Privacy Policy

When you use this website, we collect the following:

• Account information — your name, phone number, email address, and password when you create an account or sign in.
• Order information — the items you order, your order history, any special instructions, and whether you chose dine-in, takeaway, collection, or delivery.
• Delivery and location information — your delivery address and postcode, which we use to confirm that your chosen branch delivers to you and to calculate any delivery fee.
• Payment information — payments are handled by our payment provider, Adyen. We do not store your full card number; we receive only a secure token and limited details needed to confirm and refund your order.
• Loyalty and rewards — where you take part in our loyalty programme, your points balance, vouchers, coupons, and redemption history.
• Communication preferences — your choices about our newsletter and the notification categories and channels (email, push, SMS) you have opted into.
• Device and usage information — device type, browser or operating system, app version, identifiers, and diagnostic or crash data used to operate and improve the site.

• To create and manage your account and keep you signed in.
• To process, prepare, and fulfil your orders.
• To take payment and issue refunds.
• To operate our loyalty programme and apply any rewards.
• To send you service messages such as order updates, receipts, and account notices.
• To send you our newsletter and other marketing where you have opted in, which you can withdraw at any time.
• To provide customer support and respond to your enquiries.
• To keep the site secure and prevent fraud.
• To understand how the site is used and improve it, where you have agreed to analytics cookies.
• To comply with our legal and regulatory obligations.

Under the UK GDPR we rely on the following legal bases: performance of a contract (to fulfil your orders and run your account), consent (for the newsletter, marketing, analytics cookies, and optional permissions such as location and push notifications), legitimate interests (to secure and improve the site), and legal obligation (to meet accounting, tax, and other legal requirements).

We do not sell your personal data. We share it only with:

• Service providers who process data on our behalf, including payment processing (Adyen), cloud hosting and storage, email and SMS delivery, and — where you have agreed to analytics cookies — website analytics (Google).
• Delivery partners where needed to fulfil a delivery order.
• Authorities or third parties where required by law, to enforce our terms, or to protect the rights and safety of our customers and staff.

These parties may only use your data as necessary to provide their services to us.

To keep you signed in, our account service sets a secure session cookie on your browser. It is set by our API origin (a separate host from this website) so your session works across the site and the mobile apps. We do not use advertising or cross-site tracking cookies.

We also use Google Analytics, loaded through Google Tag Manager, but only if you agree to it on our cookie banner. For the full list of cookies and on-device storage we use, and how to change your mind at any time, see our Cookie Policy.

Where you accept analytics cookies, we use Google Analytics (through Google Tag Manager) to understand how the site is used. Google LLC, based in the United States, receives and processes that data on our behalf, so this involves a transfer of your data outside the UK. Google is contracted to process it only for us, and the transfer is covered by the safeguards described under International Transfers below.

What we send is limited to how the site is used: the pages you view, the items you look at and order, the value of an order and its order reference, and the branch you chose. Alongside that, Google receives the technical details any web request carries — your IP address, your browser's user agent, and the page you arrived from. We never send Google your name, email address, phone number, or delivery address.

You should know that the Google Tag Manager container loads on every page, before you answer the cookie banner. Until you accept analytics it runs with every Google storage signal set to denied (Google Consent Mode v2, advanced mode), so no analytics cookie is written and nothing is stored on your device. It does not mean nothing reaches Google: because the container is loaded from Google's servers and sends cookieless pings, Google receives your IP address, user agent, and referring page before and regardless of the choice you make. Those pings carry no cookie or identifier that follows you between visits, and advertising signals are switched off permanently, but they do happen and we would rather say so plainly than imply otherwise.

Our legal basis for analytics is your consent. You can withdraw it at any time using the Cookie settings control in the footer of every page. When you do, we delete the Google Analytics cookies from your browser and stop sending anything further. We also record the Google Analytics identifier those cookies held, so that if you ask us, we can request that Google erase the data collected under it.

When you answer the cookie banner — or change your mind later — we keep a record of that decision on our servers, so we can show that consent was properly given, refused, or withdrawn. The record holds:

• a random identifier for your browser's consent cookie (not your name or account);
• which categories you accepted or refused;
• whether you accepted, refused, changed, or withdrew your choice;
• the date and time you chose;
• the version of the cookie wording you were shown;
• your browser's user agent — the short line of text your browser sends identifying itself and your operating system.

We keep these records for six years, which is how long we may need them to evidence a consent decision, and then delete them. A record is kept even after you withdraw consent, because it is the evidence of what you were asked and what you answered — but you can change the choice itself at any time from Cookie settings in the footer.

We keep your personal data for as long as your account is active and as needed to provide our services. We are required by UK tax and accounting law to retain order and transaction records for a set period — around six years. When data is no longer needed and the law no longer requires us to hold it, we delete or anonymise it.

Subject to applicable law, you have the right to access, correct, delete, or restrict the processing of your personal data; to object to processing; to data portability; and to withdraw consent at any time. You can manage your notification and newsletter preferences from your account at any time.

The quickest way to exercise your access, export, and erasure rights is from the manage your data page once you are signed in. The same tools are available in the Jack's Burger mobile apps.

If you are in the UK, you also have the right to complain to the Information Commissioner's Office (ICO) at ico.org.uk.

You can request erasure of your account from the manage your data page (or in the mobile apps). Because UK tax and accounting law requires us to keep your order and transaction records, an erasure is carried out by anonymising your data rather than deleting every record: your personal details are removed or replaced, your account is closed, and your past orders are kept only in an anonymised, non-identifying form for the legally required period.

When you request erasure, we email you a confirmation with a link to cancel. You then have a 30-day grace period to change your mind by using that link — no need to sign back in. If you do nothing, your data is anonymised after the grace period ends, and that step cannot be reversed.

You can also ask for a copy of your data. We prepare a machine-readable export and email you a secure download link that stays valid for seven days. Requesting an export does not close your account or interrupt your ability to order.

We use appropriate technical and organisational measures to protect your personal data, including encryption in transit and access controls. No method of transmission or storage is completely secure, so we cannot guarantee absolute security.

Our services are not directed at children under 13, and we do not knowingly collect personal data from them. If you believe a child has provided us with personal data, please contact us so we can delete it.

Your data may be processed outside the UK — including by Google LLC in the United States, where you have accepted analytics cookies. Where it is, we put appropriate safeguards in place, such as the UK international data transfer addendum to the standard contractual clauses, to protect your information.

We may update this Privacy Policy from time to time. When we do, we will revise the “Last updated” date above and, where appropriate, let you know.

If you have questions about this Privacy Policy or how we handle your data, contact us:

Jack's Burger Franchises Ltd
139 Wilbraham Road, Manchester, M14 7DS, United Kingdom
Email: info@jacksburgeruk.com
Phone: +44 7899 367574

You can also email us directly at info@jacksburgeruk.com.