Privacy Policy

FT Smash operates the online food ordering platform at ftsmash.co.uk. For the purposes of UK GDPR and the Data Protection Act 2018, FT Smash is the data controller responsible for your personal data.

FT Smash
463 Halliwell Road, Bolton, BL1 8DB
Phone: 01204 298383
Email: ftsmashltd@gmail.com

For any data protection questions, contact us at the email above with the subject line "Data Protection Query". We aim to respond within 14 days.

We collect the following personal data:

When you create an account:

• Full name
• Email address
• Phone number
• Password (stored as a one-way encrypted hash — we cannot read it)
• Date and time of account creation
• Marketing consent preference and timestamp

When you place an order (account or guest):

• Name, email, and phone number as provided
• Items ordered, quantities, customisations, and special instructions
• Order reference number and order timestamp
• Any allergen or dietary information you provide
• The time slot you selected, if you scheduled your order for later

If you choose delivery:

• Your delivery address and postcode
• Your postcode is sent to a third-party lookup service to find its location, and that location is sent to a third-party routing service to measure the driving distance from our kitchen. This is how we check you are inside our delivery area and work out the delivery fee. See section 5.
• We do not track your device location — we only use the postcode you type in.

If you enable order notifications:

If you allow browser or device notifications, we store a notification subscription issued by your browser (a unique endpoint URL and the keys needed to send to it) so we can tell you when your order is ready. You can revoke this at any time in your browser or device settings.

Payment information:

Payments are processed directly by SumUp. FT Smash does not store, see, or process your full card number, expiry date, or CVV. We only retain the transaction reference ID and amount. SumUp is PCI DSS Level 1 certified.

Technical and usage data:

• IP address
• Browser type and version
• Device type (mobile or desktop)
• Pages visited and timestamps
• Session cookies required for login

We use your data only for lawful purposes. Below is a summary of what we process, on what legal basis, and for how long we keep it:

We will only send you marketing emails or texts if you have given your explicit consent during registration or updated your preferences in your account settings. We do not pre-tick marketing boxes.

If you have placed an order with us, we may occasionally contact you about similar offers under the "soft opt-in" rule (PECR 2003), unless you have opted out.

You can withdraw your marketing consent at any time by:

• Toggling it off in your Account Settings
• Clicking the unsubscribe link in any marketing email
• Contacting us at ftsmashltd@gmail.com

Withdrawing consent does not affect the lawfulness of processing before withdrawal, and you will continue to receive transactional emails (e.g., order confirmations) as these are necessary for your order.

We do not sell your personal data. We share it only with trusted third-party processors who act on our instructions and under binding Data Processing Agreements:

SumUp Ltd — Payment processing. Data shared: name, email, amount, IP address. SumUp processes payments securely and complies with UK GDPR. SumUp Privacy Policy →

Resend Inc — Transactional email delivery (order confirmations and account emails). Data shared: name and email address. Resend complies with UK GDPR. Resend Privacy Policy →

Brevo (Sendinblue SAS) — Transactional email delivery. We are moving our email to Brevo, and one of Brevo or Resend will deliver any email we send you. Data shared: name and email address. Brevo is based in the EU and complies with UK GDPR. Brevo Privacy Policy →

Postcodes.io — UK postcode lookup, used only for delivery orders. Data shared: the postcode you enter at checkout. It is used to find the postcode's approximate location so we can check you are in our delivery area. No name, contact details or order contents are sent. postcodes.io →

OSRM (Open Source Routing Machine) — Driving-distance calculation, used only for delivery orders. Data shared: the coordinates of our kitchen and the approximate coordinates of your postcode. No name, address line, contact details or order contents are sent. project-osrm.org →

Website & Database Host — Our servers and database store all website data including account and order information. Our hosting provider complies with UK GDPR and we have a Data Processing Agreement in place.

We may disclose your data to law enforcement, courts, or regulatory authorities if required by law or to protect the rights, property, or safety of FT Smash, our customers, or the public.

Where any processor transfers data outside the UK or EEA, this is done using appropriate safeguards such as UK Standard Contractual Clauses (SCCs) or transfers to countries with UK adequacy decisions. SumUp, Brevo and Resend operate primarily within the EU/EEA and comply with applicable transfer restrictions. Our postcode lookup and distance-calculation services receive only a postcode or coordinates — no information that identifies you by name or contact details.

We take appropriate technical and organisational measures to protect your data against unauthorised access, loss, or destruction. These include:

• HTTPS/SSL encryption for all data transmitted between your browser and our servers
• Passwords stored using bcrypt hashing (one-way encryption — we cannot read your password)
• Access to personal data restricted to authorised personnel only
• Regular security monitoring of our systems

No system is 100% secure. In the event of a personal data breach that poses a risk to your rights, we will notify you without undue delay and report to the Information Commissioner's Office (ICO) within 72 hours of becoming aware.

We use the following cookies on our website:

Strictly necessary cookies (no consent required): These are required for the website to function, including maintaining your login session and your shopping cart. Without these, the website will not work correctly.

Third-party cookies from SumUp: The SumUp payment widget may set cookies for payment security and fraud prevention purposes when you reach the checkout.

Google Maps (optional): The map on our homepage only loads when you choose to view it. Once loaded, Google may set its own cookies — see Google's privacy policy for details.

You can control cookies through your browser settings. Disabling strictly necessary cookies will affect website functionality. For more information on managing cookies, visit allaboutcookies.org.

Our Service is not directed at children under the age of 13. We do not knowingly collect personal data from children. If you believe a child has provided us with personal data, please contact us at ftsmashltd@gmail.com and we will delete it promptly.

Under UK GDPR, you have the following rights regarding your personal data. To exercise any of these rights, email us at ftsmashltd@gmail.com with the relevant request title. We will respond within 30 days (extendable to 90 days for complex requests).

• Right of Access — Request a copy of all personal data we hold about you. Subject: "Data Access Request".
• Right to Rectification — Request correction of inaccurate data. You can also update your name and phone number directly in Account Settings.
• Right to Erasure ("Right to be Forgotten") — Request deletion of your data. We may retain some data where required by law (e.g., tax records for 6 years). Subject: "Erasure Request".
• Right to Restrict Processing — Request we limit how we use your data while a dispute is resolved. Subject: "Restriction Request".
• Right to Data Portability — Request your data in a portable, machine-readable format (e.g., CSV). Subject: "Data Portability Request".
• Right to Object — Object to processing based on legitimate interests (e.g., server logs). Subject: "Objection". You can also unsubscribe from marketing at any time.
• Rights Related to Automated Decisions — We do not make any automated decisions that significantly affect you. If this changes, we will inform you.

If you are unhappy with how we have handled your personal data, you have the right to lodge a complaint with the Information Commissioner's Office (ICO) — the UK's independent data protection authority. This is free of charge.

We encourage you to contact us first so we can try to resolve the issue directly. If we are unable to, you can reach the ICO via:

• Website: ico.org.uk
• Phone: 0303 123 1113
• Post: Information Commissioner's Office, Wycliffe House, Water Lane, Wilmslow, Cheshire, SK9 5AF

We may update this Privacy Policy from time to time to reflect changes in our practices, technology, or legal requirements. We will notify you of any material changes via email or a prominent notice on the website. Your continued use of the Service after the effective date of any changes constitutes your acceptance of the updated policy.

The current version of this policy is always available at ftsmash.co.uk/privacy.

This Privacy Policy is governed by UK GDPR, the Data Protection Act 2018, and the Privacy and Electronic Communications Regulations 2003 (PECR). Any disputes relating to this policy shall be subject to the jurisdiction of the courts of England and Wales.