Your data, handled with care.

Last updated 28 October 2026

The short version

We collect only what we need to take, cook and deliver your order, run your account, and run our partner programme.
We don't sell your data. We only use tracking or advertising cookies if you've agreed to them, and we use none today.
Card payments are handled by Stripe. We never see or store your full card number.
You can ask to see, correct or delete your data at any time.

01Who we are

Prendy's is the controller of the personal data described here. Contact us about privacy at hello@prendys.com. Our registered business details are on our terms page.

02What we collect and why

Who	What we collect	Why, and our lawful basis
Customers	Name, email, password (stored only as a secure scrambled hash), delivery address, phone number, delivery notes, what you order, order history and progress	To take, cook, deliver and support your order and run your account (contract). To keep sales and tax records (legal obligation).
Payments	Stripe gives us the payment's status, amount and reference. We never receive your full card number.	To take payment and handle refunds (contract), and to prevent fraud (legitimate interests).
Rep codes	Which rep, if any, referred your order	To pay that rep's commission (legitimate interests). Reps see your first name and town, not your full address or phone.
Franchise applicants	Everything you enter on our partner application: contact details, location, experience, availability, social media handles, transport, right to work and the other answers you give	To assess your application and contact you about it (steps before a contract, and legitimate interests).
Reps	Contact details, home address, bank account details, tax status and UTR, your signed agreement with your typed name, drawn signature, date, IP address and device details	To run your agreement and pay you (contract), and to keep tax and contract records (legal obligation). Bank details and UTR are encrypted and only the owner can view them.
Suppliers	Business and contact details, food registration and hygiene information, food safety documents and certificates, bank details, invoices, order confirmations, and your signed supplier agreement with its signing record (typed name, drawn signature, date, IP address and device details)	To approve you as a supplier, place and pay for orders, and keep food safety and traceability records (contract, legal obligation and legitimate interests). Bank details are encrypted and only the owner can view them; each view is logged.
Trainers you share with	If you invite your personal trainer or coach, the name, email and gym you give us, and whether they accepted. If they ask to hear about becoming a rep, we note that	To send the invite and let them see your meals, at your request (consent, which you can withdraw by stopping sharing). We only contact a trainer about becoming a rep if they tick the box asking us to.
Staff	Name, email, role, rota and tasks completed	To run the kitchen and deliveries (contract and legitimate interests).
Website visitors	An anonymous count of page views per day. No cookies, no IP address, nothing that identifies you.	To understand which pages are used (legitimate interests).

Please don't put health details in delivery notes. If you need to tell us about an allergy or medical need, email us and we'll use it only to keep you safe.

03Cookies and storage on your device

Sign-in cookie (pz_sess): keeps you signed in. It's essential, so it doesn't need consent.
Storage in your browser: we remember your box in progress, a rep link you arrived with (for 30 days), a draft franchise application, and allergen filters you've chosen. These stay on your device and you can clear them in your browser settings.
Prendy's Radio: if you tap the radio in the shop, Spotify's player loads and Spotify may set its own cookies, under Spotify's cookie policy. Nothing from Spotify loads until you tap it.
We don't use advertising or tracking cookies. If we ever add them, we'll ask first.

We only share what each service needs to do its job:

Stripe, to process payments.
Your trainer or coach, only if you invite them: they see your first name and last initial, what you ordered in the last 8 weeks, its nutrition and your protein target. Never your address, phone or payments. You can stop sharing at any time in My account.
Our courier or delivery driver, who receives your name, delivery address, phone number and delivery notes.
Our hosting provider, who runs the server our website and database are on.
Our email provider, when we send emails (for example supplier orders).
Our accountant and HMRC, for tax records, and the police, courts or regulators (such as the Food Standards Agency or the council) where the law requires it, for example during a food safety recall.

We never sell your personal data. Some providers may store data outside the UK. When they do, we make sure the transfer is protected by UK-approved safeguards.

05How long we keep it

Orders and payment records: 6 years after the end of the financial year they belong to, as tax law requires.
Your account: until you ask us to close it. Order records are kept as above.
Franchise applications that don't go ahead: 12 months, then deleted.
Rep agreements, signatures and payment details: for the length of the agreement plus 6 years.
Supplier records, documents, agreements and invoices: for the length of the relationship plus 6 years.
Page view counts: anonymous, so they're kept as statistics.

06Keeping it safe

Our site uses HTTPS throughout. Passwords are stored only as secure hashes. Rep bank details and tax references are encrypted, and only the owner can view them. Staff access is limited by role, and access to sensitive details is logged.

07Your rights

Under UK data protection law you can ask us to:

give you a copy of your personal data
correct anything that's wrong
delete your data, where we don't need to keep it by law
restrict or object to how we use it
move your data to another provider, where that applies

You can do the most common ones yourself: sign in and open My account → Account & privacy to update your details, download your data, or delete your account. Deleting your account erases your name, email, phone, saved addresses, saved box and protein target straight away. Past order records (items, prices, dates) are kept for 6 years because tax law requires it, with your name, address, phone and notes removed.

For anything else, email hello@prendys.com. We'll reply within one month. If you're unhappy with how we've handled your data, you can complain to the Information Commissioner's Office (ICO) at ico.org.uk or on 0303 123 1113. We'd appreciate the chance to put things right first.

08Changes to this policy

We'll update this page when how we use data changes, for example when our app launches. The date at the top shows the latest version.