Privacy Policy

Last updated: May 2026

Welcome to Bankuet Limited's website (www.bankuet.co.uk) (the “Website”). Thank you for choosing to be part of our community at Bankuet Limited (referred to as “Bankuet”, “we”, “us”, or “our” in this Privacy Policy).

We are committed to protecting your personal information and your right to privacy. When you visit our Website and use our services, you trust us with your personal information. We take your privacy very seriously. If you have any questions or concerns about this Privacy Policy, or our practices with regards to your personal information, please contact our Data Protection Officer (DPO) at robin@bankuet.co.uk.

In this Privacy Policy, we seek to explain to you in the clearest way possible what information we collect, how we use it and what rights you have in relation to it. We hope you take some time to read through it carefully, as it is important.

This Privacy Policy applies to all personal information collected through our Website, and/or any related services, sales, marketing or events (we refer to them collectively in this Privacy Policy as the “Services”).

Under UK data protection law, Bankuet is the data controller. We also act as a joint data controller alongside Bankuet Foundation in respect of certain data processing activities. Under this arrangement, Bankuet is primarily responsible for complying with the obligations under applicable data protection laws, including the General Data Protection Regulation. However, you may exercise your data subject rights against either Bankuet or Bankuet Foundation.

Please read this Privacy Policy carefully as it will help you make informed decisions about sharing your personal information with us.

Table of Contents

1. What Information Do We Collect?

In this section, we explain what personal information we collect about you, how we use it, and the legal basis for using your personal information in this way.

Personal information you disclose to us

We collect personal information that you voluntarily provide to us when registering through the Website and/or the Services expressing an interest in obtaining information about us or our products and services, when participating in activities on the Services or otherwise contacting us.

The personal information that we collect depends on the context of your interactions with us, the Website and the Services, the choices you make and the products and features you use. The personal information we collect can include the following:

• Identity and Contact Information. We collect your first name, last name, phone numbers, email address, business email, business phone number, social media account information; and other similar data.
• Personal Information Provided by You. We collect data collected from surveys; and other similar data.
• Campaign Information. When you sign up for a campaign, we will collect information to help us set this up. We will ask you for the campaign name, the type of campaign, your fundraising target, and the envisaged fundraising end date. We will also collect information on your organisation, including the type of organisation, your organisation's name and phone number, the number of centres, any food network affiliations, and if applicable, your organisation's charity number. You will also have the chance to provide us with the name of your organisation's name and where you are based.
• Donation Information. When you make a donation, we will ask you for the donation amount and whether the donation is a single or monthly payment to help facilitate the donation.
• Payment Data. We collect data necessary to process your payment if you make purchases, such as your payment instrument number (such as a credit card number), the security code associated with your payment instrument, and your billing address.
  
  All payment data is stored by third parties, Stripe, PayPal and GoCardless. Please refer to their Privacy Policy for more information on the processing of your payment data:
  • Stripe: https://stripe.com/gb/privacy
  • PayPal: https://www.paypal.com/uk/legalhub/paypal/privacy-full
  • GoCardless: https://gocardless.com/privacy/payers/
  
  All personal information that you provide to us must be true, complete and accurate, and you must notify us of any changes to such personal information.
• Location Data (only if you opt-in). We collect your precise device location where you grant us permission via the 'Use my location' feature on the food bank map on our Website. We may retain this information for service improvement purposes.

Information automatically collected

• Technical and Browser Information. We automatically collect certain information when you visit, use or navigate the Services. This information does not reveal your specific identity (like your name or contact information) but may include device and usage information, such as your IP address, browser and device type and characteristics, operating system, language preferences, referring URLs, device name, country and approximate location inferred from your IP address, information about how and when you use our Services and other technical information, and usage data (collected via Google Analytics GA4 and Beacon CRM). This information is primarily needed to maintain the security and operation of our Services, and for our internal analytics and reporting purposes.
• Online Identifiers. We collect cookie identifiers, or others such as the ones used for analytics and marketing; and other similar data.

Lawful bases

We may process or share your personal information based on one or more of the following legal bases:

• Consent: We may process your data if you have given us specific consent to use your personal information in a specific purpose.
• Legitimate Interests: We may process your data when it is reasonably necessary to achieve our legitimate business interests or those of third parties.
• Performance of a Contract: Where we have entered into a contract with you, we may process your personal information to fulfil the terms of our contract.
• Legal Obligations: We may disclose your information where we are legally required to do so in order to comply with applicable law, governmental requests, a judicial proceeding, court order, or legal process, such as in response to a court order or a subpoena (including in response to public authorities to meet national security or law enforcement requirements).

2. How Do We Use Your Information?

We use personal information collected via our Website and/or Services for a variety of purposes described below. We indicate the specific legal bases we rely on next to each purpose listed below.

We may also use your information to comply with our legal obligations (for example, related to tax and accounting, etc).

3. Who Will Your Information Be Shared With?

We may share your personal information with our joint controller, Bankuet Foundation. We may also share your personal information with:

• Vendors, Consultants and Other Third-Party Service Providers. We may share your data with third party vendors, service providers, contractors or agents who perform services for us or on our behalf and require access to such information to do that work. Examples include: payment processing, data analysis, email delivery, hosting services, customer service and marketing efforts. We may allow selected third parties to use tracking technology on the Services, which will enable them to collect data about how you interact with the Services over time. This information may be used to, among other things, analyse and track data, determine the popularity of certain content and better understand online activity. Unless described in this Privacy Policy, we do not share, sell, rent or trade any of your information with third parties for their promotional purposes. We have contracts in place with our data processors. This means that they cannot do anything with your personal information unless we have instructed them to do it. They will not share your personal information with any organisation apart from us. They will hold it securely and retain it for the period we instruct.
• Business Transfers. We may share or transfer your information in connection with, or during negotiations of, any merger, sale of company assets, financing, or acquisition of all or a portion of our business to another company.
• Professional advisers. We may share your data with our auditors, legal advisers and other professional advisers where necessary to comply with our legal obligations.
• Legal requirement. We may share your data if required to do so by court order or if we are under a duty to disclose your information to comply with (and/or where we believe we are under a duty to comply with) any legal obligation. This includes exchanging information with law enforcement agencies, regulators, or other similar government bodies.
• Legitimate interests. We may share your data with any person to whom disclosure is necessary for us to protect our rights, property, or safety, our clients, or other third parties, and to enforce our rights under this Privacy Policy or under any agreement with you. This includes exchanging information with other companies and organizations for the purposes of detecting and preventing fraud and cyber-crime or other crime.
• Marketing. We and/or our third party marketing partners may use the personal information you send to us for our marketing purposes, if this is in accordance with your marketing preferences. You can opt-out of our marketing emails at any time (see section 12 below for more information on how to do this).

We may also share and disclose your information with the following third parties. We have categorized each party so that you can easily understand the purpose of our data collection and processing practices.

4. Do We Use Cookies and Other Tracking Technologies?

Yes, we may use cookies and similar tracking technologies (like web beacons and pixels) provided by your browser or associated applications to access, collect and store your information. Information about how we use such technologies and how you can refuse non-essential cookies can be found in our cookie banner here.

5. How We Use Mapbox

We use Mapbox for the purpose of providing better service. This Website and the Facebook application use Mapbox APIs. By using our Mapbox API Implementation, you agree to be bound by Mapbox's Terms of Service. You may find the Mapbox APIs Terms of Service here. To better understand Mapbox's Privacy Policy, please refer to this link.

6. How Long Do We Keep Your Information?

We will only keep your personal information for as long as it is necessary for the purposes set out in this Privacy Policy, unless a longer retention period is required:

• in the event of a complaint;
• if we reasonably believe there is a prospect of legal proceedings;
• if we are aware of pending or ongoing legal proceedings; or
• in some circumstances, if applicable law says we must (for example, to comply with tax, accounting or other legal requirements).

When we have no ongoing lawful basis or legitimate business need to process your personal information, we will either delete or anonymize it to create anonymised data (like aggregated statistics), or, if this is not possible (for example, because your personal information has been stored in backup archives), then we will securely store your personal information and isolate it from any further processing until deletion or anonymization is possible.

If you opt in to marketing from us, or we otherwise have a legal basis to send you marketing, we will keep your relevant personal information for as long as you are receiving marketing. If you later decide to opt out, we may keep a record of your opt-out or objection so we can respect your preferences and demonstrate our compliance.

7. Where Do We Store Your Information?

Bankuet is based in the United Kingdom (“UK”), and provides its services within the UK. However, we may transfer your personal information outside the UK and some of our third party service providers (e.g., Google, Facebook, and Stripe) may also process your data outside the UK:

• To store your personal information;
• To provide our Services to you;
• To support our operations and management; and
• Where we are legally required to do so.

Where this occurs, we will have legal protections in place to safeguard personal data transfers in compliance with data protection laws. These legal protections may include:

• UK Addendum to the EU Standard Contractual Clauses (SCCs); and
• Adequacy decisions by the UK Government.

For more information, please contact us via the details provided in section 14 below.

8. How Do We Keep Your Information Safe?

We have implemented appropriate technical and organizational security measures designed to protect the security of any personal information we process, including:

• SSL encryption;
• Password-protected systems;
• Access restrictions; and
• Staff training on data handling.

We seek to always comply with applicable data protection and privacy laws. However, please also remember that we cannot guarantee that the internet itself is 100% secure. Although we will do our best to protect your personal information, transmission of personal information to and from our Websites and Services is at your own risk. You should only access the Website and Services within a secure environment.

If you have any concerns that your personal information has been put at risk, please contact us via the details provided in section 14 below.

9. Do We Collect Information From Persons Under 18?

We do not knowingly collect or solicit data from or market to persons under 18 years of age. By using the Website or Services, you represent that you are at least 18 or that you are the parent or guardian of such a person under the age of 18 and consent to their use of the Website or Services. If we learn that personal information from users less than 18 years of age has been collected, we will deactivate their account via the web app and take reasonable measures to promptly delete such data from our records. If you become aware of any data we have collected from persons under age 18, please contact us via the contact details provided in section 14 below.

10. What Are Your Privacy Rights?

You have the following rights in certain circumstances:

• to be provided with a copy of your personal information;
• to ask us to correct or delete your personal information;
• to ask us to restrict how we use your personal information (for example, while we investigate your concerns about the accuracy of data, or lawfulness of a certain use);
• to object to the further use of your personal information, including the right to object to direct marketing from us;
• to request that personal data you provided to us be moved to a third party; and
• where you have consented, to withdraw consent.

If you would like to exercise any of the above rights in relation to any personal information we hold about you, or if you have questions or comments about your privacy rights, you may contact us via the contact details set out in section 14 below.

If you believe we are unlawfully processing your personal data or if you have any concerns, you also have the right to lodge a complaint with the Information Commissioner's Office (“ICO”). You can visit the ICO's website here.

11. How Can You Review, Update, or Delete the Data We Collect From You?

To request to review, update, or delete any personal information of yours that we hold, please submit a request form by clicking here or get in touch with us using the contact information provided in section 14 below. We will aim to respond to your request within 30 days.

If you would at any time like to review or change the information in your account via the web app or terminate your account, you can contact us using the contact information provided in section 14 below.

Upon your request to terminate your account, we will deactivate or delete your account and information from our active databases. However, some information may be retained in our files where necessary to prevent fraud, troubleshoot problems, assist with any investigations, enforce our Terms of Use and/or to comply with legal or regulatory requirements.

We are required by HMRC to keep Gift Aid declarations and related records for at least six years for tax and audit purposes. Where we are required to retain personal data to comply with legal or tax obligations (for example, Gift Aid records), requests for erasure may be restricted.

12. Marketing Communications

If you provided us with your consent or we otherwise have a legal basis as set out in section 2, we may send you marketing emails.

You can unsubscribe from our marketing email list at any time by clicking on the 'unsubscribe' link in the emails that we send you or by contacting us using the details provided in section 14 below. You will then be removed from the marketing email list.

However, we will still need to send you service-related emails that are necessary for the administration and use of your account. To opt-out of these emails, you may contact us using the contact information provided in section 14 below.

13. Do We Make Updates to This Policy?

We may update this Privacy Policy from time to time. The updated version will be effective as soon as it is accessible on the Website, unless we state otherwise.

If we make material changes to this Privacy Policy, we will notify you of those changes, for example by prominently posting a notice on our Website or by contacting you directly where appropriate. We encourage you to review this Privacy Policy frequently to remain informed about how we protect your information.

14. How Can You Contact Us About This Policy?

If you have questions or feedback for us about this Privacy Policy, you may contact our Data Protection Officer (DPO), Robin Ferris, by sending an email to robin@bankuet.co.uk, or by post to: