Choppr Privacy Policy
Last updated: 29 September 2026
Choppr is operated by I-GALAXY MEDIA LIMITED, company number 05881572, registered in England and Wales. Our registered office is 4th Floor Hamilton House, Mabledon Place, London, England, WC1H 9BB. Contact us about privacy at [email protected].
This policy explains how personal information is handled when you visit Choppr's website, contact us, use a restaurant's Choppr-powered services or administer a restaurant account. It covers the Choppr platform. It does not cover a separate AI receptionist service, call-audio recordings or conversation transcripts.
1. Who is responsible for your information?
When you are a restaurant customer
The restaurant normally decides how your information is used for its orders, deliveries, reservations, loyalty programme and marketing. It is the controller of that information. Choppr normally acts as its processor: we host and operate the platform on the restaurant's instructions under a data-processing agreement.
Customer records are kept separate between restaurant businesses. Choppr does not combine those records across separate restaurant businesses for analysis or to build shared customer profiles.
The restaurant's own privacy notice explains its purposes, lawful bases, retention choices and contact details. Contact the restaurant about an order, booking, its marketing or a request concerning its customer records. You can also contact us, identifying the restaurant, and we will pass your request to the appropriate business and assist it where required.
When Choppr is responsible
I-GALAXY MEDIA LIMITED is the controller for information we use for our own business activities, such as managing restaurant subscriptions, responding to enquiries, billing, business correspondence and meeting our legal obligations. We also control information used for our own website administration and platform-wide abuse prevention where we determine those purposes.
Technical support and security work on restaurant customer records remain subject to the restaurant's instructions where we perform them as its processor. Choppr does not send its own promotional marketing. We send important account and service notifications, such as billing, security, maintenance and changes affecting your service.
2. Information we handle and where it comes from
Depending on the features you use, information may include:
- Contact and account information: names, email addresses, telephone numbers, delivery or billing addresses, business details, staff account identifiers and access permissions.
- Restaurant activity: orders, delivery instructions, reservations, loyalty balances and activity, customer requests and service correspondence.
- Payment and billing information: invoices, amounts, payment status, transaction references and payment-method information returned by the payment provider. Payment-card details are submitted through the provider's payment interface; do not include card numbers or security codes in notes or support messages.
- Communications information: email or SMS content, recipients, delivery status, marketing permissions, preference changes and opt-out records.
- Technical information: IP addresses, browser and device information, session identifiers, access records and diagnostic or security information.
Information comes from you, the restaurant and its authorised staff, or payment, communications and other integration providers involved in the relevant service. A restaurant may import its existing customer records into Choppr and is responsible for having authority to do so and explaining that use to you.
Allergy or dietary information supplied to a restaurant may reveal health or religious information. Please provide only what is needed for your request. The restaurant is responsible for identifying the lawful basis and any additional condition needed to use that information; Choppr handles it on the restaurant's instructions.
3. Why Choppr uses information
For activities where Choppr is the controller, our purposes and lawful bases are:
| Purpose | Lawful basis |
|---|---|
| Respond to a prospective customer's enquiry and arrange a subscription | Steps requested before entering a contract, where the contract is with the individual; otherwise legitimate interests in communicating with business representatives and arranging our services. |
| Administer subscriptions, authorised users, billing and service communications | Performance of our contract where the individual is a party; otherwise legitimate interests in managing our relationship with the subscribing business. |
| Respond to support enquiries and resolve service issues | Performance of a contract where applicable; otherwise legitimate interests in assisting users and maintaining a reliable service. Restaurant records accessed for support are processed on the restaurant's instructions. |
| Protect our website and service against fraud, misuse and unauthorised access | Legitimate interests in protecting users, information and our business; legal obligation where a specific legal duty applies. |
| Maintain accounting records and comply with tax, regulatory or binding legal requirements | Legal obligation. |
| Handle complaints and establish, exercise or defend legal claims | Legitimate interests in resolving disputes and protecting legal rights. |
| Assess or carry out a proposed business sale, merger or restructuring, using information for which Choppr is controller | Legitimate interests in evaluating and completing business transactions and maintaining service continuity, subject to necessity, confidentiality and the safeguards in section 6. |
We consider the effect on individuals when relying on legitimate interests. You can contact us to ask about those interests or object to the processing.
For restaurant activities, the restaurant determines the lawful basis for each purpose. An order or reservation and optional marketing are separate purposes. Our processing agreement does not give a restaurant permission to send marketing without satisfying the applicable rules.
4. Information you need to provide
Forms identify information needed to create or administer an account, respond to a request or complete a transaction. Without the relevant contact, order, delivery or payment information, we or the restaurant may be unable to provide the requested service. Optional marketing permission is not required to place an order or make a reservation. Only provide sensitive details where they are necessary for your request.
5. Marketing and your choices
Restaurants must have an appropriate lawful basis and satisfy applicable electronic marketing rules before using Choppr to send marketing. This may involve consent or the limited existing-customer soft opt-in, where all its conditions are met. Supplying a telephone number, making a booking or placing an order does not automatically give unrestricted marketing permission.
Marketing permissions and objections relate to the relevant restaurant and communication channel. A restaurant importing a contact must establish that it is eligible for the intended marketing; import alone does not establish permission.
You can object to direct marketing at any time, and withdraw marketing consent without affecting your ability to order or book. Use the working unsubscribe method supplied with the message or contact the restaurant. Only reply STOP where the message offers that supported method. If you contact [email protected], include the restaurant's name and the email address or telephone number concerned so that we can route and assist with your request.
Preference and limited suppression records are used to prevent further unwanted marketing. An opt-out does not prevent service messages genuinely needed for an existing order, booking or account. Withdrawing consent does not affect processing lawfully carried out before withdrawal. Choppr's own account and service notifications are separate from restaurant marketing. They are used to communicate information needed to administer, protect or provide your service and do not include promotional offers.
6. Who information is shared with
Mobile numbers and marketing consent
Choppr will not sell or share mobile numbers or customer consent information with third parties or affiliates for marketing or promotional purposes. This includes SMS opt-in records and consent to receive marketing messages.
Service providers that help us deliver messages may process the information needed to provide that service on our behalf or on behalf of the relevant restaurant, under contractual restrictions. They must not use this information for their own marketing or promotional purposes. The other disclosures described in this policy do not permit the sale or sharing of mobile numbers or customer consent information for third-party or affiliate marketing.
Information is made available only where needed for the relevant purpose. Recipients may include:
- The restaurant handling your transaction and its authorised staff.
- Cloud hosting, database storage, backup and infrastructure-security providers.
- Email and SMS delivery providers receiving the recipient details, content and delivery information needed to send messages.
- Payment processing and fraud-prevention providers handling the relevant transaction.
- Delivery services or other integrations selected and authorised by the restaurant.
- Professional advisers, such as accountants, legal advisers and insurers, where relevant to their work.
- Courts, regulators, law-enforcement bodies or other recipients where disclosure is legally required or justified for the protection of legal rights.
We limit disclosure to information needed for the recipient's role. Providers processing information on our behalf are subject to appropriate contractual obligations. Some recipients, including payment providers for certain activities, determine their own purposes and explain those activities in their own privacy notices.
Restaurants receive a separate named sub-processor register as part of their service arrangements, with notice of changes as set out in our data-processing schedule. A restaurant may separately share information with its own partners under its own privacy notice.
Business sales and restructuring
If a sale, merger or restructuring of all or part of Choppr's business is proposed or completed, relevant personal information may be disclosed to prospective or actual buyers, their advisers or the successor business where necessary and lawful. We will limit access, use anonymised or redacted information where practicable, and apply confidentiality and security safeguards. Recipients must not use information disclosed for transaction assessment for unrelated purposes.
Restaurant customer data that we hold as processor remains subject to the restaurant's instructions and our processing agreement. This notice does not independently authorise us to sell that data or repurpose it. Any transfer must respect applicable contractual requirements and data-protection obligations. We will provide required information about changes affecting who is responsible for personal information and how it is used.
7. Where information is stored and processed
Choppr’s main customer database and its backups are stored in the United Kingdom. We use an email delivery service configured in Ireland, which receives the recipient details and message content needed to send emails.
Other processing locations depend on the providers and features used, including any remote access. UK database and backup storage does not mean that every payment, communications or integration provider processes information exclusively in the UK. Where personal information is transferred outside the UK in circumstances requiring safeguards, the transfer must be covered by an applicable UK adequacy arrangement or another lawful transfer mechanism, such as an International Data Transfer Agreement or UK Addendum, with the required assessment and additional protections where necessary.
You can contact [email protected] for information about the locations and safeguards relevant to your information and how to obtain a copy of applicable safeguards. Restaurants also receive the relevant provider and location information under their processing arrangements.
8. How long information is kept
We apply retention periods or criteria according to the purpose and our role. A restaurant's subscription does not justify keeping every customer record indefinitely.
| Information | Retention period or criteria |
|---|---|
| Restaurant customer and staff records during service | Kept on the restaurant's documented instructions for its orders, reservations, loyalty, communications and administration. The restaurant determines appropriate periods for those purposes and may instruct earlier deletion, subject to applicable legal obligations. |
| Restaurant data when the service ends | The restaurant has 30 days to request an export, without renewing. We delete live restaurant personal data without undue delay after that window and completion of any timely requested export. The restaurant can instruct earlier return or deletion. During the exit period, data is restricted to the exit process and necessary protection. |
| Residual backups of deleted restaurant data | Expire or are removed within 14 days after live-system deletion. Pending removal, deleted data is beyond ordinary use; deletion instructions are reapplied after a recovery restoration. |
| Choppr business-account and contact records | Kept during the relationship. After closure, records are restricted to those needed to settle outstanding amounts, resolve open issues, meet legal recordkeeping duties or handle identifiable legal claims. We assess the applicable recordkeeping and claim periods and remove records when those purposes end. |
| Choppr invoices and tax records | Kept for the period required by the applicable accounting or tax rules, taking account of the relevant accounting period and any ongoing enquiry requiring longer retention. This does not justify retaining an entire restaurant customer database. |
| Support enquiries and complaints | Kept while the issue and related follow-up remain open, and afterwards only where the record is needed to establish service history, resolve a related dispute or meet an identified legal requirement. We remove unnecessary attachments and customer data once no longer needed for that purpose. |
| Security and diagnostic records | Retention is determined by the detection and investigation period needed for the relevant security risk. Records connected to an identified incident may be retained until investigation, remediation and related proceedings are complete. |
| Marketing permissions and suppression records | Permission evidence is retained while relied on and for the period needed to resolve related complaints or demonstrate compliance. Minimum opt-out details are retained while necessary to prevent reintroduction into marketing lists. Where we act as processor, the restaurant's instructions and the exit arrangements above apply. |
Cancelling one feature does not require deletion of data still needed for other continuing services. Information retained to comply with law or address a specific claim is restricted to that purpose. We may retain genuinely anonymised information that no longer identifies individuals.
9. Security
We use technical and organisational measures appropriate to the information and risks, including controls over authorised access, secure communications, service maintenance and recovery arrangements. Access must be limited to people who need it for their duties. No internet service can promise absolute security. Please protect your credentials and report suspected unauthorised access to [email protected].
Our automated anti-spam controls are designed to detect and restrict bots, repeated submissions and excessive requests. They use relevant technical and request information for service protection; they are not designed to assess genuine customers' purchasing behaviour or decide whether those customers should be allowed to order. If you believe a security control has blocked you incorrectly, contact [email protected] so we can investigate.
10. Cookies and similar technologies
Choppr’s public information website does not use cookies. The Choppr system, including restaurant ordering pages and account areas, uses cookies or similar storage needed for requested functions such as signing in, maintaining sessions, remembering a basket and completing checkout, together with necessary security functions. Choppr does not install visitor analytics or advertising trackers for its own purposes.
A restaurant may choose to install its own analytics, advertising pixels or other tracking tools on its Choppr-powered pages. The restaurant must explain those tools in its privacy and cookie information, including their providers, purposes and duration. Where consent is required, the tools must remain inactive until you agree, and you must be able to refuse or withdraw consent. Advertising tracking requires prior consent. Where a lawful exception applies to a particular technology, all conditions of that exception must be met, including information and objection requirements where applicable.
The restaurant is responsible for the tools it selects and the purposes for which it uses their information. Choppr remains responsible for obligations applying to its own role in implementing or operating those tools. A restaurant installing a tool does not by itself establish that the tool is lawful or authorised by the visitor.
Information about the cookies and storage actually used, including their purposes and duration, must be available on the relevant website or ordering pages. Browser controls can also remove or block cookies, although blocking necessary storage may prevent requested functions from working.
11. Your rights and complaints
Depending on the processing and applicable law, you may ask to access, correct, erase or restrict your personal information, obtain it in a portable format, or object to processing. Rights are subject to applicable conditions and exceptions. You have the right to object to direct marketing, and you may withdraw consent whenever processing relies on it.
Contact [email protected] for processing controlled by Choppr. For restaurant customer records, contact the restaurant; we will assist it with requests and route requests sent to us. We may ask for information reasonably needed to verify identity and identify the records concerned.
You can complain to the Information Commissioner's Office (ICO) at ico.org.uk/make-a-complaint. You do not have to contact us first, although we are happy to help resolve concerns.
External websites
Our website and restaurant pages may contain links to websites operated by other organisations. Those websites have their own privacy notices explaining how they handle information you provide to them. A link does not mean that Choppr controls or endorses their privacy practices. Please review their notices before submitting personal information. This does not remove Choppr's responsibilities for information it collects or discloses through its own services.
12. Changes and contact
We will update this policy when our data practices change and show the current date. Where appropriate, we will provide additional notice before materially different processing begins.
Privacy contact: [email protected]
Company: I-GALAXY MEDIA LIMITED, trading as Choppr
Registered office: 4th Floor Hamilton House, Mabledon Place, London, England, WC1H 9BB.