Platform & End-Customer Privacy Notice

Last updated: 4 August 2026

1. Introduction

This Platform & End-Customer Privacy Notice explains how Slerp Limited (“Slerp”, “we”, “us”, “our”) uses personal data when you place an order with a restaurant or hospitality business (a “Merchant”) using ordering technology powered by Slerp (the “Platform”).

Slerp provides the technology that allows Merchants to take orders and, where applicable, to have those orders delivered by courier partners. We do not sell food ourselves, and we do not decide a Merchant’s menu, prices or marketing.

We do, however, decide a number of important things about how the Platform works and how your personal data is handled within it. For that reason Slerp is a data controller of your personal data, in some respects together with the Merchant and in some respects on its own. Section 2 explains this.

2. Who controls your personal data?

A. Slerp and the Merchant are joint controllers for your order

For the personal data needed to take, accept and fulfil your order, Slerp and the Merchant are joint data controllers. This means we decide together how that personal data is used, and neither of us could provide the service without the other.

The Merchant decides what it sells, what it charges, whether it offers delivery or collection, and how it deals with its own customers. Slerp decides how the ordering technology works, what information is collected at checkout, how order records are stored and for how long, and, where delivery is used, which courier is asked to collect your order.

B. The essence of our arrangement

Where two organisations are joint controllers, data protection law requires them to agree how responsibilities are divided and to tell you the essence of that agreement. In summary:

The Merchant is your first point of contact. It is responsible for telling you how your personal data is used and for handling requests to exercise your rights. Slerp gives the Merchant reasonable help to do this.
Slerp is responsible for the security of your personal data while it is held within the Platform, for how long it is kept there, for any transfer of it outside the United Kingdom that Slerp makes, and for notifying the Information Commissioner’s Office of any relevant personal data breach affecting the Platform.
The Merchant is responsible for your personal data once it has been exported from the Platform or sent at the Merchant’s request to another company, and for any marketing the Merchant sends you.
You can exercise your rights against either Slerp or the Merchant. You do not need to approach both, and you are not obliged to go to one before the other. See section 12.

C. Where the Merchant acts alone

The Merchant is the sole controller of personal data it decides about by itself. This includes its menu, prices and product information, the customer accounts, order history and loyalty records it holds, and any marketing communications it sends you. The Merchant’s own privacy policy applies to that use and you can usually find a link to it on the Merchant’s website. You should review it for details of how the Merchant uses your personal data, including for marketing and how long it keeps it.

D. Where Slerp acts alone

Slerp is the sole controller of personal data used for purposes that Slerp decides by itself, for example keeping the Platform secure and preventing fraud. Section 6 sets these out in full.

E. Other companies involved in your order

Courier partners, payment providers, point of sale providers and, where a Merchant also sells through them, online marketplaces each act as independent controllers of the personal data they receive and use for their own purposes. Their own privacy notices apply to that use.

3. Personal data processed via the Platform

Depending on what the Merchant offers and what you choose, the Platform may process:

Identity and contact details: name, email address, phone number.
Order information: items ordered, quantities, customisations, order notes, order value, timestamps, order reference or ID.
Fulfilment information: delivery address (or collection location), preferred fulfilment time, and delivery instructions.
Delivery information: courier allocated, collection and delivery timings, tracking status and delivery outcome.
Marketing preference: whether you have chosen to receive marketing from the Merchant at checkout.
Loyalty information: where the Merchant offers loyalty or a digital wallet pass, your balance, rewards and redemption history.
Device and technical information: IP address, device identifiers, browser type, and usage data (see section 7).
Support communications: messages or calls with Slerp and/or the Merchant relating to your order.

Payment information

Payments are processed by third-party payment providers integrated into the Merchant’s checkout experience. Slerp does not store full payment card details (such as the full card number or CVV). Payment providers act as independent controllers for payment processing.

4. How the Platform is used (purposes)

Order processing: taking your order and passing it to the Merchant for preparation and fulfilment.
Operational communications: sending order confirmations, status updates and fulfilment notifications.
Delivery: where delivery is selected, allocating your order to a courier partner and enabling tracking (see section 5).
Loyalty: where the Merchant offers it, issuing and redeeming rewards, including through a digital wallet pass.
Recording your marketing preference so that the Merchant can honour it.
Customer support: investigating and resolving order issues and responding to enquiries (see section 8).
Platform operations: keeping the Platform reliable and secure, monitoring performance, and preventing fraud and abuse (see sections 6 and 7).

Our lawful bases for using your personal data

We only use your personal data where the law allows. Depending on the purpose, we rely on:

Performance of a contract: to take and fulfil your order. Your contract for the food or other products is with the Merchant. Your use of the ordering technology is governed by Slerp’s Platform Terms of Use.
Legitimate interests: to keep the Platform secure and working properly, to prevent fraud and abuse, to investigate incidents, to measure and improve how our technology performs, and to produce reporting and insight. We balance these interests against your rights.
Consent: for marketing communications, where the Merchant relies on your consent, and for non-essential cookies.
Legal obligation: to comply with the law and to respond to lawful requests.

5. Delivery enabled through Slerp Dispatch (where applicable)

Where the Merchant offers delivery using Slerp Dispatch and you choose delivery, Slerp shares the information needed to complete the delivery with a courier partner. This typically includes your name, phone number, delivery address and order reference.

Slerp holds the relationship with each courier partner and decides which courier is asked to collect a given order, based on factors such as availability, distance and vehicle type. A Merchant may ask us to prioritise or exclude particular courier partners.

Courier partners act as independent data controllers for the delivery itself. They use your personal data to carry out the delivery, to provide tracking and to meet their own legal obligations.

Slerp monitors courier performance and delivery outcomes, and may liaise with the Merchant and the courier partner to resolve delivery issues, including through customer support.

6. Where Slerp acts as sole controller

Slerp is the sole controller of personal data used for the following purposes, which Slerp determines itself:

Security and fraud prevention: detecting suspicious activity, preventing abuse and protecting the Platform.
Service integrity and troubleshooting: investigating incidents, debugging and keeping the Platform reliable.
Allocating deliveries: deciding which courier partner is asked to collect an order, and managing our relationships with courier partners.
Customer support handled by Slerp: responding to you where you contact Slerp directly about an order (see section 8).
Measuring and improving our technology: understanding how the Platform performs and where it can be improved.
Reporting and insight: producing reporting and insight about how the Platform is used, including reporting that combines information across the Merchants we work with. Wherever possible this uses aggregated, anonymised or de-identified data that does not identify you.
Compliance: meeting our legal obligations and responding to lawful requests.

For these purposes we rely on legitimate interests (operating, securing and improving our technology) and, where relevant, legal obligation.

7. Cookies, analytics and technical data

We use cookies and similar technologies within the Platform experience to operate and secure the Platform, to understand how it is used and to improve performance. Where cookie choices are offered to you, they are presented through the cookie controls on the website or app you are using.

Technical data such as your IP address and device identifiers may be used for security, fraud prevention, troubleshooting and performance analytics.

8. Customer support and communications

Slerp operates its own customer support channel for orders placed through the Platform. If you start a conversation with us, for example through the live chat available on your order tracking page, Slerp will access the relevant order and delivery information in order to investigate and respond. Slerp is the controller of those support communications.

We may communicate with you and coordinate with the Merchant and the courier partner to resolve the issue. Support communications may be retained for quality assurance, dispute resolution and service integrity purposes.

You can also contact the Merchant directly. The Merchant is responsible for the products it sells and for remedies under consumer law.

9. Sharing of personal data

In connection with the Platform, personal data may be shared with:

The Merchant you ordered from.
Courier partners to complete delivery, where applicable.
Payment providers for payment processing, where applicable.
Point of sale providers and online marketplaces, where the Merchant uses technology that connects the Platform to its till system or to a marketplace it also sells through.
Service providers and software providers that support the Platform, including hosting, monitoring, menu and order synchronisation, and customer support tooling, subject to contractual confidentiality and security obligations.
Professional advisers such as lawyers, accountants and insurers, where necessary.
Authorities where required by law or where necessary to protect rights, safety and security.
Parties to a corporate transaction, if Slerp enters into a merger, acquisition, reorganisation or sale of assets, subject to appropriate safeguards.

Slerp maintains a list of the categories of third party to which personal data may be disclosed in connection with the Platform. You can request details by contacting us using the details in section 14.

10. International transfers

Personal data may be processed outside the United Kingdom. Where this happens, Slerp uses appropriate safeguards recognised under UK data protection law, such as the UK International Data Transfer Agreement (IDTA) and/or the UK Addendum to EU Standard Contractual Clauses, or adequacy regulations where these apply.

11. Data retention

Slerp decides how long personal data is retained within the Platform. We keep it only for as long as is necessary for the purposes described in this notice and to meet legal, accounting, contractual and operational requirements, for example resolving disputes, investigating security incidents and allowing Merchants to access their own transaction records. Retention periods are set out in Slerp’s data retention policy, which is available on request.

Where a Merchant holds a copy of your personal data outside the Platform, the Merchant decides how long it keeps that copy.

12. Your rights and how to exercise them

Under UK data protection law you may have rights including access, correction, deletion, restriction, objection, and data portability in certain circumstances. You can also withdraw consent to marketing at any time.

Because Slerp and the Merchant are joint controllers of your order data, you may exercise your rights against either of us. You do not need to contact both, and you do not need to approach one before the other.

In practice, the Merchant is usually best placed to help with questions about your order, your account with that Merchant, loyalty and marketing, because the Merchant decides those things. If you contact Slerp, we may ask you for details to identify the relevant Merchant, and we will either handle your request or pass it to the Merchant and support them in responding. We will tell you which.

For requests about matters where Slerp acts as sole controller, listed in section 6, please contact Slerp directly.

13. Changes to this notice

We may update this notice from time to time. We will post the latest version on this page and update the “Last updated” date above.

14. Contact

If you have questions about this notice or about how Slerp uses personal data in connection with the Platform, contact us at: [email protected].

If you have concerns about how your personal data is handled, you can also contact the Merchant you ordered from. You have the right to lodge a complaint with the UK Information Commissioner’s Office (ICO) at ico.org.uk.