Privacy notice

01Who we are

Forking Chefing is the trading name of [Forking Chefing Ltd], company number [to follow], registered office [to follow]. For the information described here we are the data controller: we decide what is collected and why, and we are answerable for it.

We are a small business run by one person, so we are not required to appoint a Data Protection Officer and have not. The founder is accountable for everything in this notice. We are registered with the Information Commissioner’s Office and pay the annual data protection fee; our registration number is [to follow].

02What we hold and why

1. Your email address and postcode district, if you joined the launch list at forkingchefing.com/launch. Lawful basis: your consent, given by ticking the box and then confirming from the email we send. You can withdraw it with the link in any email we send, by replying “stop”, or by emailing us.
2. To take and run a booking: your name, email address and phone number; the address the session happens at, with access and parking notes; how many people are eating; the menu and any photos you send us of your kitchen; the dates you asked for and the chef you were matched with. We hold this because we need it to perform the contract between us. Without it we cannot send anyone to your kitchen.
3. To bill you: the session fee, the shopping list you approved, the receipts and the invoice. Payment card details are handled by our payment provider and never reach us. We hold this to perform the contract, and afterwards to meet our legal obligations to HMRC.
4. To cook safely for you: allergy and dietary information for everyone eating, including children. This is health information and section 03 sets out how it is handled.
5. To answer you: emails you send us and our replies. We hold these because we have a legitimate interest in keeping a record of what was agreed, and because you would reasonably expect a reply to be readable later.
6. If something goes wrong: what happened, when, and any photographs of damage. We hold this to handle the complaint or the insurance claim, and to defend a legal claim if one is made.
7. Feedback you give us after a session, so we can change what needs changing. We ask, you choose, and a blank reply is a complete answer.

03Allergies and diets

1. Allergy and dietary information is special category data under the UK GDPR, because it says something about your health. It gets stricter treatment than the rest.
2. We ask for it separately at booking, with wording that makes clear what it is for, and your chef confirms it on the call before shopping. Our condition for holding it is your explicit consent. Where the information is about a child, we ask the parent or guardian who is booking.
3. We use it for one purpose: designing and cooking the menu so it is safe for the people eating. We do not use it for anything else, and we never use it to make decisions about you.
4. Your chef, and your front of house, sommelier, mixologist or nutritionist if your booking includes them, receive only the declaration for their own booking, through a link that expires. They act on our written instructions and may not keep or reuse it.
5. We delete it within 30 days of the session unless you ask us to keep it for a rebooking. You can withdraw your consent at any time by emailing us; if you withdraw it before the session we will usually have to cancel, because cooking for you without it is not something we are willing to do.
6. Please do not email us the detail. We ask for it at booking and your chef takes it on the call, so that it is held in one place and deleted on time. If you email it anyway, it is kept with the rest of our email, for the period in section 06, and held where section 09 says our email is held.
7. Be honest with us. A home kitchen is never an allergen-free kitchen and we will not pretend otherwise. If someone eating has a severe allergy, tell us before you book and we will say plainly whether we can cook safely for you.
8. If you book The Week Ahead, your nutritionist rings you before the session to plan the week, and takes the allergy and diet detail as your chef does. Anything else you choose to tell them about anybody’s health is a conversation between you: we do not ask for it, none of it reaches our systems or your chef, and the plan they pass to your chef names dishes and quantities, never reasons.

04Cookies and analytics

1. Nothing is set until you say yes. When you first visit we ask whether we may count your visit. Until you press Accept, this site stores nothing on your device and contacts no analytics service. Pressing “No thanks” is exactly as easy, and the site behaves identically either way.
2. Your answer is remembered in your browser’s local storage under a single flag, so we do not ask again on every page. That flag is the one thing we store without asking, because remembering that you said no is the only way to honour it. It never leaves your device.
3. If you accept, we use Google Analytics to count visits and see which pages are read. It sets cookies on your device and sends information to Google, including your device and browser type, the pages you look at, and a truncated version of your IP address. We have turned off every advertising feature: we do not run adverts, we do not build advertising audiences, and we never ask for advertising consent.
4. We look at this to decide which parts of the site are worth writing and where people give up. We do not try to identify you from it, and we do not combine it with your booking.
5. You can change your mind whenever you like. The Cookies link in the footer of every page reopens the question. Choosing “No thanks” then stops any further collection; to clear cookies already set, use your browser’s settings.
6. Google acts as our processor for analytics and may transfer information outside the UK; section 09 covers that. Google’s own description of what it does with the data is on their site.

05Who else sees it

1. Your chef, and your front of house, sommelier, mixologist or nutritionist if your booking includes them. They are self-employed, they act on our written instructions, and they get only what their own booking needs: your name, the address and access notes, the menu, and the allergy declaration. They are bound by confidentiality and data-handling terms and may not keep or reuse any of it.
2. Our payment provider, to take your payment. They handle the card details; we only ever see that a payment succeeded.
3. The tools we run the business on: email, a calendar, a booking form, an invoicing tool and, if you consented, Google Analytics. Our email is provided by Google, as Google Workspace, so anything you email us is held by Google on our behalf. Each acts as our processor under a contract.
4. The launch list is kept in the database this site runs on, and its emails are sent by the service that sends this site’s own email. Both act as our processors.
5. Cloudflare, which every visit to this site passes through on its way to the servers that run it. It delivers the pages and protects the site, so it handles your IP address and whatever your browser sends and receives here, including anything you type into a form. It also hides the email addresses on our pages from robots that collect them. It acts as our processor.
6. Our accountant and, if we need one, our solicitor or insurer — the last only if there is a claim.
7. Anyone the law requires, such as HMRC, or an environmental health officer investigating an incident.
8. That is the list. We do not sell your information, we do not share it for anyone else’s marketing, and we do not put it in an advertising audience.

06How long we keep it

1. Allergy and dietary details: deleted within [30 days] of the session, unless you ask us to hold them for a rebooking.
2. Booking and payment records, invoices and receipts: [six years] after the end of the tax year they fall in, because HMRC requires it.
3. Kitchen photos and access notes: deleted [30 days] after the session, or kept for as long as you remain a returning customer if you ask us to.
4. An application to cook with us that we turn down: deleted within [six months] of our telling you. If we take you on, it stops being an application and becomes part of your chef record, which section 08 covers.
5. Emails: [two years], then deleted, unless they form part of a booking record or a complaint.
6. Complaints, incidents and insurance claims: [six years] from resolution, which is the period in which a claim could still be brought.
7. Your marketing preference: for as long as you want to hear from us, plus a record of your unsubscribe so we do not email you again by mistake.
8. The launch list: an address nobody confirms is deleted after 7 days; a confirmed one 12 months after it was confirmed; and any address at once if you unsubscribe or tell us to stop.
9. Analytics, if you accepted it: 14 months in Google Analytics, then deleted automatically. We keep that long so we can compare a season against the same season a year before, which two months would not allow. The totals we read in reports are aggregated and outlive the underlying records. If you said no thanks, there is nothing to keep.

07Marketing

1. We only email you about the service if you asked us to, or if you have booked with us before and we are telling you about something similar.
2. The launch list. If you joined the launch list, that is consent to news about our launch, for up to 12 months from the day you confirmed, and nothing else: not a newsletter about anything else, and never given to anybody else to use. The box is never pre-ticked, because a pre-ticked box is not consent, and nothing is sent until you confirm from the email we send. We hold the address, the district, when you asked and when you confirmed, the version of this notice you were shown, and which of these emails we last sent you.
3. Every marketing email has an unsubscribe line, and replying “stop” works just as well. We act on it straight away.
4. Messages about a booking you have made — a confirmation, an invoice, the card typed up afterwards — are not marketing and are sent regardless. If you would rather not receive those, the answer is to not have a booking with us.

08Chefs, crew and applicants

1. If you apply to cook. We hold your name and email address, and the answers you give us: what you cook, where you have cooked, the postcode districts you cover, the days you usually work, and what you are like in someone’s kitchen. We hold it because you asked us to consider you, which is a step taken at your request before any contract between us.
2. Your passkey is not your fingerprint. You sign in with your face, your fingerprint or your device’s PIN, and none of those ever leave your device or reach us. What we hold is a public key your device gave us and a name for the device, which together prove it is the same device next time and nothing else.
3. The code we send you. Before anything else we email a six-digit code to the address you typed, to check the address is yours. We hold that address from the moment you ask for a code, whether or not you go any further.
4. An account exists as soon as you make a passkey. That happens before we have asked you anything about cooking, so if you stop there we still hold your name, your email address and that passkey. We also keep a name for the device — if you leave that box blank we take it from what your browser tells us, such as “Safari on iPhone” — together with when you made it and when it was last used to sign in.
5. What you write about yourself is shown to customers. Your answer to what you are like in someone’s kitchen appears beside your name when we suggest you for a session. It is in your own words, and nothing else from your application is shown to anyone outside the business.
6. If we do not take you on, we delete your application within [six months] of telling you, and sooner if you ask. A person reads every application; nothing here is decided by a machine.
7. If you cook for us, we hold your name and contact details, your right-to-work and self-employment details, your Level 2 Food Safety certificate, your food business registration with the council, your insurance details, your diary and your invoices.
8. We also hold the result of a Basic DBS check. That is criminal-offence information and gets stricter treatment: we record the outcome and the date, not the detail, we hold it under the conditions the Data Protection Act 2018 allows for it, and we destroy the certificate copy within [six months] of the vetting decision.
9. We use all of this to satisfy ourselves that you can safely be sent into a customer’s home, to book you work, and to pay you.
10. Customers are told that our chefs are Basic DBS-checked, food-safety trained and registered. They are never told the contents of your check.

09Where it is held

Our records are held in the United Kingdom or the European Economic Area wherever we can arrange it. Our email is the exception: it is held by Google, which offers no United Kingdom location and may hold it in the United States or elsewhere. Every visit also passes through Cloudflare, a United States company, which handles it at whichever of its data centres is nearest to you: for a visitor in the UK, usually one in the UK. Some of the other tools we use, including Google Analytics if you consented to it, may also transfer information to countries outside the UK. Where that happens it is done under the safeguards the UK GDPR requires, such as the International Data Transfer Agreement or an adequacy decision. [Confirm the transfer mechanism for each processor before launch.]

10Your rights

1. You can ask us what we hold about you and get a copy, normally within one month and free of charge.
2. You can have it corrected if it is wrong, or completed if it is missing something.
3. You can ask us to delete it. Where we are keeping something because the law requires it, such as an invoice for HMRC, we will say so plainly rather than quietly refusing.
4. You can ask us to stop or limit what we are doing with it, and you can object to anything we are doing on the basis of our legitimate interests.
5. Where you gave us consent — your allergy details, or analytics — you can withdraw it at any time. Withdrawing does not undo what was done while the consent stood.
6. You can ask for a portable copy of the information you gave us, in a form another business could read.
7. To use any of these, email [email protected]. We may ask a question to check it is really you, and then we will get on with it.

11Complaints

If we have got something wrong, tell us first at [email protected] and we will try to put it right. If you are not satisfied, you can complain to the Information Commissioner’s Office, the UK regulator for data protection, at ico.org.uk/make-a-complaint or on 0303 123 1113. You do not have to come to us first, but we would rather you did.

12Changes and contact

If we change how we use your information we will update this notice and change the version and date at the top. Where the change matters we will tell people who have a booking with us rather than expecting them to notice.

Forking Chefing, [registered address], Plymouth. Email [email protected]. The related terms, including cancellation and liability, are in our terms and conditions.