This policy explains how Online Marketing Solutions Ltd, trading as Octopus Menu, a company registered in England and Wales (company number 11903083) (“Octopus Menu”, “we”, “us”) uses personal data as a controller: the data of the restaurants and other businesses that use our platform and their team members, of visitors to our website, and of people who contact us.
1. Diners: the restaurant is responsible
If you used a restaurant’s menu, left it feedback, joined its loyalty card or signed up for its emails, that restaurant is responsible for your personal data (it is the controller) and we handle the data on its behalf (we are its processor). The diner privacy notice explains what is collected and how to exercise your rights; the restaurant’s own notice is linked from its menu. Please contact the restaurant about your data. If you contact us, we will pass your request to the restaurant. Our obligations to restaurants are in our Data Processing Addendum.
2. What we collect
- Account data: the name, email address and role of each person with access to a business account, and their sign-in details (passwords are handled by our authentication provider and never stored by us in readable form). If you sign in with Google or Apple, where offered, we receive your name and email address from them.
- Business details: business name, contact email and phone, address, website and similar details you add to your account. Where these identify a person, such as a sole trader, they are personal data.
- Billing data: your plan, billing currency, billing history and payment status. Card details are collected and held by Stripe, not by us.
- Records of your agreement: which version of our Terms of Service and Data Processing Addendum was accepted, by whom, when, and how.
- Usage and technical data: how the dashboard is used, and the IP address, browser and device details sent with each request, including in our server logs.
- Website analytics: if you accept analytics cookies on our website, which of our marketing and sign-up pages were visited, the referring site, and the browser and approximate location, collected with our own self-hosted analytics. We do not use Google Analytics on our website.
- Correspondence: what you send us when you contact us by email or through our contact form.
3. Why we use it and our lawful bases
- To provide the Service under our contract with your business: creating and running the account, publishing menus, sending account and service emails, and support. Lawful basis: contract, and our legitimate interests in serving the business you work for.
- To bill and keep accounts. Lawful basis: contract and legal obligation.
- To keep the Service secure, prevent fraud and abuse, and enforce our terms. Lawful basis: legitimate interests.
- To improve the Service using aggregated usage information. Lawful basis: legitimate interests.
- To show our website in your language: the country our hosting provider derives from your IP address picks the language our pages open in, until you choose one from the language menu. It is used only for that request and is not stored. Lawful basis: legitimate interests.
- Website analytics. Lawful basis: consent, which you can withdraw at any time through “Cookie settings”.
- To keep a record of your agreement to our terms, and to establish, exercise or defend legal claims. Lawful basis: legitimate interests and legal obligation.
- Product news. If we send business customers news about the Service, we do so on the basis of our legitimate interests, and you can unsubscribe at any time.
4. Who we share it with
- Our service providers, listed on our sub-processors page, who process data for us under contract.
- Stripe, which processes payments as a controller in its own right.
- Professional advisers, insurers and auditors, under confidentiality.
- Authorities, courts and regulators where the law requires it or to protect our rights.
- A buyer or successor if all or part of our business is sold or reorganised.
We do not sell personal data.
5. Where it is stored
Our application servers are in the United Kingdom (London) and our database is in the European Union (Ireland). Some service providers process data in other countries, including the United States. Where personal data leaves the UK, we rely on adequacy regulations, the UK Extension to the EU-US Data Privacy Framework where the recipient is certified, or the UK International Data Transfer Agreement or Addendum to the EU Standard Contractual Clauses.
6. How long we keep it
- Account data, business details and dashboard usage: while the account is open. Cancelling a paid plan does not close the account (it moves to the Free plan). When an account is closed, the business details are anonymised straight away and the rest of the account’s data, including team members’ details, is deleted 30 days later.
- Billing records: as long as tax and company law require us to keep accounting records (generally six years from the end of the financial year they relate to).
- Records of acceptance of our terms: for as long as we may need them to show what was agreed, which can be after the account closes.
- Menu analytics we hold for restaurants (not linked to a named diner): Free plan: 7 days. Essential: 90 days. Growth: while the account is open.
- Our website analytics: up to 25 months.
- Server logs and correspondence: only as long as needed for the purposes above.
We may keep data for longer where the law requires it or where it is subject to a legal hold for an actual or expected legal claim.
7. Your rights
Under data protection law you can ask us for access to your personal data, to correct it, to erase it, to restrict or object to our use of it, and to receive it in a portable form. Where we rely on consent, you can withdraw it at any time. Some rights have limits; for example, we may need to keep billing records. To exercise a right, email privacy@octopusmenu.com. We will reply within one month.
You also have the right to complain to the Information Commissioner’s Office (ICO) at ico.org.uk. We would appreciate the chance to deal with your concerns first.
8. Cookies
Our Cookie Policy explains the cookies we use and how to change your choice.
9. Security
We protect personal data with measures that include encryption in transit, encryption at rest by our hosting providers, separation of each account’s data in the database, multi-factor authentication for our staff and logging of administrative access. No system is perfectly secure; if a breach affects you, we will tell you where the law requires it.
10. Children
Our platform is for businesses and is not aimed at children. Accounts are for people aged 18 or over.
11. Changes
We may update this policy. The version and date at the top show when it last changed, and we will tell account owners about material changes.
12. Contact
Data protection enquiries: privacy@octopusmenu.com.