Privacy Policy

1. Who is responsible for your information?

JAWA AI LTD operates JAWA.FOOD. We act as controller when deciding how to use information to provide public business discovery, maintain the catalogue, protect the service, respond to enquiries and keep necessary legal records.

The restaurant, takeaway or other business is responsible for how it uses information you provide directly to it. Contact that business about its orders, bookings, delivery arrangements or records. This notice explains JAWA.FOOD's own catalogue website and does not replace a business's privacy notice.

Approved public business and menu details can be supplied through the JAWA business platform. Public pages use JAWA.FOOD's catalogue; private customer, order and staff records are outside that catalogue. Public business contact details may nevertheless identify a sole trader or another individual.

2. What information do we handle?

Search and browser information

The postcode, search words, cuisine and service choices, sort order and other filters you submit, together with IP addresses, browser/device information and requests needed to deliver and protect the website.

Public business information

Approved business names, public addresses and contact details, locations, menu information, prices, opening hours and fulfilment details supplied for the catalogue.

Support and communications

The contact details and correspondence you choose to send us when asking a question, reporting a listing or exercising a right.

Browser preferences

Your cookie choice, the appearance setting you request and any basket you build on your device. Our Cookie Policy explains the relevant cookies, local storage and their duration.

Checkout preview

In an explicitly enabled development or staging preview, starting checkout sends the basket to us to create a private draft. Reviewing valid details saves your name, mobile number, email, delivery address where needed and notes in encrypted fields. The preview cannot send an order to a business or take payment. Its marketing tickbox does not record consent while order placement is unavailable.

Optional JAWA account sign-in

JAWA ID in JAWA.MENU handles your password, email confirmation and any configured Google or Apple sign-in. FOOD receives your verified account reference, name and email, and keeps encrypted display details and encrypted sign-in tokens in its own private database. We use these to maintain your requested FOOD session and prefill checkout; they give no access to a business. FOOD never receives your password or a Google or Apple provider token.

A postcode is needed to find nearby businesses; without it, the current service cannot show location-based results. You can browse public policy pages without supplying one. Search does not create a customer account, order record or payment profile.

Search information appears in the page URL and may remain in browser history, copied links and infrastructure logs. The application filters postcode and search-word parameters from Rails logs, but the deployment's wider logging and retention arrangements must be confirmed. Search words are only matched against public business names, cuisines and menus, so please do not type personal details into the search box or provide unnecessary sensitive information in an enquiry.

3. Why do we use it?

We rely on legitimate interests in providing the local discovery service you request, maintaining accurate public business information, protecting the website against misuse and responding to enquiries, balanced against the interests and rights of the people concerned. Where a specific legal recordkeeping or disclosure duty applies, we rely on that legal obligation.

Your submitted postcode is used to find an approximate location and compare nearby businesses or supplied delivery coverage. Search words, cuisine and service choices and other filters refine or reorder those results. We do not infer a confirmed delivery service merely because a business is nearby.

There are no optional analytics or advertising cookies in this application. A saved accept choice does not authorise future tracking, new recipients or new purposes. Any future activity requiring consent needs a specific explanation and fresh choice before it begins.

The current catalogue does not make decisions about individuals based solely on automated processing that produce legal or similarly significant effects.

4. Who receives information?

Authorised service personnel and providers of hosting, database and support services may receive information needed to operate or support the deployment. We may also disclose necessary information to professional advisers or where required by law.

For postcode searches and delivery checks, the server sends the postcode to Postcodes.io when an approximate location is not already available in its lookup cache. When you request an interactive business map, or open the optional checkout preview, the browser loads map resources from OpenFreeMap. Those requests disclose the browser's IP address and the map area being viewed to that provider. Address text is not sent to the map tile provider.

JAWA ID in JAWA.MENU receives sign-in requests and authenticates your account; Google or Apple is contacted by JAWA ID only when you choose an enabled provider. FOOD does not currently send an order to a business, process card payments or run delivery tracking. The deployment's actual suppliers, processing locations and applicable transfer safeguards must be confirmed below. We do not promise that all processing takes place in the UK.

Contact us for information about applicable transfer safeguards and how to obtain a copy.

Service providers, purposes and locations

Pending confirmation before production use.

International transfers and safeguards

Pending confirmation before production use.

5. How long is information kept and how is it protected?

Public catalogue information, enquiries, service logs and legal records should be kept only for the time justified by their purpose, legal duties or relevant legal claims. The deployment's periods, withdrawal/correction process and backup expiry still need confirmation where the schedule is blank. Removing a public listing does not automatically erase copies in every log, backup or external source.

Postcode-to-coordinate reference lookups use a bounded in-memory cache: successful results can remain for 30 days and unsuccessful lookups for one minute. That cache does not create a customer profile or order record. Cookie and local-storage durations are explained separately in the Cookie Policy.

Checkout drafts expire after 24 hours. The configured retention job deletes older drafts when it next runs. The deployment must operate this job, and confirm backup expiry, before enabling the preview. Drafts and their personal details are kept outside the public catalogue.

The application limits its public catalogue to approved fields, separates it from private business records and uses protected session and preference cookies with request-forgery protection for preference changes. The wider operational security arrangements for the deployment must be confirmed below; these statements do not promise that planned controls are already operated.

Retention, backup expiry and deletion process

Pending confirmation before production use.

Technical and organisational security measures

Pending confirmation before production use.

6. Your choices and rights

You may ask for access to your personal information, correction, erasure, restriction or portability where the relevant right applies. Rights depend on the processing and can have legal conditions and exceptions. We may need to verify your identity. We will respond within the applicable statutory period, normally one month, subject to permitted timing rules and extensions.

Where separate processing relies on consent, you may withdraw that consent without affecting earlier lawful processing. You can change your browser cookie preference at any time in the Cookie Policy. Rejecting optional cookies does not prevent essential security functions.

Use the contact details below for information we control. For information held independently by a restaurant or takeaway, contact that business. You can also complain to the Information Commissioner's Office or another competent supervisory authority; you do not have to contact us first.

You have the right to object to processing based on legitimate interests. You can object to direct marketing at any time.

Cookie Policy · Complain to the Information Commissioner's Office

7. Contact and updates

Legal service provider

JAWA AI LTD

Company number

15815826

Business / registered address

53 Dorcas Avenue, Newcastle Upon Tyne, United Kingdom, NE15 6SL

Service and privacy enquiries

[email protected]

We will update this notice when the service or relevant processing changes and identify the revision date above. Where needed, we will bring material changes to your attention before new processing begins.