising Ltd handles personal information about customers, website visitors, applicants, franchisees, suppliers and business contacts.
1. Who we are
Lookumades Franchising Ltd operates our Canterbury store and is the controller of the personal data described in this policy.
- Company number
- 15663451 (England and Wales)
- Registered office
- 29A St Margaret’s Street, Canterbury, Kent, CT1 2TG
- ICO registration
- ZC228405
- Privacy enquiries
- privacy@lookumades.uk
- Complaints
- complaints@lookumades.uk
- Franchise enquiries
- franchising@lookumades.uk
2. What this policy covers
This policy covers our websites, applications, forms and digital tools; the Canterbury store and other directly operated locations; our guest WiFi service in the Canterbury store; franchise recruitment and network management; and our marketing, recruitment and supplier relationships.
Independent franchisees are separate businesses and are responsible for their own store customers’ data. Their own privacy notices explain their practices. Where a central system is used, responsibility depends on who determines how and why the information is processed. Contact us if you need help identifying the right business for a privacy request.
This notice is not a contract, and using our services does not itself constitute consent. Where we rely on consent for a particular activity, we ask separately and you can withdraw it.
3. Information we handle
- Contact and identity details: names, email addresses, telephone numbers, postal addresses and, where relevant, dates of birth.
- Orders and payments: items ordered, order value, store, collection or delivery details, transaction references, card type, last four digits and payment outcome. Payment providers process card details; we do not store full card numbers.
- Gift cards: gift cards are sold through our Voucher Connect store, where Voucher Connect collects the buyer’s name and email address, the recipient’s name and email address, any message the buyer adds and the payment details, and manages the card’s code, value and balance. When a card is redeemed in store, we handle the code and balance needed to honour it.
- Loyalty and accounts: account details, preferences, rewards and redemptions.
- Communications: enquiries, complaints, reviews, survey responses, competition entries and photographs you send us.
- Job applications: CVs, employment history, education, references and right-to-work information.
- Franchise applications: business background, operating experience, available funds, proof of funds, company details and references.
- Franchise enquiries: your name, email address, mobile number, country, preferred town, funding position, experience, timeframe, how you heard about us and your message. If you used them, we also receive your franchise quiz answers and the location you chose on our franchise map. The form also records the page you came from, the referring website, any campaign tags in the link you followed, the time you sent it and a reference number.
- Technical information: IP address, browser and device information handled when services deliver pages or protect access. Our wider digital services may also handle usage and approximate location information. Section 8 explains this website specifically.
- CCTV: video images in and immediately outside our directly operated premises.
- Guest WiFi: first name, email address, optional phone number, whether you ticked the marketing box and when, and technical connection details such as device type, device identifiers (such as the MAC address), connection times and session length.
Information may also come from franchisees, delivery platforms, payment providers, banks, referees, previous employers, recruitment platforms, credit-reference and business-information agencies, and public sources such as Companies House for franchise due diligence.
The franchise enquiry form sends your details to us directly when you press Send my enquiry. Our other website enquiry forms prepare an email for you to review and send through your email application, and those details are not submitted to Lookumades until you send that email. Gift cards are bought on the Voucher Connect store, not through a form on this website.
4. Why we use information
| Purpose | Lawful basis |
|---|---|
| Preparing orders, taking payments, issuing refunds and operating accounts or loyalty schemes | Performance of a contract; legal obligations for relevant financial records |
| Honouring gift cards in store and helping customers with gift card questions (cards are sold and delivered by Voucher Connect) | Performance of a contract; legitimate interests in helping customers use their gift cards |
| Answering enquiries and resolving complaints | Legitimate interests in running a responsive business |
| Handling an allergy request for a particular order | Explicit consent where personal health information is processed; see section 5 |
| Preventing fraud and protecting people, premises and systems, including CCTV | Applicable legitimate interests in safety and security |
| Providing guest WiFi in our Canterbury store, running and securing the network and keeping a record of connections | Legitimate interests in providing a safe, working network for customers |
| Assessing job and franchise applications | Steps before entering a contract and legitimate interests in assessing suitability |
| Replying to franchise enquiries, including sharing them with our franchise development team at Blitz Franchise | Steps taken at your request before entering a contract, and legitimate interests in growing the franchise network |
| Franchise management, royalty reporting and audits | Contractual obligations and legitimate interests in managing the network |
| Accounting, tax, food safety, employment and health and safety obligations | Legal obligation |
| Email and SMS marketing | Consent, or legitimate interests where the permitted existing-customer “soft opt-in” applies under electronic-marketing rules |
| Advertising and remarketing, where used in our wider services | Consent |
| Aggregate analytics in our wider digital services | Legitimate interests in improving services, subject to applicable cookie rules; this website has no analytics scripts |
| Legal claims and corporate transactions | Legitimate interests and, where applicable, legal obligation |
Where we rely on legitimate interests, you can contact us for more information and exercise your right to object. We do not claim that using our services gives blanket consent to these activities.
5. Allergy information and application declarations
We do not retain personal allergy details. Please speak to the team before ordering so we can discuss ingredients and cross-contact risks for your order. Where you provide personal health information for that conversation, it is used to address your request and is not saved to a loyalty account or marketing profile.
Our published allergen guide describes products and ingredients and contains no customer personal data.
We do not request criminal-conviction declarations through this website’s application forms. Please do not send criminal-record documents with a website enquiry. If a separate recruitment process requires such information, its purpose and applicable privacy information must be explained before it is requested.
6. CCTV
We use CCTV for the safety of customers and staff, crime prevention and the investigation of incidents and disputes. Our lawful basis is legitimate interests in protecting people and premises.
- Clear signs identify the operator and a contact point.
- Footage is automatically overwritten after 30 days unless retained for a specific incident, insurance claim, disciplinary matter or police request.
- We do not record audio or use covert cameras. Cameras are not placed in toilets, changing areas or staff rest areas.
You may request footage of yourself by providing the date, approximate time and location. Other identifiable people will need to be protected when footage is released. Independently operated franchise locations have their own CCTV notices.
7. Marketing
We send email or text marketing where you have opted in, or where the existing-customer soft opt-in permits messages about similar products and you were offered an opt-out when your details were collected.
Guest WiFi: we send marketing to WiFi guests only if they tick the optional marketing box on the sign in page. Connecting to the WiFi does not require it, and you can withdraw consent at any time.
You can unsubscribe using the link in a marketing message or contact privacy@lookumades.uk. Unsubscribing is free. It does not stop necessary service messages such as order confirmations or safety notices. We do not sell your information for third-party marketing or knowingly send marketing to under-18s.
8. This website, cookies and external services
The website’s own code does not set cookies. If you save franchise locations, their names are stored in this browser’s local storage until you clear your shortlist or browser data. On the franchise pages, this browser’s session storage holds the campaign details of the link you arrived from, the last franchise page you viewed, your quiz result, whether you closed the enquiry reminder bar and your enquiry reference, so they can be added to an enquiry you choose to send. Session storage clears when you close the tab. Your starting location is not saved in browser storage. The website does not include analytics scripts, advertising pixels, remarketing tags or embedded social-media tracking. There is therefore no cookie-settings panel for optional tracking on this website.
The hosting and access-control services may process technical information and use cookies needed to deliver, secure or authenticate access to the site. This statement about the website’s code does not mean the hosting platform or services you visit separately use no cookies.
Fonts load from Google Fonts, so your browser makes requests to Google when displaying them. Ordering links open our online ordering service or Deliveroo; the Find Us street map loads map tiles from OpenStreetMap, which receives technical information such as your IP address and browser details when those tiles load. When you submit a UK postcode or an unlisted UK place in the franchise finder, the query is sent to Postcodes.io, which also receives technical connection information such as your IP address. Listed-town searches are processed within the page. The location you choose is included in the enquiry page link only when you choose to enquire. Directions and social links open external services. Those services have their own privacy and cookie notices. Social icons on this site are links, not embedded feeds.
Gift cards are bought on a separate store run by Voucher Connect, which has its own privacy and cookie notice. Your payment details are handled by Voucher Connect and its payment providers, and we do not see or store your full card number.
If we introduce optional tracking, we will update this notice and provide the choices required before it operates. Browser settings can also control cookies, although blocking essential cookies may affect access to some services.
9. Who we share information with
We share information needed for the services and purposes described in this policy. Providers used across our business include:
- Online ordering provider: point of sale, ordering and transaction records.
- Xero: accounting and payroll.
- Sling: staff scheduling.
- Google: Workspace, forms, storage and analytics in relevant wider services; Google Fonts on this website.
- Supabase: application databases and synchronisation.
- Netlify and Cloudflare: application hosting, delivery and access control across our services.
- Voucher Connect: selling and delivering gift cards, taking payment and managing balances.
- Netlify: hosting this website and receiving franchise enquiry form submissions.
- Blitz Franchise: our franchise development team, based in Canada. It receives franchise enquiries so it can reply to them and help assess them.
- Spotipo: guest WiFi sign in portal and guest records.
- Orbital: installs and manages our guest WiFi and has administrator access to the sign in portal.
- Email marketing provider: sends marketing emails to customers and WiFi guests who have opted in.
- DocuSign: electronic signatures.
- Payment processors, delivery platforms and professional legal, accounting, HR and insurance advisers.
Providers’ roles depend on the service: some act on our instructions, while others determine purposes of their own, as explained in their privacy notices.
We may also share relevant information with franchisees, credit-reference agencies, regulators, tax authorities, law enforcement, insurers, legal advisers or parties to a business sale or investment where necessary and lawful. We do not sell your personal data.
10. How long we keep information
| Information | Retention period |
|---|---|
| Order and transaction records | 6 years from the end of the financial year of the transaction |
| Gift card records held by us | 6 years from the end of the financial year of the sale |
| Loyalty accounts | While active, plus 24 months from the last transaction |
| Marketing contact details | Until consent is withdrawn or you object; reviewed after 24 months without engagement |
| Personal allergy details | Not retained |
| Customer service correspondence | 24 months from resolution |
| Guest WiFi sign in records | 24 months from your last connection. If you ticked the marketing box, your contact details are then kept as marketing contact details. |
| CCTV | 30 days, unless retained for a specific incident |
| Unsuccessful job applications | 6 months from the decision |
| Employee records | 6 years after employment ends; payroll and pension records longer where legally required |
| Unsuccessful franchise applications | 12 months from the decision |
| Franchise enquiries that do not lead to an application | 12 months from our last contact with you |
| Franchise agreements and associated records | Agreement term plus 7 years |
| Financial and accounting records | 6 years plus the current year |
| Analytics records in wider digital services | 26 months; this website has no analytics scripts |
| Records relating to a live or anticipated legal claim | Until the claim is resolved and applicable limitation periods expire |
Where a shorter period is possible, we apply it. Information that no longer needs to identify anyone may be anonymised for aggregate use.
11. International transfers
Some providers store or access information outside the UK, principally in the European Economic Area and the United States. Franchise enquiries are shared with Blitz Franchise in Canada, which the UK recognises as providing adequate protection for personal data handled by commercial organisations. Transfers require an applicable UK adequacy decision or other appropriate safeguards, such as the UK International Data Transfer Agreement or UK Addendum to EU standard contractual clauses. The UK extension to the EU–US Data Privacy Framework may apply where the recipient is certified.
We do not currently transfer personal data to the United Arab Emirates or other Gulf states. Contact us for information about the safeguards relevant to a particular service or transfer.
12. Protecting information
We are responsible for protecting the personal data we handle. If you have a concern about its security, contact privacy@lookumades.uk.
No system is completely secure. If a personal data breach occurs, we will assess it and make notifications to the ICO and affected people where required by applicable data-protection law.
13. Your rights
Depending on the circumstances, you can request access, correction, deletion, restriction of processing or a portable copy of information you have provided. You may object to processing based on legitimate interests, and you have an absolute right to object to direct marketing. Where we rely on consent, you can withdraw it without affecting earlier lawful processing.
We do not make solely automated decisions with legal or similarly significant effects about you. Job and franchise applications are assessed by people.
Email privacy@lookumades.uk or write to our registered office. We may need information to verify your identity or written authority if someone acts for you. We normally respond within one month; permitted extensions or requests for clarification will be explained to you. Requests are normally free of charge.
14. Complaints
To raise a data-protection complaint, email complaints@lookumades.uk or write to our registered office. Please explain your concern and how we can contact you. Privacy enquiries and rights requests can also be sent to privacy@lookumades.uk.
We will acknowledge a data-protection complaint within 30 days, investigate it and communicate the outcome without undue delay.
You can also complain to the Information Commissioner’s Office. Its helpline is 0303 123 1113, and its postal address is Wycliffe House, Water Lane, Wilmslow, Cheshire, SK9 5AF. You also have the right to seek a judicial remedy.
15. Children
Our online services are not directed at children under 13. We do not knowingly collect their personal information without parental consent or offer accounts, loyalty membership or marketing to anyone we know is under 13. Where parental consent is required for an online service, it must come from the person with parental responsibility. Contact our privacy inbox if you believe we hold a child’s information without the necessary consent.
16. Third-party websites
Ordering platforms, payment providers, maps and social-media websites have their own privacy practices. Read their notices before supplying information. This policy describes Lookumades’ processing, not every activity of those services.
17. Changes to this policy
We review this policy at least annually and when our processing or the law changes materially. The version and date at the top identify the current issue. Where a change materially affects you, we will notify you directly where appropriate.
18. Contact us
Privacy: privacy@lookumades.uk
Complaints: complaints@lookumades.uk
Franchise enquiries: franchising@lookumades.uk
Data Protection, Lookumades Franchising Ltd
29A St Margaret’s Street, Canterbury, Kent, CT1 2TG