Privacy
policy.

Who we are

YouMeSushi (“us”, “we”, or “our”) operates youmesushi.com (the “Site”) along with our restaurants, takeaway counters and delivery services. This page explains what personal information we collect, how we use it and the choices you have.

For the purposes of UK data protection law we are the data controller for the information described here. Some of our branches are run by franchise partners — where a branch handles your information for its own local purposes, that branch acts as controller for those activities and we act as controller for the Site, your account and our central marketing.

By using the Site you agree to the collection and use of information in line with this policy. Unless defined differently here, terms have the same meaning as in our Terms and Conditions.

Information collection and use

We use your personal data to process your order, manage transactions and personalise your customer account. With your consent, we’d also like to keep in touch about what we’re doing, including menu changes and product updates.

While using our Site we may ask you to provide certain personally identifiable information that can be used to contact or identify you (“Personal Information”), including but not limited to:

• Your name
• Email address
• Postcode and delivery address
• Phone number
• Order history and loyalty activity
• Payment confirmation details (card payments are processed by our payment providers — we never store full card numbers)

Why we use your information and our legal bases

Under UK GDPR we must have a lawful basis for using your personal data. Ours are:

• Contract — to take, prepare and deliver your order, manage your account and handle refunds.
• Consent — to send you marketing emails, texts or push notifications, and to set non-essential cookies. You can withdraw consent at any time.
• Legitimate interests — to keep the Site secure, prevent fraud, improve our menu and service, and respond to your enquiries and feedback.
• Legal obligation — to keep tax, accounting and food-safety records, and to respond to lawful requests.

Log data

Like many site operators, we collect information that your browser sends whenever you visit our Site (“Log Data”). This may include your device’s Internet Protocol (“IP”) address, browser type and version, the pages of our Site you visit, the time and date of your visit, the time spent on those pages and other statistics.

Cookies

Cookies are small files of data, which may include an anonymous unique identifier, sent to your browser from a website and stored on your device. Like many sites, we use cookies to collect information.

We use the following categories:

• Essential cookies — needed for the Site, your basket and checkout to work. These are always on.
• Analytics cookies — help us understand how the Site is used so we can improve it.
• Marketing cookies — used to measure and tailor our advertising.

Managing cookies

Non-essential cookies are only set with your consent, and you can change your choice at any time through the cookie banner or your browser settings. You can also instruct your browser to refuse all cookies or to tell you when a cookie is being sent — but if you do not accept cookies, some parts of our Site may not work.

Communications

We may use your Personal Information to contact you with newsletters, marketing or promotional material and other information about YouMeSushi that may be of interest to you. You can opt out of any or all of these at any time by following the unsubscribe instructions in any email we send, or by emailing us.

We will always send service messages relating to an order you have placed — for example an order confirmation — as these are needed to fulfil your order.

Who we share your information with

We never sell your personal data. We share it only with organisations that help us run our business, and only as far as they need it:

• Our point of sale, order management and loyalty providers
• Delivery partners and third-party ordering platforms used to fulfil your order
• Payment providers who process your payment securely
• Email, SMS and marketing platforms used to send communications you have agreed to
• IT, hosting and analytics suppliers who support the Site
• Franchise partners operating the branch fulfilling your order
• Professional advisers, insurers and authorities where we are required to disclose by law

International transfers

Some of our suppliers are based outside the UK. Where your personal data is transferred outside the UK, we make sure appropriate safeguards are in place — such as UK adequacy regulations or the International Data Transfer Agreement/Addendum — so your data receives an equivalent level of protection.

Security

We use appropriate technical and organisational measures to protect your personal data, including encrypted connections, restricted access on a need-to-know basis and secure, reputable suppliers. No method of transmission over the internet is completely secure, so we cannot guarantee absolute security, but we take these responsibilities seriously and will notify you and the ICO where required if a breach affects your rights.

Data retention and deletion

We keep your personal data only for as long as is necessary for the purposes for which it was collected, or to comply with legal, accounting or reporting requirements.

If you request deletion of your personal data or close your account, we will remove your details from our active systems, including our point of sale system, order manager and marketing CRM. However, in line with our legal obligations under applicable tax and accounting regulations, we are required to retain certain transaction records (which may include your name, contact details and purchase history) for up to six years.

These records are stored securely, are not used for marketing or profiling and are accessed only for accounting, auditing or legal purposes. At the end of the retention period the records are permanently deleted.

Your rights

Under UK data protection law you have the right to:

• Be told how your personal data is used
• Ask for a copy of the personal data we hold about you
• Have inaccurate data corrected
• Ask us to delete your data (subject to the retention rules above)
• Ask us to restrict how we use your data
• Object to processing based on our legitimate interests, and to direct marketing at any time
• Ask us to transfer your data to you or another provider (data portability)
• Withdraw consent where we rely on it

Automated decisions and profiling

We do not make decisions about you that have a legal effect using automated processing alone. We may group customers by things like order history or nearest branch so that offers and menu news are more relevant. You can opt out of this by unsubscribing from marketing at any time.

Children

Our Site and marketing are not aimed at children. We do not knowingly collect personal data from anyone under 13. If you believe a child has provided us with personal data, please contact us and we will delete it.

Changes to this privacy policy

We may update this policy from time to time. Any changes will be posted on this page with a revised date at the top, and where changes are significant we will tell you by email or a notice on the Site. Please review this page from time to time.

Complaints

If you are unhappy with how we have handled your personal data, please contact us first so we can put it right. You also have the right to complain to the Information Commissioner’s Office (ICO), the UK regulator for data protection, at ico.org.uk or on 0303 123 1113.