Privacy Policy

Who we are

Iron Burger is responsible for how your personal information is used (the data controller). This policy covers our website, enquiries, catering bookings and event order services. For privacy questions or requests, email info@hadeedsmashburgers.co.uk.

Information we collect

Our booking form collects your name, organisation or event name, email, phone or WhatsApp number, event date, venue and postcode, event type, estimated burger quantity, outdoor space, parking or loading access, and any notes you provide. We also receive information you send by email. Please avoid unnecessary sensitive information in notes.

Event orders record ticket identifiers, quantity, status and timestamps. Staff-login security records include IP addresses, attempt times and outcomes. Website providers may process technical logs, including IP addresses, browser details and requests.

Why we use it

We use enquiry details to reply, prepare quotes and arrange catering; order details to prepare food and show collection status. Our lawful basis is taking steps at your request before a contract, or fulfilling our contract with you. For organisation contacts and general correspondence, we rely on our legitimate interest in responding and running our catering business. Security logs and staff access serve our legitimate interest in preventing misuse and keeping services working. Legal obligations apply where records must be kept by law.

Providing enquiry details is your choice, but without the required contact fields we cannot process the form. We do not make automated decisions about you with legal or similarly significant effects.

Providers and processing

The public booking form sends your details directly to Formspree, which may also collect hardware, IP address, browser, domain, access time and referrer information. Its privacy policy describes processing in the US and other countries where it operates. Vercel hosts the website; Supabase supports event orders and staff-access security. Email providers process correspondence. Information may be disclosed where legally required.

Providers may process information outside the UK. Where UK international transfer rules apply, a transfer requires an applicable adequacy regulation, appropriate safeguards or a permitted exception. Contact us for details of the arrangements applicable to your information.

Cookies

The website does not use analytics or advertising tracking. Staff sign-in sets the necessary hsb_staff cookie to authorise staff access. It is HttpOnly (unavailable to page scripts), expires after 12 hours and is cleared on sign-out. Blocking it prevents staff sign-in.

How long information is kept

Retention depends on the enquiry or booking, service delivery, necessary business records, legal obligations and resolving disputes. We keep information only as long as needed for those purposes. Provider logs and backups may have separate retention arrangements. Contact us about a particular record or deletion request.

Your rights

Under UK data protection law, you can request access, correction, deletion, restriction or portability of your information, and object to processing based on legitimate interests. Rights depend on the circumstances. If processing relies on consent, you can withdraw it. Email us to exercise your rights; responses are normally due within one month.

You can raise concerns with us and complain to the UK Information Commissioner's Office (ICO) at ico.org.uk/make-a-complaint.