COOK Privacy Notice

Effective Date: Aug 2026

Last Updated: Aug 2026

At COOK, protecting your privacy is important to us. We want you to enjoy shopping with us, online or in-store, while keeping you in control of your personal data. This Privacy Notice explains:

What personal data we collect
How we use it
Who we share it with
Your rights and how to exercise them

You can contact us anytime at privacy@cookfood.net for questions or requests.

1. About COOK

COOK refers to all businesses trading under the COOK brand. COOK is primarily operated by COOK Trading Ltd (company number 04611064, registered at The Cook Kitchen, Eurolink Way, Sittingbourne, Kent, ME10 3HH). Most COOK shops are owned and operated directly by COOK Trading Ltd, although some shops are independently owned and operated by franchisees.

“We,” “us,” or “our” means COOK Trading Ltd and, where relevant, its franchisees.

COOK Trading Ltd and franchisees work closely together and use shared systems and processes across the COOK network.

When you shop online at www.cookfood.net, COOK Trading Ltd acts as the data controller for your personal data.

For in-store activities, such as purchases made directly in a COOK shop or the use of CCTV, the relevant shop operator acts as the data controller. For most COOK shops this will be COOK Trading Ltd, but for franchised shops it will be the relevant franchisee.

In many cases, including order fulfilment, Click & Collect, and the use of our central systems (such as customer accounts, order management, and POS systems), COOK Trading Ltd and franchisees jointly determine how and why personal data is used. In these situations, we act as joint controllers.

For certain services, such as payment processing, franchisees may have their own direct relationships with third-party providers. However, these services operate within COOK’s shared systems and processes, and in many cases COOK Trading Ltd and franchisees jointly determine how personal data is used.

We have arrangements in place with our franchisees to define our respective responsibilities for protecting your personal data. You can contact us at privacy@cookfood.net if you would like more information about these arrangements.

Privacy matters are overseen by our central privacy team, contactable at privacy@cookfood.net.

2. Understanding the Legal Bases We Rely On

Data protection law sets out several reasons why a company may collect and use personal data. Here's how each one applies to COOK:

Consent

Where you've given us permission to use your data for a specific purpose - for example, by signing up for our email newsletter. You can withdraw your consent at any time.

Contract

Where we need your data to fulfil an order or provide a service. For example, when you place a home delivery order, we'll share your address with our courier so we can get your food to you.

Legal compliance

Where the law requires us to collect or share your data - for example, passing details to law enforcement where fraud or criminal activity is involved.

Legitimate interests

Where we have a reasonable business need to use your data that doesn't unfairly impact your rights. For example, we may use your purchase history to personalise offers or analyse shopping trends across our customer base to improve our products and plan for demand.

A note on soft opt-in

If you've shopped with us and haven't opted out of marketing emails, we may contact you about products and offers we think you'd enjoy. This is known as a 'soft opt-in' and is permitted under UK rules. You can opt out at any time - see Section 8 (‘Your Rights’).

3. Personal Data We Collect

We collect personal information to provide services, improve your experience, and communicate relevant offers. This may include:

Type of Data	Purpose	Legal Basis
Name, address, email, phone	Order fulfilment, refunds, delivery	Contract
Payment information (processed via secure providers)	Payment processing	Contract
Account login details	Account management	Contract
Transaction & purchase history	Customer service, tailored offers	Contract / Legitimate interest
Website activity, IP address	Site analytics, website improvement	Legitimate interest / Legal Compliance
Social media interactions	Marketing and engagement	Consent
CCTV images	Safety, security, crime prevention	Legitimate interest / Legal Compliance
Loyalty and discount programme data	Programme participation	Consent / Contract
Telephone calls	Customer service, training, quality assurance, fraud prevention, compliance	Legitimate interest / Legal Compliance

We may analyse your purchase history and interactions with COOK to better understand customer preferences and provide personalised recommendations and offers. This does not involve automated decision-making that produces legal or similarly significant effects.

4. How We Use Your Data

We use your personal data to:

Process orders and deliveries
Respond to enquiries, complaints, or refund requests
Contact you regarding important safety information
Provide tailored offers and marketing communications based on your consent or our legitimate interests where permitted under PECR and UK GDPR (including soft opt-in rules for existing customers).
Protect against fraud and ensure security
Improve our products, services, and website
Comply with legal and regulatory obligations
Use your purchase history to make personalised recommendations (this does not involve any decisions with legal or similarly significant effects)

We do not sell your personal data to third parties.

5. Sharing Your Data

We may share your personal data with trusted partners where necessary, including:

Delivery services and COOK franchisees – to fulfil Click & Collect and Home Delivery orders
IT, hosting, and cloud service providers – to run our website, databases, and internal systems
Marketing and email communication platforms – to send newsletters, offers, and SMS communications where you have consented
Analytics, website performance, and customer feedback providers – to improve our website, services, and customer experience (for example, online review platforms)
Customer support tools – including live chat systems for responding to enquiries
Routing and logistics software – to plan delivery routes efficiently
Affiliate and referral platforms – to manage commissions or refer-a-friend programmes

Where personal data is transferred outside the UK, we use appropriate safeguards such as UK adequacy regulations, the International Data Transfer Agreement (IDTA), or approved contractual clauses.

Other sharing

We will never sell or trade your personal data. In some cases, we may share your data with third parties for their own purposes if you have given consent, for example, if you enter a competition and agree to receive promotional information from a partner.

We may also share personal data where required by law or to protect our legal rights, such as:

Preventing fraud or other illegal activity in our shops or systems
Responding to requests from law enforcement or government authorities
Managing potentially fraudulent activity in our premises or systems

6. Cookies and Online Tracking

We use essential cookies required for the operation of our website. We also use analytics, functionality, and marketing cookies where you have provided consent through our cookie preference tools. You can manage or withdraw your cookie preferences at any time.

Full details are available in our Cookie Policy.

7. Data Retention

We retain personal data only for as long as necessary for the purposes for which it was collected:

Order and transaction records: 7 years
Competition entries: 3 months

Customer accounts inactive for 7 years are anonymised or securely deleted.

We retain marketing preferences and consent records for as long as you continue to engage with our communications, or until you withdraw your consent or opt out of marketing.

Telephone & CCTV Recordings are stored securely, and access is restricted to authorised individuals only. We will retain recordings only for as long as necessary in line with our retention policies and legal obligations.

In some circumstances, we may retain personal data for longer where required to comply with legal obligations, resolve disputes, enforce agreements, or establish, exercise, or defend legal claims.

8. Your Rights

Under UK GDPR, you have the following rights:

Right	How to Exercise
Access	Request a copy of your personal data.
Rectification	Ask us to correct inaccurate or incomplete data via email or your online account (www.cookfood.net/your-account). We may ask you to verify your identity before making changes.
Erasure	Request deletion or anonymisation of your data where legally possible.
Restriction	Ask us to limit processing in certain circumstances.
Objection	Object to processing based on legitimate interests or for marketing purposes.
Data portability	Receive your data in a commonly used format (where processing is automated and based on consent or contract).
Withdraw consent	Withdraw consent for marketing at any time.

Guidance to Managing Your Rights

Marketing and direct communications

You can stop direct marketing communications by:

Clicking the ‘unsubscribe’ link in any marketing email we send
Updating your preferences in your online account at www.cookfood.net/your-account
Contacting our Privacy team at privacy@cookfood.net

Please allow a short period for our systems to update - usually up to 2 weeks for email and 12 weeks for postal communications.

Accessing and correcting your personal data

You can access or correct your personal data at any time through your online account. Alternatively, you can email us at privacy@cookfood.net. We may need to verify your identity before making any changes. If a third-party acts on your behalf, we will confirm that they have your permission to do so.

Legitimate business interests

If we process your personal data based on our legitimate interests, you can ask us to stop processing for reasons related to your individual situation. We must stop unless we have a compelling overriding reason to continue.

Response time

We normally respond to requests within 30 days, in line with UK GDPR. If we refuse a request, we will explain the reason.

9. Making a Request

We handle data protection requests through a secure process:

Contact us at privacy@cookfood.net
We log the request, verify identity where required, and track progress.
You receive confirmation and notification once the request is completed.

For guidance on exercising your rights, including marketing preferences, see Section 8 (‘Your Rights’).

10. Children’s Data

We sell some meals intended for children; however, our products and services are purchased by adults. We do not knowingly collect personal data directly from children under the age of 16.

11. Security

We use appropriate technical and organisational measures to protect personal data, including access controls, encryption, and staff training.

12. Complaints

If you’re not satisfied with how we’ve handled your personal data, please contact our privacy team first so we can try to resolve the issue, see Section 8 (‘Your Rights’).

If you remain unhappy, you have the right to make a complaint to the Information Commissioner’s Office (ICO):

Phone: 0303 123 1113
Website: https://ico.org.uk/
Postal address: Information Commissioner’s Office, Wycliffe House, Water Lane, Wilmslow, Cheshire SK9 5AF

13. Updates

We may update this Privacy Notice from time to time. Significant changes will be highlighted on our website. The most current version is always available online.