1. Who We Are
CartaGrid Limited (“CartaGrid”, “we”, “us”, “our”) is a company registered in England and Wales. Our registered office is at 14 Clifton Moor Business Village, James Nicholson Link, York YO30 4XG. We operate the CartaGrid allergen compliance platform, accessible at cartagrid.com.
For any privacy-related queries, contact us at operations@cartagrid.com.
2. What Data We Collect
We collect and process the following categories of personal data:
- Account data: Name, email address, job role, venue name
- Operational data: Menu items, ingredients, allergen declarations, HACCP records
- Staff training data: Certification records and expiry dates
- Customer allergen declarations: Allergen information submitted by venue customers via QR code, linked to a table number. This is special category health data under UK GDPR Article 9, processed on the basis of explicit consent given at the point of submission
- Usage data: Login timestamps, actions performed within the platform, audit trail entries
- Payment data: Billing details processed securely via Stripe (we do not store card data)
- Communications: Support messages and correspondence
3. How We Use Your Data
We use your personal data to:
- Provide and maintain the CartaGrid platform
- Ensure allergen compliance and audit trail integrity under Owen's Law and UK FSA requirements
- Send real-time operational alerts to designated venue staff (e.g. allergen declarations, temperature breaches, training expiry)
- Process payments and manage subscriptions
- Send service notifications, compliance alerts, and support communications
- Improve platform performance and reliability
- Meet our legal and regulatory obligations
4. Legal Basis for Processing
We process your data on the following legal bases under UK GDPR:
- Contract performance: To deliver the CartaGrid service you have subscribed to
- Legal obligation: To maintain allergen records as required by UK food safety law
- Legitimate interests: Platform security, fraud prevention, and service improvement
- Explicit consent: For customer allergen declarations (special category health data), consent is obtained at the point of submission via the public allergen declaration form
- Consent: Where you have provided explicit consent for specific communications
5. Data Sharing
We do not sell your personal data. We share data only with trusted third-party sub-processors necessary to deliver our service, including database infrastructure, the application hosting platform, payment processing, AI processing for compliance document generation, workflow automation, staff alerting and notifications, and our voice agent platform.
A current list of sub-processor functions — including purpose, location, and data transfer mechanism — is maintained at cartagrid.com/sub-processors. The specific identity of each sub-processor is available to Subscribers on written request under our Data Processing Agreement. We notify Subscribers at least 30 days before adding or replacing any sub-processor function, with a right to object on reasonable data protection grounds.
All sub-processors are bound by data processing agreements and are obligated to protect your data. Full details of our processing arrangements are set out in our Data Processing Agreement.
6. Data Retention
We retain your data for as long as your account is active and for a period of 7 years thereafter, in line with UK food safety audit requirements. Payment records are retained for 7 years in accordance with HMRC requirements. You may request deletion of non-compliance data at any time.
7. Your Rights
Under UK GDPR, you have the right to:
- Access the personal data we hold about you
- Correct inaccurate or incomplete data
- Request erasure of your data (where legally permissible)
- Object to or restrict processing
- Withdraw consent at any time, where processing is based on consent (this does not affect the lawfulness of processing before withdrawal)
- Data portability — receive your data in a machine-readable format
- Lodge a complaint with the Information Commissioner's Office (ICO) at ico.org.uk
To exercise any of these rights, contact us at operations@cartagrid.com.
8. Security
We implement appropriate technical and organisational measures to protect your data, including role-based access controls, immutable audit logging, encrypted data transmission, and regular security reviews. Our platform status and uptime are monitored continuously at status.cartagrid.com.
9. Cookies
CartaGrid uses only essential cookies required for platform functionality and session management. We do not use advertising or tracking cookies.
10. Changes to This Policy
We may update this Privacy Policy from time to time. We will notify subscribers of material changes by email. The current version is always available at cartagrid.com/privacy.
11. Contact
CartaGrid Limited
14 Clifton Moor Business Village, James Nicholson Link, York YO30 4XG
operations@cartagrid.com
cartagrid.com