GDPR for Takeaways: Customer Data, Marketing and Your Own Ordering App (UK)

When customers order through your own app or website, your takeaway is normally the controller of their details under UK GDPR, and you can use them to make and deliver the order without asking for consent. Marketing is different: under PECR, offers by text or email need consent or the “soft opt-in”, which only works if you offered a clear opt-out at checkout and repeat it in every message. Every rule below was checked against ICO, GOV.UK, Apple and Google pages on 29 October 2026. General information, not legal advice.

Who is the controller when customers order through your own app?

The UK GDPR calls whoever decides why and how personal data is used the controller, and anyone handling it on their behalf a processor; the ICO says a sole trader can be a controller. Your takeaway decides to collect names, numbers and addresses to fulfil orders, and whether to market to those customers, so you are the controller and must be able to show you comply.

The company running your app or website usually acts as your processor. The ICO says a processor that decides purposes for itself becomes a controller for that processing, and some providers hold both roles: Stripe’s UK privacy policy says that, depending on the activity, it is a data controller and/or a data processor. Ask your provider which role it takes.

Orders and marketing need different lawful bases

The ICO says the contract basis applies when you need someone’s data to deliver a service they asked for, and a contract need not be written down, so a takeaway order qualifies. Its example: using a buyer’s address to deliver goods is necessary; profiling their interests from what they bought is not.

For marketing, the ICO names consent and legitimate interests as the likely bases, legitimate interests only where PECR does not require consent, and people have an absolute right to object. A purely administrative message is not marketing: “your order is on its way” is a service message; add “20% off on Friday” and it becomes marketing.

The soft opt-in, step by step for a takeaway

The ICO’s Guide to PECR says you must not send marketing emails or texts to individuals without specific consent, with a limited exception for your own previous customers. Its detailed guidance sets five conditions, all required:

1. You collected the contact details yourself, directly from the customer. The ICO says no third-party list can be soft opt-in compliant.
2. You collected them during a sale, or negotiations for one. A placed order counts.
3. You only market your own similar products: your menu and deals, not other companies’.
4. You offered a clear opt-out when you collected the details, such as a prominent box at checkout. One hidden in your privacy policy does not count.
5. Every later message has a free, simple opt-out: an unsubscribe link, or STOP by text. The ICO says not to make people log in to unsubscribe.

The ICO’s own worked example is a takeaway: a customer orders pizza online, gives a mobile number, and the checkout has a clear box to tick if they do not want marketing texts. Putting the opt-out only in the order confirmation text is too late, and the ICO says marketing texts that follow would breach PECR.

When you need consent instead

Newsletter sign-ups who never ordered, competition entries and messages promoting another business need consent. The ICO’s rules, in short:

• An unticked box or another clear action. Pre-ticked boxes and silence are not consent.
• Name your business and the channel, and ask separately for email and text.
• Never make marketing a condition of ordering; the ICO calls “by submitting your order, you agree to receive our marketing emails” bad practice.
• Record who agreed, when and how, and make withdrawing easy.

Push notifications and in-app messages

The ICO’s definition of electronic mail covers emails, texts, voicemail, in-app messages and social media direct messages; it does not name push notifications. Apple is explicit: guideline 4.5.4 says pushes should not be used for promotions or direct marketing unless customers opted in through consent language shown in your app, with an in-app way to opt out.

Apple’s wording suggests the phone’s own “Allow notifications” prompt is not enough: add a plainly worded marketing choice in the app and a switch to turn it off. Our suggestion: treat promotional pushes like marketing texts.

How long to keep customer data

The UK GDPR sets no fixed periods. The ICO says keep personal data no longer than you need it, set standard retention periods where possible, and erase or anonymise the rest; a small business with occasional low-risk processing may not need a written policy but must still review. Tax rules set a floor for sales records, not for every customer’s phone number.

The UK GDPR gives health data extra protection as special category data, and an allergy note such as “severe nut allergy” plausibly counts, by our reading. Use it to make the order safely and keep it out of marketing.

What to put in your privacy notice

The ICO says privacy information must be given when you collect the data, in clear and plain language. For a takeaway, its checklist comes down to:

• Who you are: trading name, the company or sole trader behind it, and contact details.
• What you collect (name, phone, email, address, order history, delivery notes, cookies), why, the lawful basis for each purpose and, where you rely on it, your legitimate interest.
• Who receives it: your ordering provider, card payment company, any courier, your email or text service, and any transfers outside the UK.
• How long you keep each type of data.
• People’s rights, including objecting to marketing, withdrawing consent and complaining to the ICO.

Have a way to take complaints too: the ICO says the Data (Use and Access) Act 2025, now in force, requires you to help people complain, for example with an electronic form, and to acknowledge complaints within 30 days.

The app stores add their own rules. Apple’s guideline 5.1.1 requires a privacy policy link in App Store Connect and inside the app, plus in-app account deletion where people can create an account. Google Play requires a privacy policy link in the Play Console and in the app, and account deletion in the app and on the web.

Questions to ask your ordering provider

The ICO says your contract with a processor must describe the processing and, as a minimum, cover acting only on your instructions, confidentiality, security, sub-processors, help with people’s rights, assisting you with security and breaches, the end of the contract, and audits. Put these questions to any provider, us included, and get the answers in writing:

1. Are you our processor for customer data, and where is the written contract?
2. Do you use our customers’ data for any purpose of your own?
3. Which sub-processors handle hosting, texts, email and push, and is data stored or accessed outside the UK?
4. Does checkout show a marketing choice when customers enter their details, separately for email, text and push, and can we set the wording?
5. Are consents and opt-outs recorded with a date and time?
6. Can customers delete their account in the app and on the web, and how do we answer access and erasure requests?
7. Can we export our customer list and order history, and do you return or delete the data when we leave?
8. How fast will you tell us about a breach? The ICO says a breach likely to put people at risk must be reported to it as soon as possible and, where feasible, within 72 hours.

The ICO fee and enforcement

Organisations that use personal information, sole traders included, must pay the ICO a data protection fee unless exempt: £52 a year for tier 1 (turnover up to £632,000 or no more than 10 staff), £78 for tier 2, £5 off by direct debit. The ICO’s self-assessment tells you if you need to pay. The government’s factsheet on the 2025 Act also says it aligns PECR enforcement powers and fines with the Data Protection Act 2018.

Where Aexir fits

Aexir is an online ordering system for independent restaurants and takeaways: their own branded iOS and Android ordering app, ordering website and browser till (POS on the Go), for a flat monthly fee at published prices. Aexir Digital Ltd is based in Manchester and sets up restaurants in the UK, France and worldwide.

Push notifications, offers, promo codes and loyalty are part of the platform, so these consent rules apply to our clients as to anyone. UK plans run from £30 to £50 a month ex VAT, on the pricing page. For what to send next, see our takeaway marketing ideas.

Sources

• ICO Guide to PECR, electronic mail marketing: https://ico.org.uk/for-organisations/direct-marketing-and-privacy-and-electronic-communications/guide-to-pecr/electronic-and-telephone-marketing/electronic-mail-marketing/ (checked 29 October 2026)
• ICO guidance on direct marketing using electronic mail (updated 28 April 2026): https://ico.org.uk/for-organisations/direct-marketing-and-privacy-and-electronic-communications/guidance-on-direct-marketing-using-electronic-mail/, https://ico.org.uk/for-organisations/direct-marketing-and-privacy-and-electronic-communications/guidance-on-direct-marketing-using-electronic-mail/how-do-we-comply-with-the-pecr-electronic-mail-marketing-rules/ and https://ico.org.uk/for-organisations/direct-marketing-and-privacy-and-electronic-communications/guidance-on-direct-marketing-using-electronic-mail/key-concepts-for-direct-marketing-using-electronic-mail/ (checked 29 October 2026)
• ICO, choosing your lawful basis for direct marketing: https://ico.org.uk/for-organisations/direct-marketing-and-privacy-and-electronic-communications/sending-direct-marketing-choosing-your-lawful-basis/ (checked 29 October 2026)
• ICO, controllers and processors: https://ico.org.uk/for-organisations/uk-gdpr-guidance-and-resources/controllers-and-processors/controllers-and-processors/what-are-controllers-and-processors/ and contract terms: https://ico.org.uk/for-organisations/uk-gdpr-guidance-and-resources/accountability-and-governance/contracts-and-liabilities-between-controllers-and-processors-multi/what-needs-to-be-included-in-the-contract/ (checked 29 October 2026)
• ICO lawful basis guide, contract: https://ico.org.uk/for-organisations/uk-gdpr-guidance-and-resources/lawful-basis/a-guide-to-lawful-basis/contract/ and storage limitation: https://ico.org.uk/for-organisations/uk-gdpr-guidance-and-resources/data-protection-principles/a-guide-to-the-data-protection-principles/storage-limitation/ (checked 29 October 2026)
• ICO right to be informed checklists: https://ico.org.uk/for-organisations/uk-gdpr-guidance-and-resources/individual-rights/the-right-to-be-informed/checklists/ and special category data: https://ico.org.uk/for-organisations/uk-gdpr-guidance-and-resources/lawful-basis/special-category-data/what-is-special-category-data/ (checked 29 October 2026)
• ICO storage and access technologies, exceptions: https://ico.org.uk/for-organisations/direct-marketing-and-privacy-and-electronic-communications/guidance-on-the-use-of-storage-and-access-technologies/what-are-the-exceptions/ (checked 29 October 2026)
• ICO on the Data (Use and Access) Act 2025 (updated 19 June 2026): https://ico.org.uk/about-the-ico/what-we-do/legislation-we-cover/data-use-and-access-act-2025/the-data-use-and-access-act-2025-what-does-it-mean-for-organisations/ (checked 29 October 2026)
• ICO breach reporting: https://ico.org.uk/for-organisations/report-a-breach/personal-data-breach/ and data protection fee: https://ico.org.uk/for-organisations/data-protection-fee/ with tiers: https://ico.org.uk/for-organisations/data-protection-fee/data-protection-fee/ (checked 29 October 2026)
• GOV.UK Data (Use and Access) Act factsheet: https://www.gov.uk/government/publications/data-use-and-access-act-2025-factsheets/data-use-and-access-act-factsheet-ico (checked 29 October 2026)
• GOV.UK record keeping: https://www.gov.uk/running-a-limited-company/company-and-accounting-records and https://www.gov.uk/self-employed-records/how-long-to-keep-your-records and HMRC VAT Notice 700/21: https://www.gov.uk/guidance/record-keeping-for-vat-notice-70021 (checked 29 October 2026)
• Apple App Store Review Guidelines 4.5.4 and 5.1.1: https://developer.apple.com/app-store/review/guidelines/ (checked 29 October 2026)
• Google Play user data policy: https://support.google.com/googleplay/android-developer/answer/10144311 and Stripe privacy policy: https://stripe.com/gb/privacy (checked 29 October 2026)