Privacy policy Last updated: [DATE]
1. Who we are
This website, doughdohs.com, is run by [LEGAL ENTITY NAME], a company registered in [England and Wales] under company number [COMPANY NUMBER], with its registered office at [REGISTERED ADDRESS] ("Dough Dohs", "we", "us"). We're the controller of the personal information we collect through this website. We're registered with the Information Commissioner's Office (ICO) under registration number [ICO REGISTRATION NUMBER]. For anything about your data, email [PRIVACY CONTACT EMAIL] or write to us at [POSTAL ADDRESS].
2. What this policy covers
This policy covers doughdohs.com and the forms on it. Ordering isn't done on this website. When you tap "Order now", you go to our online ordering site at order.doughdohs.com, which runs on Square. Your order, payment and delivery details are handled there, under [the Square Online privacy terms and our own ordering privacy notice: LINK / UNKNOWN]. Delivery apps (for example Uber Eats) have their own privacy policies.
3. What we collect and why
| What | When | Why (purpose) | Lawful basis |
|---|---|---|---|
| First name, email, postcode | When you join The DOH List | To send you DOH List emails about Dough Dohs news, new pizzas and drops. To understand which areas people sign up from, so we can plan new kitchens | Consent (UK GDPR Art. 6(1)(a); PECR reg. 22 for marketing emails) |
| First and last name, email, phone, city or area of interest, current occupation or business, available investment (optional), hospitality experience (yes/no), message (optional), interest type (full franchise or dark kitchen) | When you send a franchise or dark-kitchen enquiry | To reply to your enquiry and assess whether a partnership could work | Steps before entering a contract at your request (Art. 6(1)(b)) and/or legitimate interests (Art. 6(1)(f)) |
| Technical data: IP address, device and browser type, pages viewed, referring page, approximate location from IP, timestamps | When you visit the site | To run and secure the site (hosting, bot protection) and, with your permission, to understand how the site is used | Security and hosting: legitimate interests. Analytics: consent (or the PECR statistical-purposes exemption, if legal confirms it applies) |
| Anything you send us by email or social media DM | When you contact us | To reply | Legitimate interests |
We don't ask for special category data. Please don't include health or other sensitive information in the message box.
4. Who we share it with
We use trusted service providers who process data for us under contract:
| Provider | What they do | Where | Safeguard |
|---|---|---|---|
| [Lovable: hosting provider of the website] | Website hosting | [LOCATION] | [UK IDTA / EU SCCs + UK Addendum / adequacy] |
| [Cloudflare] | Content delivery, security, bot protection; image storage (R2) | [LOCATION] | [SAFEGUARD] |
| [Lovable analytics / Tinybird] | Site usage statistics | [LOCATION] | [SAFEGUARD] |
| [Google Fonts; Fontshare] | Font delivery (your browser sends your IP address to them) | [LOCATION] | [SAFEGUARD] |
| [EMAIL MARKETING PROVIDER – UNKNOWN] | Sends DOH List emails | [LOCATION] | [SAFEGUARD] |
| [FormSubmit (formsubmit.co)] | Delivers form submissions to our inbox by email | [LOCATION] | [SAFEGUARD] |
| [Square] | Online ordering on order.doughdohs.com (separate site) | [LOCATION] | [SAFEGUARD] |
| [Other Ahtom group companies – IF APPLICABLE] | [e.g. franchise assessment] | UK | Intra-group agreement |
We don't sell your personal information. We may disclose information where the law requires it, or to protect our rights.
5. How long we keep it
- The DOH List: until you unsubscribe. We then keep a suppression record (your email only), so we don't email you again. Inactive subscribers are removed after [RETENTION PERIOD, e.g. 24 months of no opens or clicks – LEGAL TO SET].
- Franchise enquiries: [RETENTION PERIOD – LEGAL TO SET] after our last contact, unless we enter into an agreement with you.
- Website and security logs: [PERIOD set by the hosting provider – UNKNOWN].
- Analytics: [PERIOD – UNKNOWN].
6. Your rights
Under UK data protection law you have the right to:
- access your data
- have it corrected or erased
- restrict or object to its use, including an absolute right to object to direct marketing
- data portability
- withdraw consent at any time. This doesn't affect anything we did before you withdrew it
Every DOH List email has an unsubscribe link. To use your rights, email [PRIVACY CONTACT EMAIL]. We'll reply within one month. If you're unhappy with how we've handled your data, you can complain to the ICO: ico.org.uk/make-a-complaint, 0303 123 1113. We'd appreciate the chance to sort it out first.
7. Children
This site isn't aimed at children. You must be [13 / 16 / 18 – LEGAL TO SET] or over to join The DOH List or send an enquiry.
8. Security
We use HTTPS across the site and limit who can see form submissions. [Further measures – UNKNOWN until the backend is chosen.]
9. Changes
We'll post any changes here and update the date at the top.