UK GDPR customer information

Privacy & Data Protection

How Dexter’s handles personal information used by the website, Loyalty App, collection ordering, rewards, promotions and Sunday Roast pre-orders.

Who is responsible for your data?

Data controller: Dexters, 10A Dundasvale Court, Glasgow, G4 0JS, Scotland. The customer-facing brand may be displayed as Dexter’s. For privacy requests, email privacy@dextersspot.co.uk or call 0141 473 5249.

Personal information we collect

Name, email address, phone number and account identifiers.
Loyalty stamps, points, rewards, offers, promotion entries and redemption history.
Order contents, modifiers, notes, collection times, order status and transaction references.
Sunday Roast booking information, deposit reference and payment status. Full card details are processed by the payment provider and are not intended to be stored by Dexter’s.
Authentication, device/browser, IP, security and technical information needed to operate and protect the service.
Messages, enquiries, complaints and catering information you send to Dexter’s.

Why we use information and lawful bases

Contract: to create and operate customer accounts, process orders and deposits, provide requested loyalty benefits and deal with requests linked to an order or service.
Legitimate interests: to secure and improve the service, prevent fraud and duplicate rewards, troubleshoot faults, maintain proportionate business records and provide customer support, where those interests are not overridden by your rights.
Legal obligation: where records or disclosures are necessary for tax, accounting, food-safety, consumer, regulatory or other legal requirements.
Consent: where consent is required, including certain non-essential cookies/technologies or marketing communications.

Direct marketing and your choices

Dexter’s only sends marketing emails or text messages to customers where the relevant marketing permission is recorded. Email and SMS choices are kept separately. Marketing consent is optional: saying no does not affect your account, orders, loyalty points or rewards.

If you consent, Dexter’s may send offers, promotions, loyalty news and information about Dexter’s products and services using the channel you selected. You may withdraw consent or object to direct marketing at any time using the marketing preferences in your account, the unsubscribe option provided with marketing communications, or by contacting privacy@dextersspot.co.uk.

When you opt out, Dexter’s may keep a minimal suppression or “do not contact” record so your preference can be respected and you are not added back to marketing by mistake. This suppression information is used to comply with your opt-out, not to send marketing.

Providing information

Some personal information is needed to create an account, place an order, take payment, provide a reward or respond to a request. If required information is not provided, Dexter’s may be unable to provide that particular service. Information requested only for optional marketing or non-essential features is not required to buy food.

Who we share information with

Dexter’s uses service providers for hosting, database/authentication, payments, email and communications. Current services include Vercel, Supabase, Stripe and Google/Gmail, and WhatsApp/Meta when a customer chooses that communication channel. Information is shared only where reasonably necessary for the relevant service, legal obligation, security purpose or customer request.

International transfers

Some service providers may process information outside the UK. Where UK data-protection law requires safeguards, Dexter’s relies on an applicable UK adequacy regulation, the UK International Data Transfer Agreement/Addendum or another lawful transfer mechanism made available by the relevant provider. Customers may contact Dexter’s for information about the applicable safeguards.

How long we keep information

Dexter’s keeps information only for as long as needed for the purpose for which it was collected, including fulfilment, customer support, fraud/security, accounting, tax, legal claims and food-safety obligations. Account and loyalty information is generally retained while the account remains active and for a reasonable period afterwards where needed for deletion, security, dispute or legal purposes. Order and payment-reference records are retained for the period required by applicable accounting, tax and legal obligations. Retention periods and criteria must be reviewed when systems or legal requirements change.

Your UK data-protection rights

Depending on the circumstances and lawful basis, you may have rights of access, rectification, erasure, restriction, objection and data portability. Where processing relies on consent, you may withdraw consent at any time and it must be as easy to withdraw as to give. Requests can be made using the contact details above.

Your right to object: where Dexter’s relies on legitimate interests, you may object to that processing in relevant circumstances. You have an absolute right to object to direct marketing.

Complaints to the ICO

You may complain to the Information Commissioner’s Office if you are unhappy with how your personal information is handled. Information is available at ico.org.uk. Dexter’s would welcome the opportunity to resolve the issue first, but this does not remove your right to contact the ICO.

Cookies and local storage

Browser storage and similar technologies may be used where strictly necessary for sign-in, security, preferences and core app functions. Non-essential analytics, advertising or similar technologies must not be set or accessed until any consent required by UK privacy law has been obtained. See the Cookie & Local Storage Policy.

Security and data breaches

Dexter’s uses authentication, access controls, role restrictions, one-time reward checks and security features supplied by its service providers. Staff credentials must not be shared. Access should be limited to authorised users and reviewed when roles change. No internet service can guarantee absolute security. Suspected personal-data breaches must be investigated promptly and reported to the ICO and affected individuals where UK data-protection law requires it.

Automated decisions

Reward and promotion systems may automatically determine whether a QR code is valid, whether points have already been credited or whether a promotional result applies. Dexter’s does not intend to make solely automated decisions that produce legal or similarly significant effects on customers without providing the information and safeguards required by law.

Changes to this notice

This notice may be updated when Dexter’s changes its services, suppliers, legal structure, data uses or legal requirements. Material changes should be brought to customers’ attention where appropriate.