Privacy Policy
Last updated: 15 November 2026
Who we are
Safe Serve Flags Ltd (“we”, “us”) runs the website at safeserveflags.co.uk and the shop at shop.safeserveflags.co.uk. We are the controller of the personal data described in this policy.
- Company number: 16969406 (registered in England and Wales)
- Registered office: Crooklets Amusement Centre, Crooklets, Bude, EX23 8NE
- Contact for privacy questions: support@safeserveflags.co.uk
This policy covers the website, the shop, the members area, staff system training and the certificates we issue.
Safe Serve Flags is an extra layer of safeguarding, complementary to a venue’s existing allergy procedures. We do not ask diners for health information, and you should not send us details of anyone’s allergies or medical conditions.
What we collect
What we hold depends on how you use us.
| You are | What we collect | Where it comes from |
|---|---|---|
| A shop customer | Name, billing and delivery address, email, phone number, what you ordered, and your shop account login if you create one | You, at checkout |
| Paying by card | We do not see or store your card number. Stripe takes the payment and tells us whether it succeeded | Stripe |
| A venue owner or manager | Name, email, password (stored encrypted), your business and venue details, contact details, menus and logo you upload, and your accreditation application | You |
| A member of staff doing system training | Name, email, job role, the venue you work at, your quiz attempts and scores, and your certificate (number, issue and expiry date) | You, or your employer if they add you to their staff list |
| Someone who sends an enquiry | Venue name, your name, email, phone number, town and your message | You, on the contact or interest form |
| Anyone who signs in | Sign-in attempts with the date, IP address and browser, used to protect accounts | Your device |
| A website visitor | Your postcode if you search the venue finder, and your location if you choose “Use my location”. Location is used in your browser to sort results and is not stored by us | You |
If your employer adds you to their staff list, they give us your name and email so we can invite you to system training.
We do not knowingly collect data from children. Accounts are for people working in or running a food business.
Why we use it
We only use personal data where UK data protection law gives us a reason to.
| What we do | Our lawful basis |
|---|---|
| Take, deliver and support your shop order | Performing our contract with you |
| Run your account, your venue listing, staff system training and certificates | Performing our contract with you or your employer |
| Review accreditation applications and keep the venue finder accurate | Our legitimate interest in running the scheme properly |
| Reply to enquiries | Our legitimate interest in answering you, or steps before a contract |
| Keep accounts secure and investigate misuse | Our legitimate interest in protecting users and the service |
| Keep order and tax records | A legal obligation |
| Send marketing emails or newsletters | Your consent, which you can withdraw at any time |
We do not sell personal data, and we do not make decisions about you by automated means alone. The staff quiz is marked automatically, but it can be retaken and anyone can ask us to look at a result.
Who we share it with
We share personal data only with the companies that help us run the service, and only what each one needs.
| Company | What they do for us | What they receive |
|---|---|---|
| Stripe | Takes card, Apple Pay and Google Pay payments | Payment details, name, billing address, order amount |
| Prep365, our fulfilment partner, using the Mintsoft warehouse system | Packs and posts shop orders | Name, delivery address, email, phone number, items ordered |
| Hostinger | Hosts the shop and our company email | Shop accounts and orders; emails you send us |
| Vercel | Hosts the website | Pages you request, including your IP address |
| Supabase | Stores accounts, venues, staff records and certificates, in the EU, and sends account emails | The account, venue and system training data listed above |
| Measures how the shop is used (Google Analytics) | Pages viewed, device and approximate location | |
| Productivity Tools | Error reports so we can fix faults, with personal details removed | Technical details of the error |
| postcodes.io | Turns a postcode into a map position for the venue finder | The postcode typed in |
When you press “Directions” on a venue, Google Maps opens and Google’s own privacy policy applies.
We will also share data if the law requires it, or with professional advisers where needed. If the business is sold or merged, personal data may pass to the new owner under the same protections.
What is shown publicly
Two things are visible to anyone, by design.
- Venue listings. A listed venue’s name, address, phone number, website, description, menus, logo and food hygiene rating appear on the venue finder. These are business details supplied by the venue.
- Certificate checks. Anyone who has a system training certificate number can check it on our website. The check shows the holder’s name, job title, venue, score, and the issue and expiry dates. This lets an employer or inspector confirm a certificate is genuine.
A certificate confirms system training in using Safe Serve Flags only. It is not a food allergy qualification and not venue accreditation.
If you are a member of staff and do not want your certificate to be checkable, contact us and we will withdraw it.
Cookies
We use cookies that the website and shop need in order to work, and the shop uses Google Analytics. We do not use advertising cookies.
| Where | Cookie | What it is for |
|---|---|---|
| Website | Sign-in cookies | Keep you signed in to your account |
| Shop | Basket and session cookies | Remember what is in your basket and keep you signed in to your shop account |
| Shop | Stripe cookies | Help Stripe take payments safely and prevent fraud |
| Shop | Google Analytics cookies | Measure how the shop is used, so we can improve it |
You can block or delete cookies in your browser settings, and you can stop Google Analytics with Google’s opt-out add-on. If you block the necessary cookies, signing in and checkout will not work.
How long we keep your data
We keep personal data only as long as we need it.
| Data | How long we keep it |
|---|---|
| Shop orders and invoices | 6 years after the end of the tax year, as tax law requires |
| Account details | While the account is open, then deleted within 12 months of closure |
| Staff system training records and certificates | For the life of the certificate, then 2 years, so past training can be evidenced |
| Accreditation applications | For as long as the venue is a member, then 2 years |
| Enquiries | 2 years after our last contact |
| Sign-in and security records | 12 months |
Where it is stored. Website data is stored in the European Union. Some of our providers, including Stripe, Google and Vercel, may process data outside the UK. Where they do, they rely on safeguards recognised under UK law, such as the UK’s adequacy decisions or standard contractual clauses.
Security. Passwords are stored encrypted and we never see them. Access to members’ data is restricted by account, and our administrators must sign in with two-factor authentication. No system is completely secure, so if we ever have a breach that puts you at risk, we will tell you and the Information Commissioner’s Office as the law requires.
Your rights
Under UK data protection law you can ask us to:
- give you a copy of the personal data we hold about you;
- correct anything that is wrong;
- delete your data, where we have no good reason to keep it;
- stop or limit how we use it, including for marketing;
- send your data to you or another organisation in a usable format;
- withdraw consent you have given, at any time.
To use any of these rights, email support@safeserveflags.co.uk. We will reply within one month and there is normally no charge. We may ask you to confirm who you are first.
If you are a member of staff, your employer added some of your details. You can ask either us or them to correct them.
If you are unhappy with how we have handled your data, please tell us first so we can put it right. You also have the right to complain to the Information Commissioner’s Office at ico.org.uk/make-a-complaint or on 0303 123 1113.
Changes to this policy
We will update this policy when what we do changes, and show the date of the latest version at the top. If a change affects how we use data you have already given us, we will tell you by email or on the website before it takes effect.