Privacy Policy

Chezzy Rewards is the loyalty and rewards programme for Chesterfield Eats customers, provided by [Registered company name, e.g. Chesterfield Eats Ltd] ("we", "us", "our"), registered in England and Wales under company number [company number], registered office at [registered address].

We are the data controller for the personal data described in this policy. If you have any questions about this policy or how we handle your data, contact us at [privacy contact email].

• We collect your email (and, if you give it, your name and phone number) so you can sign in and we can send you tickets, prizes, and account emails.
• We record which orders you've claimed, which games you've played, what you've won, and any survey answers or reviews you submit — all tied to your account so the rewards system works.
• If you win a physical prize or a raffle prize, we ask for a delivery name, address, and phone number to send it to you.
• We use SendGrid (Twilio) to send emails, and don't use any advertising or analytics cookies.
• We never sell your data, and we don't share it with anyone except the processors listed below who help us run the service.
• You can ask to see, correct, or delete your data at any time — see "Your rights" below.

We collect the following categories of personal data:

• Account details: your email address (required to sign in), and your name and phone number if you choose to add them.
• Order verification: the Order ID you submit to claim a ticket, and details we match it against (order total, order date, the outlet it was placed with). We don't store your Chesterfield Eats order confirmation email against your rewards account — order matching is done by Order ID only, and the underlying email is kept only briefly to help us troubleshoot a failed match.
• Loyalty activity: the tickets you've earned and spent, which games you've played, what you won or didn't win, and any voucher/discount codes assigned to you.
• Prize delivery details: if you win a physical prize or a raffle prize that needs posting out, the name, delivery address, and phone number you give us to fulfil it.
• Reviews and surveys: if you submit a Google review link for a bonus ticket, or complete one of our surveys, we store what you submitted.
• Raffle entries and donations: which raffles you've entered, and how many tickets you've donated to our Chesterfield Food Bank pot (donations are not anonymous to us, so we can maintain accurate records, but we don't publish your identity alongside them).
• Technical data: the IP address recorded when you sign up (used only to help us spot abuse of the ticket system), and a session cookie that keeps you signed in.

Under UK GDPR, we need a valid legal basis for each way we use your data:

• To provide the rewards programme (creating your account, tracking tickets and games, sending you prize codes, delivering physical prizes) — performance of a contract with you.
• To send you service emails (sign-in links, prize confirmations, raffle results) — performance of a contract.
• To prevent abuse of the ticket and voucher system (e.g. recording signup IP, enforcing one claim per order) — legitimate interests in running a fair scheme and protecting it from fraud.
• To run surveys and process review submissions you choose to complete — consent (given by taking part) and contract (the reward you receive for it).
• To keep records of donations to Chesterfield Food Bank — legitimate interests in accurate bookkeeping of a charitable pool.

We do not use your data for marketing emails or third-party advertising, and we do not carry out any automated decision-making that produces legal or similarly significant effects about you. Game outcomes are decided by randomised, pre-configured odds set by us, not by profiling you.

We use a small number of strictly necessary cookies — one to keep you signed in as a customer, and a separate one for staff signed into the admin area. These are essential to the site working and are exempt from consent requirements under the Privacy and Electronic Communications Regulations (PECR).

We do not currently use any analytics, advertising, or tracking cookies. If that changes, we'll update this policy and show a cookie banner before any non-essential cookie is set.

We share personal data only with the following processors, and only as far as needed for them to provide their service to us:

• Twilio SendGrid — sends transactional emails (sign-in links, prize and raffle notifications) on our behalf. SendGrid is based in the United States; transfers are protected by UK-approved safeguards (the UK International Data Transfer Addendum to the EU Standard Contractual Clauses).
• [Hosting / database provider] — stores our application database and hosts the website.
• Chesterfield Food Bank — receives the total donation amount raised each month; we do not share individual customers' names or contact details as part of this.

We never sell personal data, and we don't share it with advertisers or data brokers. We may disclose data if required by law, for example to comply with a court order or a request from a regulator.

We keep account and loyalty activity data for as long as your account is active, plus a reasonable period afterwards for record-keeping and fraud prevention (typically up to [X years — confirm your retention policy]). Prize delivery details are kept only as long as needed to fulfil and account for that prize. You can ask us to delete your account and associated data at any time — see below.

Under UK GDPR, you have the right to:

• ask for a copy of the personal data we hold about you;
• ask us to correct inaccurate or incomplete data;
• ask us to delete your data, or restrict how we use it, in certain circumstances;
• ask us to provide your data in a portable format, or transfer it to another provider;
• object to us processing your data where we rely on legitimate interests; and
• withdraw consent at any time for anything we do on the basis of your consent (e.g. surveys), without affecting anything we did before you withdrew it.

To exercise any of these rights, contact us at [privacy contact email]. We'll respond within one month. If you're unhappy with how we've handled your data, you also have the right to complain to the UK's data protection regulator, the Information Commissioner's Office (ICO) — ico.org.uk, or by phone on 0303 123 1113.

Chezzy Rewards is not directed at children, and we don't knowingly collect personal data from anyone under 16. If you believe a child has given us personal data, please contact us and we'll delete it.

We use appropriate technical and organisational measures to protect your data, including encrypted connections (HTTPS), access controls on our admin systems, and secure, hashed storage of passwords and session tokens.

We may update this policy from time to time, for example if we add a new feature that changes what data we collect. We'll update the "last updated" date at the top of this page whenever we do.

If you have any questions about this policy or your personal data, contact us at [privacy contact email] or write to us at [registered/contact address].