Privacy Policy

Who we are

ClickMeats (“we”, “us”, “our”) is a UK-based online marketplace connecting customers with independent butcher shops for click-and-collect orders. We are the data controller responsible for your personal data when you use our platform at clickmeats.co.uk (the “Service”).

ClickMeats is operated by ClickMeats Limited, a company registered in England and Wales under company number 17328291.

You can reach us about anything in this policy at admin@clickmeats.co.uk.

Our role vs the butcher's role

ClickMeats is a marketplace. The butcher shop is the seller of record for the meat you buy. Both of us process some of your personal data, but for different reasons and with different responsibilities.

ClickMeats processes your data to run your account, take payment, route the order to the correct shop, send you order-status emails, and improve the Platform.

The butcher shop processes a subset of your data (name, phone, order details, collection time) to prepare and hand over your order. The shop is responsible for food quality, preparation, hygiene, allergen disclosure, stock availability, and correct handover. The shop does not see your email address, your card details, or your other orders.

The formal split is set out in our Data Processing Addendum with each shop. Both parties are joint controllers of Order Data under UK GDPR Article 26. For rights requests we are the primary contact — see “Your rights” below.

The data we collect

We only collect what we need to run the Service. The data falls into three categories:

Account data

• Email address — required to create an account, sign in, and receive order receipts.
• Phone number — required to contact you about collection orders (e.g. when your order is ready).
• Name — shown to the butcher you place an order with so they know who is collecting.

Order data

• Order history — the items, quantities, prices, and timestamps for every order you place. Linked to your account.
• Order status events — when your order moves through preparing / ready / collected stages.

Payment data

Card details are never stored on our servers. Payments are processed by Stripe Payments UK Limited (Stripe's Privacy Policy). We receive only the order amount, the timestamp, and Stripe's opaque reference id — never your full card number, CVV, or expiry.

Technical data

• Browser session data — IP address, user agent, basic interaction analytics. Collected via PostHog (PostHog's Privacy Policy). Data is stored in the EU.
• Error reports — when the Service hits an unexpected error, we send a stack trace to Sentry (Sentry's Privacy Policy). The app is configured to scrub auth headers, cookies, payment details, and common sensitive fields before transmission, but accidental personal data in an error context remains possible and is handled under our incident process.

How we use your data

We do not use your data for marketing without your explicit consent, and we do not sell, rent, or trade your data to third parties.

Automated decision-making

We do not make automated decisions that produce legal or similarly significant effects for you. Order routing, fraud screening (via Stripe Radar), and status updates are all deterministic — no profiling models decide whether to accept or refuse your business.

Who we share your data with

We share personal data only with the parties listed below, and only for the purposes shown. We do not sell, rent, or exchange your data with anyone else.

The butcher you order from

When you place an Order, the butcher shop receives your name, phone number, and Order details (items, quantities, cut preferences, collection time). The butcher cannot see your email address, card details, other Orders you’ve placed with other butchers, or your ClickMeats account history.

Butchers agree in our Merchant Agreement not to use your contact details for any purpose beyond fulfilling the specific Order you placed with them.

Third-party processors (sub-processors)

Third-party service providers process personal data on our behalf to keep the platform running. We keep the relevant privacy, data-processing, and transfer terms under review. The current public list is available on our Subprocessors page.

We may add or replace sub-processors from time to time. When we do, we’ll update the Subprocessors page. Where a change is material, we’ll notify account holders in advance where required so you can review it.

Law enforcement and regulators

We disclose personal data to law enforcement, regulators (including the ICO), or a court only where we are legally required to do so, or where we reasonably believe disclosure is necessary to prevent fraud, protect our rights, or protect the safety of a person.

International data transfers

Most of your data stays within the UK and EEA. Some processors, including Stripe, Resend, Sentry, Cloudflare, and Vercel, may process limited data outside the UK / EEA for operational reasons. Where that happens, we rely on the applicable transfer safeguards in those providers' terms and keep those safeguards under review.

How long we keep your data

• Account data — for as long as your account is open, plus 30 days after deletion to honour recovery requests.
• Order data — 7 years from order date, to comply with UK tax record-keeping requirements (HMRC's VAT and record-keeping guidance under the Finance Act 2008).
• Analytics events — 12 months from collection.
• Error reports — 30 days from receipt.
• Support correspondence — up to 3 years after the issue is resolved.

Children's data

The Service is intended for adults aged 18 and over. We do not knowingly collect data from children under 13. If you believe a child has provided us with personal data, please contact us at admin@clickmeats.co.uk and we'll delete it.

Marketing communications

We send transactional emails (receipts, order ready notifications, refund confirmations, security alerts) as part of running your account — these are essential to performing our contract with you and cannot be turned off while you have an active account.

We do not send promotional or marketing emails as of this policy's effective date. If we introduce marketing communications in the future, we'll ask for your explicit opt-in first, and every marketing message will include a one-click unsubscribe link.

Data breaches

In the unlikely event of a personal-data breach that's likely to result in a risk to your rights and freedoms, we'll notify the UK Information Commissioner's Office within 72 hours and, where the risk is high, notify affected users directly by email.

Your rights

Under UK GDPR, you have the right to:

• Ask for a copy of the personal data we hold about you
• Ask us to correct inaccurate data
• Ask us to delete your data (subject to legal retention obligations such as the tax requirement above)
• Restrict or object to how we use your data
• Receive your data in a portable format
• Withdraw any consent you've previously given, at any time

To exercise any of these, email admin@clickmeats.co.uk. We'll respond within one calendar month. You can also read our account deletion instructions at /legal/delete-account.

If you're unhappy with how we've handled your data, you have the right to complain to the UK Information Commissioner's Office at ico.org.uk/make-a-complaint or by calling 0303 123 1113.

Cookies and similar technologies

We use cookies in two ways:

• Strictly necessary — to keep you signed in (Cognito session token) and to remember your shopping cart. These cannot be turned off; the Service cannot work without them.
• Analytics — PostHog sets cookies to measure aggregate site usage. You can opt out by clearing cookies for our domain or by enabling “Do Not Track” in your browser.

Changes to this policy

We'll update the “Effective from” date at the top of this page when we make material changes. For substantive changes (new purposes, new third parties), we also email registered users at least 14 days before the change takes effect.

Contact

Questions, requests, or complaints: admin@clickmeats.co.uk.

See also our Terms of Service.