Privacy Policy

Privacy Policy

Last updated: 29.08.2025

This Privacy Policy outlines how FLAVOR LOCK ("we", "our", or "us") collects, stores, uses, and protects your personal data when you engage with our services.

1. Who We Are

FLAVOR LOCK is a UK-based food business.

For data protection purposes, FLAVOR LOCK acts as the Data Controller for personal data collected via our landing pages, QR codes, and marketing campaigns.

Contact:
📧 [email protected]

2. What Data We Collect

We may collect the following personal information:

Full name

Phone number

Favourite menu items

This data is collected when you:

Fill out a form or landing page linked to FLAVOR LOCK

Scan a QR code and submit your information

Interact with our SMS promotions

3. How We Use Your Data

Your data is used solely for the following purposes:

To send SMS offers, promotions, and customer updates

To personalise offers based on your menu preferences

To respond to messages, feedback, or requests

We do not sell or share your personal data with third parties for advertising purposes.

4. Legal Basis for Processing

We rely on your explicit consent when you provide your details and opt in to SMS communications.
You may withdraw this consent at any time (see Section 9).

5. Data Capture, Access & Storage

Customer data is captured through QR codes and landing pages built and managed by our trusted service provider, Polarr Tech.

Data is securely stored using CRM and SMS platforms (Go High Level, Twilio).

Both FLAVOR LOCK and Polarr Tech have access to this data solely for customer engagement, tracking campaign performance, and SMS message delivery.

Polarr Tech acts as a Data Processor, handling data strictly on our instructions and in line with UK GDPR.

Your data is never shared, sold, or used by Polarr Tech or any other third party for unrelated purposes.

6. Data Retention

We retain your data only as long as necessary for the purpose it was collected or until:

You opt out of SMS communications

You request deletion of your data

7. Data Sharing & Third Parties

We only share your data with trusted service providers:

Polarr Tech – our technology and campaign delivery partner

Go High Level (LeadConnector) – CRM and SMS messaging

Twilio – SMS delivery infrastructure

All providers comply with UK GDPR and have data processing agreements in place.

8. Your Rights Under UK GDPR

You have the legal right to:
✅ Access your data
✅ Correct inaccurate information
✅ Request deletion of your personal data
✅ Withdraw consent at any time
✅ Lodge a complaint with the ICO

To exercise these rights, contact us at:
📧 [email protected]

9. Opting Out of SMS Messages

You may opt out at any time by:

Replying STOP to any SMS message

Contacting us directly via email

We maintain a suppression list to ensure your number is not contacted again after unsubscribing.

10. Data Security

We implement strong technical and organisational measures, including:

Secure UK/EU-based servers

Two-factor authentication

Restricted staff access

Data encryption and monitoring tools

11. Data Breaches

In the unlikely event of a breach, we will notify:

Affected individuals

The ICO (Information Commissioner’s Office)

This will be done within 72 hours, as required by UK GDPR.

12. International Transfers

Where any of our service providers operate outside the UK/EU, we ensure:

Appropriate safeguards are in place

Data is transferred under UK-approved Standard Contractual Clauses (SCCs)

All transfers comply with applicable laws

13. Updates to This Policy

We may update this Privacy Policy from time to time.

Changes will be posted here with a revised “Last Updated” date.

Continued use of our services means you accept any changes.

14. Children’s Data

We do not knowingly collect or process personal data from individuals under the age of 18 without parental or guardian consent. If we become aware that we have inadvertently collected personal information from a child under 18 without such consent, we will promptly delete the information.

If you believe that we may have collected data from a child without consent, please contact us immediately at 📧 [email protected]