This Privacy Policy explains how Cairngorm Research Limited (a company incorporated in Scotland with company number SC877959 and having its registered office at Summit House, 4–5 Mitchell Street, Edinburgh, EH6 7BD) (trading as Mint) ("We", "Us", "Our") collects, uses, and protects personal data when You use this website and app (the "Site/App"). We are registered with the Information Commissioner's Office (ICO) under registration number ZC110922.
In this Privacy Policy, "You" and "Your" refer to whoever is using the Site/App, whether as a Customer, as a Venue Operator, or as a visitor without an account, as the context requires.
We collect the following categories of personal data:
If You create a Customer account:
If You operate a Venue (restaurant) account:
If You use the "Notify kitchen" feature:
If You view a Menu Page without an account:
General:
| Purpose | Data Used | Lawful Basis |
|---|---|---|
| Creating and maintaining Your account, and allowing You to log in | Email address, password hash | Performance of a contract (Our Terms of Use, and Our Menu Terms if You have a Customer account) |
| Allergy profile filtering — showing You menu items that match Your allergens and/or allergens of persons on whose behalf you create and/or operate an allergy profile | Allergy profile data (names, allergens) | Explicit consent (Article 9 UK GDPR, as this is health data You and persons on whose behalf you create and/or operate an allergy profile choose to provide) |
| Operating a Venue's Account, Menu Page, and dashboard | Venue business name, address, postcode, email address, password hash, Menu Data | Performance of a contract (Our Business Terms) |
| Processing Venue subscription payments | Payment and billing information (held by Stripe, not by Us) | Performance of a contract (Our Business Terms) |
| Recording Your acceptance of Our Menu Terms, Terms of Use, and this Privacy Policy before You view allergen information | Acceptance token or account identifier, document version, IP address, timestamp | Legitimate interest in being able to demonstrate that safety information was presented to and accepted by visitors, and legal obligation to keep adequate records of consent |
| Sending a "Notify kitchen" alert to a Venue | Allergens, optional note | Performance of a contract / legitimate interest in providing the feature You requested |
| Looking up a Venue's postcode to determine its town and map location | Postcode | Performance of a contract (Our Business Terms) |
| Sending account, password reset, menu confirmation, and other operational emails | Email address, content of the email | Performance of a contract / legitimate interest in operating the Service |
| Preventing a Venue Operator We have banned from re-registering | Email address, business name, postcode, reason for ban | Legitimate interest in protecting the safety of Customers and preventing abuse of the Service |
| Responding to correspondence and support enquiries | Email address, content of Your message | Legitimate interest in responding to enquiries |
| Monitoring and maintaining the security and reliability of the Site/App, including admin access to the Service | Server logs, session data, admin login records | Legitimate interest in keeping the Site/App secure and operational |
We keep Your personal data for as long as Your account remains active, so that the Site/App can continue to provide the Service to You.
If You close Your account, or request deletion under Clause 6 below, We will delete or anonymise Your personal data, including allergy profile data and Menu Data, within a reasonable period — save that Venue Menu Data may be retained for a limited period following termination in accordance with Clause 7.6 of Our Business Terms (to allow for reactivation), after which it will be permanently deleted.
Records of acceptance of Our Menu Terms, Terms of Use, and this Privacy Policy (including anonymous, cookie-based acceptances by visitors without an account) are currently retained indefinitely, as We rely on them to demonstrate that the relevant safety information was presented to and accepted by visitors to Our Menu Pages. We are reviewing an appropriate retention period for these records and will update this Privacy Policy once one is set.
Where We ban a Venue Operator from re-registering with Us, We retain a record of the relevant email address, business name, postcode, and reason for the ban for as long as reasonably necessary to prevent re-registration.
Server logs are retained for a limited period (typically no more than 12 months) for security and troubleshooting purposes, after which they are automatically deleted or overwritten.
We share personal data with the following categories of third party, solely to the extent necessary to operate the Site/App:
We do not sell Your personal data, and We do not share it with third parties for their own marketing purposes.
Our hosting and service providers may process data in locations outside the UK as part of their global infrastructure, although Our database is hosted in the UK (London). Where any of Our service providers process personal data outside the UK, We require that appropriate safeguards recognised under UK data protection law are in place before any such transfer takes place.
Under UK GDPR, You have the following rights in relation to Your personal data:
To exercise any of these rights, please contact Us at contact@mintmenu.co.uk. You also have the right to lodge a complaint with the Information Commissioner's Office (ICO) at ico.org.uk if You believe Your data protection rights have been infringed.
Our use of cookies and similar technologies is described in Our Cookie Policy.
We may change, update, add to or delete from this Privacy Policy from time to time without prior notice. Changes take effect when posted to the Site/App.
This Privacy Policy is governed by the law of Scotland. Any disputes arising in connection with it shall be subject to the exclusive jurisdiction of the courts of Scotland.