Privacy policy

Last updated: 8 August 2026

Cooked & Ate Ltd ("we", "us" or "our") is the data controller responsible for the personal information you provide to us. This Privacy Policy explains what personal information we collect, how we use it, who we share it with and your rights under the UK General Data Protection Regulation (UK GDPR).

Please read this alongside our Cookie Policy, which explains how we use cookies and similar technologies.

Contact details

You can reach us through our contact page.

Registered address: Cooked & Ate Ltd, 66 Paul Street, London, EC2A 4NA, United Kingdom. Companies House number: 17354288.

Our website platform

Our online store is hosted by Shopify. Information you submit to our website is transmitted to and stored by Shopify and may be processed in countries outside the United Kingdom.

For most purposes, Shopify processes this information on our instructions to provide the store to us.

Shopify also uses information about your activity on our store, together with information from other Shopify merchants, to generate insights that power features known as Enhanced Services. These are used to improve products and personalisation, improve store performance, and improve advertising targeting. No other merchant can access your information. Where Shopify uses your information in this way, Shopify is responsible for that processing and for handling any requests you make about it.

To find out how Shopify uses your personal information and what rights you have in relation to it, see the Shopify Consumer Privacy Policy. You can also make a request to Shopify directly through the Shopify Privacy Portal.

If you decline non-essential cookies on our website, your activity is marked so that it is not used by Shopify for advertising purposes. You can change your choice at any time using the cookie banner.

Information we collect

We may collect the following information when you interact with us:

  • Name
  • Billing and delivery address
  • Email address
  • Telephone number (where provided)
  • Order history
  • Marketing preferences
  • Device and connection information, including your IP address, browser type, device type and other identifiers
  • Information about how you use our website, including the pages and products you view and how you move around the site
  • Basket and browsing activity, including items you add to your basket but do not go on to buy
  • Information collected through cookies and similar technologies when you visit our website

When you make a payment, your payment details are processed securely by our payment provider. We do not see or store your full payment card details.

How we collect your information

We collect information when you:

  • Place an order
  • Create an account
  • Subscribe to our email newsletter
  • Sign up for WhatsApp updates
  • Contact us through our website
  • Browse our website using cookies and similar technologies

We also receive information from our service providers, such as our payment provider and delivery partners, when they process information on our behalf, for example, delivery status updates and the outcome of payment and fraud checks.

How we use your information

We only use your personal information where we have a lawful basis to do so.

  • Process and deliver your orders, provide customer support and manage your purchases — performance of a contract
  • Send marketing emails and WhatsApp updates, where you have chosen to receive them — consent
  • Show you relevant advertising and measure how our advertising performs, where you have accepted marketing cookies — consent
  • Allow Shopify to use your information for Enhanced Services, including personalisation and advertising targeting, where you have accepted non-essential cookies — consent
  • Maintain tax records and food traceability records, and comply with other legal requirements — legal obligation
  • Detect and prevent fraud, secure your account and keep our website safe — legitimate interests
  • Improve our products, website and customer experience — legitimate interests

Who we share your information with

We only share your information where necessary to operate our business and fulfil your orders. This may include:

  • Shopify, which hosts our online store and provides the tools we use to run it
  • Our payment providers
  • Delivery partners, including Royal Mail
  • Email marketing providers
  • WhatsApp and Meta services, where you have chosen to receive updates
  • Advertising and analytics partners, including Google and Meta, where you have accepted marketing cookies
  • Professional advisers or regulators, where required by law

We do not sell your personal information.

Advertising and analytics

We advertise our products on Google and on Meta platforms, including Facebook and Instagram. If you accept marketing cookies, we share information about your activity on our website with these partners so that we can measure how our advertising performs and show you more relevant adverts.

This information is shared in two ways. Some is collected in your browser through cookies and similar technologies. Some is sent directly from Shopify's systems to Google and Meta after you place an order, which allows conversions to be measured even where cookies are blocked. Where identifying details such as your email address are included, they are converted into a scrambled form before being sent.

Shopify also uses your activity on our store, combined with activity across other Shopify merchants, to improve advertising targeting for our store, as described under "Our website platform" above.

Google, Meta and Shopify use this information in accordance with their own privacy policies, over which we have no control.

You can withdraw your consent at any time through the cookie banner on our website. If you do, we will stop sharing your information for advertising purposes.

International transfers

Some of the service providers we use may process personal information outside the United Kingdom.

Where we transfer personal information outside the UK, we rely on either an adequacy decision covering the destination country, or on the UK International Data Transfer Agreement or the UK Addendum to the European Commission's Standard Contractual Clauses. You can request a copy of the relevant safeguards through our contact page.

Marketing

If you have opted in, we may occasionally send you information about new products, offers and updates by email or WhatsApp.

You can unsubscribe at any time by:

  • Clicking the unsubscribe link in any marketing email
  • Replying STOP to a WhatsApp message, or telling us at any time that you no longer wish to receive them
  • Contacting us through our contact page

Withdrawing your consent will not affect the lawfulness of processing carried out before you unsubscribed.

How long we keep your information

We retain personal information only for as long as necessary.

  • Order and transaction records: six years from the end of the financial year to which they relate, as required by tax and accounting legislation
  • Food traceability records: the shelf life of the product plus six months, as required by food safety legislation
  • Customer account information: for as long as you have an account with us. If you close your account, or ask us to remove your details, we erase your personal details from our customer records
  • Marketing preferences: until you unsubscribe or ask us to remove your details
  • Records of unsubscribe requests: if you ask us to stop contacting you, we keep a minimal record of that request indefinitely, so that we do not contact you again by mistake
  • Website and cookie data: for the periods set out in our Cookie Policy

When we erase your personal details, your name, contact details and address are removed from our records and the same request is sent automatically to the apps and services we use. A record of what was bought, and when, remains for the tax and accounting period set out above, but it is no longer linked to your personal details.

Keeping your information secure

We take appropriate technical and organisational measures to protect your personal information against unauthorised access, loss, misuse or disclosure. While no online system can ever be completely secure, we work with trusted service providers and use industry-standard security measures to safeguard your data.

Automated checks on orders

Orders placed on our website are screened automatically for signs of fraud, and payments are screened by our payment provider. These checks may flag an order so that we can look at it, but they do not cancel or refuse orders by themselves. Any decision to cancel or refuse an order is taken by us.

You have the right to object at any time to your information being used to build a profile for direct marketing purposes.

Children

Our website is not intended for children. We do not knowingly collect personal information from anyone under 16. If you believe a child has provided us with their information, please contact us through our contact page and we will delete it.

Your rights

Under UK GDPR, you have the right to:

  • Access the personal information we hold about you
  • Request correction of inaccurate information
  • Request deletion of your personal information (where applicable)
  • Restrict or object to certain types of processing, including profiling for direct marketing
  • Request a copy of your information in a portable format
  • Withdraw consent where processing is based on consent

To exercise any of these rights, please contact us through our contact page.

Where your request relates to Shopify's own use of your information for Enhanced Services, you can also contact Shopify directly through the Shopify Privacy Portal.

We may need to verify your identity before we can act on your request. We will respond within one month of receiving it. If your request is complex, we may need longer, in which case we will tell you if that is the case and explain why.

Complaints

If you are unhappy with how we handle your personal information, please contact us first so that we can try to put things right.

You also have the right to complain to the Information Commissioner's Office (ICO), the UK's data protection regulator, at www.ico.org.uk.

Links to other websites

Our website may link to websites operated by other organisations. We are not responsible for the privacy practices or content of those websites, and we recommend that you read their privacy notices before providing them with any personal information.

Cookies

We use cookies and similar technologies on our website. When you first visit, you will be asked whether you accept non-essential cookies, and you can change or withdraw your choice at any time. Full details are in our Cookie Policy.

Changes to this policy

We may update this Privacy Policy from time to time to reflect changes in our business, legal requirements or the services we use. The latest version will always be published on our website with the updated date shown at the top.