Privacy Notice
Version 2026-09-28 · Effective 28 September 2026
What personal data Tokeat collects when you order food, run a restaurant on Tokeat or visit our websites, why we use it, who we share it with, how long we keep it and the rights you have.
Who we are
Tokeat is a trading name of RK Technology Group Limited, a company registered in England and Wales with company number 17205820.
Tokeat is an online ordering platform. Restaurants, cafés, takeaways and other food businesses use it to run their own ordering websites, and customers use those websites, and tokeat.com, to find food and place orders.
If you have any question about this notice or your data, email privacy@tokeat.com.
Who is responsible for your data
Two different organisations are responsible for different parts of your data, and it matters which one you ask.
- Tokeat is the controller of your Tokeat account, your sign-in and its security, the restaurant search on tokeat.com, and our relationship with the restaurants that pay to use Tokeat.
- The restaurant you order from is the controller of your order and of its relationship with you as its customer. It decides what to do with your order, it prepares and delivers it, and it handles refunds and complaints about the food.
- When we store and process an order for a restaurant, we do so as that restaurant’s processor, on its instructions and under a data processing agreement with it.
If you want to exercise a right over an order, you can contact the restaurant or us. If you contact us, we will either deal with your request or pass it to the restaurant and help it respond.
The data we collect
If you order food
- Your name, email address and phone number. We verify your phone number with a code sent by text message.
- Delivery addresses you save or enter.
- What you order, including notes you add for the restaurant, the time you asked for, and for dine-in orders your table number.
- Payment references: whether you paid by card or cash, the amount, and our payment provider’s reference for the payment. Card details are entered directly with our payment provider and are never seen or stored by us.
- Credits and discounts applied to your account or order.
- If a restaurant records a problem with one of your orders, such as an order not collected or a payment disputed, or blocks you from ordering from it, a record of that.
- Your sign-in details. Passwords are held by our sign-in provider, never by us. If you sign in with Google, we receive the name and email address on your Google account.
If you run or work at a restaurant on Tokeat
- Your name, email address and phone number, and your role at the restaurant.
- Business details: the business name, address, what it sells and how it is run.
- Bank and payout details, which you give to our payment provider when you set up payments. We see the status of your payout account, not your full bank details.
- The card you pay our subscription with, which is held by our payment provider.
- A record of actions staff take in the dashboard, such as refunds, credits, discounts and price changes, with who took them and when.
- What you type into our AI design and menu tools, and the menu files you upload to them.
- A record of the version of our Restaurant Terms you accepted, when, and the IP address and browser you accepted them from.
If you visit any of our websites
- Technical and security data: your IP address, browser and device type, the pages you request, and errors. Security logs record IP addresses.
- Performance data: how quickly pages load and whether they fail, measured in your browser. This is not linked to your account. You can turn it off on our cookie policy.
- If you choose “use my location” when searching, your browser shares your approximate location with us to find restaurants near you.
We use cookies and similar technologies to keep you signed in and to make the site work. Our cookie policy explains what they are for and how to control them.
How we use your data, and our lawful bases
Data protection law requires a lawful basis for each use of personal data. Ours are:
| What we do | Lawful basis |
|---|---|
| Create and run your account, and sign you in | Contract: we need it to provide the account you asked for |
| Pass your order to the restaurant, take payment, and send order updates | Contract (and, for the restaurant, its contract with you) |
| Provide the platform to restaurants, bill them and pay them out | Contract with the restaurant |
| Keep the platform secure: verify phone numbers, block abuse and fraud, and keep security logs | Legitimate interests: protecting our customers, restaurants and ourselves |
| Monitor errors and performance so the service keeps working | Legitimate interests: running a reliable service |
| Improve the platform, using information about how it is used | Legitimate interests: making the service better |
| Keep a record of the terms a restaurant accepted and of staff actions | Legitimate interests: being able to show what was agreed and who did what |
| After you delete your account, keep limited details to deal with payment disputes and claims, and to keep a restaurant’s block in place | Legitimate interests: being able to deal with payment disputes and legal claims, and preventing fraud and abuse |
| Keep financial and tax records | Legal obligation |
| Anything else we ask your permission for | Consent, which you can withdraw at any time |
Where we rely on legitimate interests, we have weighed them against your interests and rights. You can ask us for details, and you can object (see Your rights).
We do not sell your personal data, and we do not use it to make decisions about you that have legal or similarly significant effects without a person being involved.
Who we share it with
- The restaurant you order from receives your order, your name and contact details, and your delivery address or table where the order needs them.
- Service providers who run parts of the platform for us: hosting and infrastructure, sign-in, email, security, monitoring and error reporting, address lookup, maps and AI design and menu tools. Each handles data only on our instructions, under a written contract.
- Our payment provider, which processes card payments for the restaurant you order from.
- Professional advisers, and law enforcement, regulators or courts where the law requires it or it is needed to protect people from harm or fraud.
- A buyer of our business, or of part of it, if that ever happens, under the same protections as this notice.
Transfers outside the UK
Our platform is hosted in the UK. Some service providers handle data in other countries, including the United States. Where data leaves the UK we rely on UK adequacy regulations where they apply, or on the UK International Data Transfer Agreement or the UK Addendum to the EU Standard Contractual Clauses.
How long we keep it
| Data | How long |
|---|---|
| Your customer account | Until you delete it, or ask us to |
| Orders | The financial record of each order (what was sold, when, and the amount) is kept for 6 years, for the restaurant’s and our tax and accounting records |
| Your contact details on an order, after you delete your account | Kept only while a claim about the order is still possible: up to 120 days after the order (the time in which a card payment can be disputed), or longer while a refund, dispute or unpaid balance is open or a restaurant has recorded a problem with it. Then removed |
| If a restaurant has blocked you | When you delete your account we keep a secured record, which cannot be read back as your details, so that the block still applies if you sign up again. It is deleted when the block ends or the restaurant leaves Tokeat |
| A restaurant’s data after it cancels | Kept for 90 days after its access ends, so it can come back, then deleted, except financial records, which are kept for 6 years |
| Security, error and performance logs | Up to 12 months |
| Backups | Deleted on a rolling basis within 37 days |
How we protect it
Data is encrypted in transit and at rest, each restaurant’s data is kept separate from every other restaurant’s, and access is limited to people who need it. Card details never reach our systems.
Your rights
You have the right to:
- ask for a copy of the personal data we hold about you;
- ask us to correct data that is wrong or incomplete;
- ask us to delete your data;
- ask us to restrict how we use it;
- object to our using it on the basis of legitimate interests;
- ask for data you gave us in a portable format; and
- withdraw consent, where we rely on it.
You can download a copy of your data at any time with “Download my data” on your account page, as a file you can keep or give to another service. It covers your account, saved addresses and baskets, orders, payments and credits, and what restaurants have recorded about you, except where the law allows us to hold something back.
Some rights have exceptions: for example, we must keep financial records even if you ask us to delete them, and after you delete your account we keep contact details on an order while a claim about it is still possible (see [How long we keep it](#retention)). To exercise a right, email privacy@tokeat.com. We will reply within one month, and we may need to confirm who you are first. You can also change most of your details, and delete your account, from your account page.
Complaints
Please tell us first at privacy@tokeat.com and we will try to put it right. You also have the right to complain to the Information Commissioner’s Office, the UK data protection regulator, at ico.org.uk or on 0303 123 1113.
Children
You must be 18 or over to create an account or place an order. We do not knowingly collect data from children.
Changes to this notice
We will update this notice when what we do changes. The version and effective date at the top show when it last changed. If a change affects you significantly, we will tell you by email or when you next sign in.
Company information
- Company
- RK Technology Group Limited
- Trading as
- Tokeat
- Registered in
- England and Wales
- Company number
- 17205820
- Privacy
- privacy@tokeat.com
- Support
- support@tokeat.com