Privacy Policy
Privacy Policy
1. Introduction
Burger Boi is a California-inspired smashed burger brand with restaurants, kiosks and delivery kitchens across the UK. We know that “A Californian Dream in Every Bite” is a promise about food — we take the promise about your personal information just as seriously.
This Privacy Policy explains, in plain English:
- what personal information we collect about you;
- why we collect it and what legal right we have to use it;
- who we share it with;
- how long we keep it; and
- what control you have over it.
We have written this policy to comply with the UK General Data Protection Regulation (UK GDPR) and the Data Protection Act 2018, both as amended by the Data (Use and Access) Act 2025 (the main data protection provisions of which came into force on 5 February 2026), together with the Privacy and Electronic Communications (EC Directive) Regulations 2003 (PECR).
If anything here is unclear, please contact us using the details in section 16. We would rather explain something twice than leave you guessing about your own data.
2. Who we are and how to contact us
Burger Boi is a trading name of Burger Boi Franchise Limited, a company registered in England and Wales (company number 13801940), whose registered office is at 1 George Street, Wolverhampton, England, WV2 4DG.
For the purposes of UK data protection law, Burger Boi Franchise Limited is the data controller for the personal information described in this policy, except where this policy says otherwise (see section 4).
| How to reach us | Details |
|---|---|
| Privacy enquiries and data rights requests | privacy@burgerboi.co.uk |
| General enquiries | hello@burgerboi.co.uk |
| A specific restaurant | Use the contact details on our Locations page |
| Post | Data Protection Enquiries, Burger Boi Franchise Limited, 1 George Street, Wolverhampton, WV2 4DG |
We are not required by law to appoint a Data Protection Officer, and we have not appointed one. Day-to-day responsibility for data protection sits with our senior management team, who can be reached at either address above.
We are registered with the Information Commissioner’s Office as a data controller. If you need our register entry for your own records, email us and we will send it.
3. A quick summary
If you only read one section, read this one.
- We do not sell your personal information. Ever. Not to advertisers, not to data brokers, not to anyone.
- We do not take food orders or card payments on burgerboi.co.uk. Orders are placed in our restaurants, through the Burger Boi app, or through Uber Eats. Each of those channels handles your data slightly differently, and section 6 explains how.
- The main things we collect through the website are your email address if you sign up for offers, your details if you make a franchise enquiry, and technical and analytics information about your visit.
- The main things we collect through the app are your account details, your order history, your delivery address, your device information and your loyalty points balance.
- You can opt out of marketing at any time using the unsubscribe link in any email, your app settings, or by emailing us.
- You have a full set of legal rights over your information, including the right to a copy of it and the right to ask us to delete it. Section 13 explains how to use them.
4. What this policy does and does not cover
This policy covers:
- your use of burgerboi.co.uk;
- your use of the Burger Boi mobile app;
- marketing communications we send you;
- franchise enquiries and job applications made through our website;
- your visits to Burger Boi restaurants operated by us.
This policy does not cover:
4.1 Orders placed through Uber Eats. When you order Burger Boi through Uber Eats, Uber is the controller of the account, payment and delivery data you give it. We receive only what we need to make and hand over your food — typically your first name, the order contents, any allergen or preparation notes, and the order number. We do not receive your full card details. Uber’s own privacy notice governs the rest, and you should read it alongside this policy.
4.2 Restaurants operated by franchisees. Burger Boi operates as a franchise network. Some restaurants are run by us and others by independent franchisee companies under licence. Where a restaurant is franchisee-operated, that franchisee is the controller of the personal information it collects in and about that restaurant — for example CCTV footage, in-restaurant complaints, and the employment records of its own team. We remain the controller of brand-level data such as the website, the app, the loyalty scheme and our central marketing list. If you are not sure who controls a particular piece of information, ask us and we will tell you and point you in the right direction.
4.3 Other companies’ websites and platforms. Our website and social media accounts link to third parties — Uber Eats, Facebook, Instagram, TikTok, the Apple App Store, Google Play and job listing platforms. We are not responsible for their privacy practices. Please read their notices before giving them your information.
5. Where your information comes from
We collect personal information:
- directly from you — when you fill in a form, create an app account, order in a restaurant, apply for a job, enquire about a franchise, enter a competition, message us on social media, or make a complaint;
- automatically — when you use the website or app, through cookies, pixels and similar technologies (see our Cookie Policy) and through server logs; and
- from third parties — from Uber Eats when you order through it, from our app and ordering platform provider, from our payment provider confirming that a payment succeeded, from recruitment platforms, and from social media platforms when you interact with our pages or advertising.
6. What personal information we collect, why, and our lawful basis
Under the UK GDPR we must have a “lawful basis” for every use of your personal information. The tables below set that out purpose by purpose.
6.1 Visiting our website
| What we collect | Why | Lawful basis |
|---|---|---|
| IP address, approximate location derived from it, device and browser type, operating system, screen size, referring website, pages viewed, time on page, links clicked | To serve the website, keep it secure, detect faults and abuse, and understand which pages and menu items people care about | Legitimate interests — running and improving our own website and protecting it from misuse. For non-essential cookies we also rely on your consent under PECR. |
| Cookie and consent preferences | To remember your choices so we do not ask again on every page | Legal obligation (PECR requires us to be able to demonstrate consent) and legitimate interests |
Full detail on the cookies and pixels involved is in our Cookie Policy.
6.2 Signing up for offers and our newsletter
| What we collect | Why | Lawful basis |
|---|---|---|
| Name, email address, mobile number (if given), nearest or preferred restaurant, sign-up date, and the IP address and timestamp at which you signed up | To send you news, offers, new menu launches and competitions, and to keep proof that you asked to hear from us | Consent, which you gave by submitting the sign-up form and can withdraw at any time |
| Whether you opened an email, and which links you clicked | To see which offers are worth sending and stop sending the ones nobody wants | Consent |
Our sign-up and franchise forms are hosted by HighLevel (leadconnectorhq.com), a customer relationship and marketing platform that acts as our processor.
6.3 Using the Burger Boi app
The Burger Boi app is built on the Food2Go ordering platform, developed and operated for us by Arkitec Software Ltd as our processor.
| What we collect | Why | Lawful basis |
|---|---|---|
| Name, email address, mobile number, and your password stored in encrypted form | To create and secure your account | Contract — we cannot give you an account without it |
| Delivery address and, if you allow it, precise device location | To show the right restaurant and menu, calculate delivery, and get your food to the right door | Contract. Precise location is used only with your consent, given through your device settings and withdrawable there at any time. |
| Order history, basket contents, table number for table ordering, collection or delivery choice, and preparation and allergen notes | To take, prepare and deliver your order, and to handle any problem with it | Contract |
| Payment confirmation, card type, last four digits and transaction reference | To take payment and process refunds | Contract, and legitimate interests in preventing fraud |
| Loyalty points earned and redeemed, and rewards available to you | To run the loyalty scheme | Contract |
| Device identifier, app version, crash and performance diagnostics, and push notification token | To keep the app working, fix crashes and send order updates | Legitimate interests. Marketing push notifications are sent only with your consent. |
We never see or store your full card number. Card details are captured and processed by our payment service provider under the PCI DSS security standard.
6.4 Ordering and eating in our restaurants
| What we collect | Why | Lawful basis |
|---|---|---|
| Order details, table number and payment confirmation | To serve you and take payment | Contract |
| Allergen and dietary requirements you tell us about | To prepare your food safely and to comply with food information law | Contract, and legal obligation under the Food Information Regulations 2014. Where this information reveals a health condition we rely on Article 9(2)(a) UK GDPR — your explicit consent, given when you tell us. |
| Wi-Fi connection details, if you use guest Wi-Fi | To provide the connection and keep the network secure | Legitimate interests |
6.5 Franchise enquiries
| What we collect | Why | Lawful basis |
|---|---|---|
| Name, email, phone number, location of interest, available investment level, business background, and anything else you put in the form | To send you our franchise pack, assess suitability and discuss the opportunity | Legitimate interests in responding to a business enquiry you made, and steps towards a contract |
Franchise enquiry data is held in HighLevel and shared internally with our franchise development team only.
6.6 Applying for a job
| What we collect | Why | Lawful basis |
|---|---|---|
| Name, contact details, CV, work history, references and interview notes | To assess your application and make a hiring decision | Steps towards a contract, and legitimate interests in recruiting fairly |
| Right to work documents and immigration status | To meet our duty to prevent illegal working | Legal obligation under the Immigration, Asylum and Nationality Act 2006 |
| Any accessibility or health information you volunteer | To make reasonable adjustments for interview | Explicit consent, and our obligations under the Equality Act 2010 (Article 9(2)(b) UK GDPR) |
If we offer you a job, your information moves into our HR records and a separate employee privacy notice will apply.
6.7 CCTV
CCTV operates in and around our restaurants for the prevention and detection of crime, for the safety of customers and team members, and to investigate accidents and incidents. Signs at each site tell you when CCTV is in use and identify the operator, which will be either Burger Boi or the franchisee that runs that restaurant.
Footage is normally kept for 31 days and then automatically overwritten, unless it is needed for an ongoing investigation, an insurance claim or legal proceedings. It is shared with the police, our insurers or our legal advisers only where there is a proper reason to do so. Our lawful basis is legitimate interests in protecting our people, our customers and our property.
To request footage of yourself, email privacy@burgerboi.co.uk with the restaurant, the date and the approximate time. Please ask promptly, because footage is overwritten on the cycle above.
6.8 Complaints, feedback and social media
| What we collect | Why | Lawful basis |
|---|---|---|
| Your name, contact details, the restaurant involved, what happened, and any photographs or receipts you send | To investigate and put things right, and to spot patterns we need to fix | Legitimate interests in handling complaints properly, and legal obligation where food safety or allergens are involved |
| Public posts, comments, reviews and direct messages on Facebook, Instagram and TikTok | To respond to you and moderate our own pages | Legitimate interests |
Where a complaint concerns an allergic reaction or a food safety incident, we may need to share details with the local authority environmental health team or the Food Standards Agency. That is a legal obligation and we cannot ask your permission first.
6.9 Competitions and promotions
When you enter a competition or claim a promotional offer, we collect your entry details, your contact information and, for winners, whatever we need to hand over the prize. Our basis is contract — performing the competition terms — and consent where we ask to publish your name as a winner.
7. Children and young people
Our website and app are aimed at general audiences, not children. We do not knowingly create app accounts for, or send marketing to, anyone under 13, which is the age at which a child can consent to an information society service on their own behalf under Article 8(1) of the UK GDPR. This threshold may change — the Children’s Wellbeing and Schools Act 2026 allows it to be set anywhere between 13 and 16 by regulations — and we will update this policy if it does.
We design our online services with the ICO’s Age Appropriate Design Code (the Children’s Code) in mind, which means we default to the least intrusive settings and do not use children’s data for behavioural advertising.
If you believe a child under 13 has given us personal information, email privacy@burgerboi.co.uk and we will delete it.
8. Marketing: what we will and will not send you
- Email and SMS marketing. We send these only where you have opted in, or where you have bought from us and we are contacting you about similar food and offers under the “soft opt-in” permitted by PECR. Every message contains a one-click unsubscribe.
- Push notifications. Order updates are part of the service. Promotional notifications are sent only if you allow notifications, and you can turn them off in your device settings at any time.
- Social media and online advertising. We advertise on social platforms and may show adverts to people who have visited our website, and to audiences that resemble them. This relies on advertising cookies and pixels, and therefore on your cookie consent — withdraw consent through our cookie settings and we stop.
- Post. We do not run direct mail campaigns.
Withdrawing consent is free, immediate and has no effect on your ability to order. Use the unsubscribe link, change your app settings, or email privacy@burgerboi.co.uk. Please allow up to 72 hours for campaigns already in the queue to stop. We keep a permanent suppression record of your email address or number so that we do not accidentally add you back.
9. Who we share your information with
We share personal information only where we need to, and only with organisations bound to protect it.
| Category | Who and what they do |
|---|---|
| App and ordering platform | Arkitec Software Ltd / Food2Go — runs the Burger Boi app, accounts, ordering and loyalty (processor) |
| Marketing and CRM platform | HighLevel (leadconnectorhq.com) — hosts our sign-up and franchise forms and sends our campaigns (processor) |
| Delivery marketplace | Uber Eats — independent controller for orders placed on its platform (see section 4.1) |
| Payment processing | Our card acquirer and payment gateway — processor for the transaction, and independent controller for its own fraud prevention |
| Advertising and analytics | Social advertising platforms and our website analytics provider — see our Cookie Policy |
| Website hosting and IT | Our web host, website plugin providers, email provider, backup and security services (processors) |
| Franchisees | Independent Burger Boi franchisees, for order fulfilment and complaint handling at their restaurant |
| Professional advisers | Lawyers, accountants, auditors and insurers, where needed |
| Authorities | The police, local authority environmental health teams, the Food Standards Agency, HMRC, the ICO and the courts, where we are legally required or permitted to disclose |
| Corporate transactions | A buyer or investor, if we sell or reorganise the business — under confidentiality obligations |
Every processor is engaged under a written contract that meets Article 28 UK GDPR and requires them to act only on our instructions and keep your data secure.
We do not sell your personal information, and we do not share it with third parties for their own marketing.
10. Sending information outside the UK
Some of our suppliers are based outside the UK, or use sub-processors that are. Where personal information leaves the UK, we make sure one of the following protections is in place, as required by Chapter V of the UK GDPR:
- the country has UK adequacy regulations — for example, the EEA;
- the transfer uses the International Data Transfer Agreement (IDTA) or the UK Addendum to the EU Standard Contractual Clauses, backed by a transfer risk assessment; or
- for transfers to certified organisations in the United States, the UK Extension to the EU–US Data Privacy Framework (the “UK–US Data Bridge”).
You can ask us for details of the safeguards we rely on for a specific supplier by emailing privacy@burgerboi.co.uk.
11. How we keep your information safe
We use technical and organisational measures appropriate to the risk, including:
- encryption in transit (TLS/HTTPS across the website and app) and encryption at rest where our providers support it;
- hashed passwords — we never store your app password in readable form;
- role-based access control, so team members see only what their job requires;
- outsourced card processing to a PCI DSS compliant provider, so full card numbers never touch our systems;
- multi-factor authentication on administrative accounts;
- regular patching, backups and monitoring of the website and app;
- training on data protection and food safety confidentiality; and
- a personal data breach procedure, under which we assess any incident and, where it is likely to result in a risk to your rights, report it to the ICO within 72 hours and tell you if the risk is high.
No system is completely secure. If you think your app account has been compromised, change your password and tell us straight away.
12. How long we keep your information
We keep personal information only as long as we need it. Our standard periods are:
| Information | Retention period | Reason |
|---|---|---|
| Marketing list entries (active subscriber) | Until you unsubscribe, then 24 months of inactivity before deletion | Consent goes stale, and PECR expects it to be current |
| Suppression list (unsubscribed email or number) | Indefinitely, in minimal form | So that we never contact you again by mistake |
| App account and profile | Life of the account, then 12 months after your last order or a closure request | Handling disputes, refunds and chargebacks |
| Order history and loyalty records | 7 years from the transaction | HMRC requires records for six years plus the current year |
| Payment and transaction records | 7 years | Tax and accounting law |
| Delivery addresses | 12 months after last use | Repeat orders and dispute resolution |
| Franchise enquiries not taken forward | 24 months from last contact | Enquiries often revive; after that they are stale |
| Unsuccessful job applications | 6 months from the outcome | Equality Act 2010 tribunal time limits, and future vacancies |
| Right to work documents for unsuccessful applicants | Deleted at the point of rejection | No longer needed |
| Complaints and incident records | 3 years; 7 years where food safety, allergens, injury or insurance is involved | Limitation periods and insurance requirements |
| CCTV footage | 31 days, unless flagged for an investigation | Standard security practice and data minimisation |
| Website server logs | 12 months | Security investigation |
| Cookie consent records | 12 months, or until you change your choice | Demonstrating consent under PECR |
| Competition entries from non-winners | 3 months after the closing date | Handling challenges to the result |
Where we no longer need information but cannot delete it immediately — for example because it sits in an encrypted backup — we isolate it and delete it when that backup expires. We may also keep permanently anonymised statistics, which are no longer personal information.
13. Your rights over your information
Under the UK GDPR you have the following rights, and they are free to use.
- Right to be informed — to know what we do with your data. This policy is how we meet it.
- Right of access — to get a copy of the personal information we hold about you, and to know where it came from and who we shared it with.
- Right to rectification — to have inaccurate information corrected and incomplete information completed.
- Right to erasure (“right to be forgotten”) — to have your information deleted where we no longer have a good reason to keep it. This right is not absolute; we can refuse where we must keep records by law, such as transaction records for HMRC.
- Right to restrict processing — to have us pause our use of your information while a dispute about it is resolved.
- Right to data portability — to receive the information you gave us in a machine-readable format, where we process it by consent or under a contract by automated means.
- Right to object — to object to processing based on legitimate interests. Where you object to direct marketing we must stop, full stop, with no balancing exercise.
- Rights around automated decision-making — see section 14.
- Right to withdraw consent — at any time, where consent is our basis.
- Right to complain — see section 15.
How to make a request. Email privacy@burgerboi.co.uk or write to us at the postal address in section 2. Tell us which right you want to use and give us enough detail to find your records — for example the email address on your app account, or the restaurant, date and approximate time of a visit for CCTV.
What happens next. We will:
- acknowledge your request and, where necessary, ask for proof of identity so that we do not hand your data to the wrong person;
- ask a clarifying question if your request is broad — under the Data (Use and Access) Act 2025 the response clock pauses while we reasonably wait for that clarification;
- respond within one month, extendable by up to two further months for complex or numerous requests, in which case we will tell you why within the first month;
- carry out a reasonable and proportionate search for your data, which is the standard set by the Data (Use and Access) Act 2025; and
- explain our reasons if we cannot fully comply, and tell you how to challenge that.
Other people’s information. If your request would reveal someone else’s personal information — a bystander in CCTV footage, for example — we will redact or blur it before disclosure.
14. Automated decision-making and profiling
We do not make decisions about you that have legal or similarly significant effects using solely automated means.
We do use limited automation to make the service work:
- fraud and abuse checks on payments and promotional codes, which may automatically flag an order for manual review;
- segmentation of our marketing list, for example by nearest restaurant or by which menu items you have bought, so that offers are relevant rather than random; and
- loyalty point calculation, which is arithmetic rather than a judgement about you.
If an automated check ever blocks something important to you, contact us and a person will look at it.
15. Complaints
Start with us. If you are unhappy with how we have handled your personal information, email privacy@burgerboi.co.uk with “Data protection complaint” in the subject line. Under the Data (Use and Access) Act 2025 — the complaints provisions of which came into force on 19 June 2026 — we will acknowledge your complaint within 30 days, investigate it without undue delay, keep you updated on progress, and tell you the outcome.
Then the regulator. You can also complain to the UK’s data protection regulator, the Information Commissioner’s Office (ICO). You do not have to come to us first, though it usually resolves things faster.
- Website: ico.org.uk/make-a-complaint
- Helpline: 0303 123 1113
- Post: Information Commissioner’s Office, Wycliffe House, Water Lane, Wilmslow, Cheshire, SK9 5AF
You also have the right to seek a remedy through the courts, and to claim compensation for damage caused by a breach of data protection law.
16. Contact us
| Reason | Contact |
|---|---|
| Data protection, privacy and data rights | privacy@burgerboi.co.uk |
| General enquiries | hello@burgerboi.co.uk |
| Marketing opt-out | The unsubscribe link in any email, your app settings, or privacy@burgerboi.co.uk |
| Franchise enquiries | burgerboi.co.uk/franchise |
| Careers | burgerboi.co.uk/career |
| A specific restaurant | burgerboi.co.uk/locations |
| Post | Data Protection Enquiries, Burger Boi Franchise Limited, 1 George Street, Wolverhampton, WV2 4DG |
17. Changes to this policy
We review this policy at least once a year, and whenever we change how we use personal information.
The “Last updated” date at the top always reflects the current version. If we make a change that materially affects your rights, we will tell app account holders and marketing subscribers directly by email and place a notice on the website before the change takes effect. We keep previous versions and will send you one on request.
Related policies: Terms & Conditions · Cookie Policy · Allergens Information