Planthood Ltd — Terms, Policies and Notices

PRIVACY POLICY
Effective from August, 2026. Version 1.

This Privacy Policy explains how Planthood Ltd ("Planthood", "we", "our" or "us") collects, uses, stores and protects your personal information when you use our Website, purchase our products or otherwise interact with us.

Please read this Privacy Policy together with our Terms & Conditions and Cookie Policy.

1. About This Privacy Policy

1.1 Who We Are

Planthood Ltd is the controller of the personal information described in this Privacy Policy.

Our company details can be found in Clause 1.2 of our Terms & Conditions.

1.2 Contacting Us

If you have any questions about this Privacy Policy or how we use your personal information, please contact our Customer Success Team:

Email: support@planthood.co.uk

If you wish to exercise your data protection rights, please contact us using the details above.

1.3 Data Protection Registration

Planthood Ltd is registered with the Information Commissioner's Office (ICO).

Our ICO registration number is: ZB203796

1.4 Changes to this Privacy Policy

We may update this Privacy Policy from time to time to reflect changes in legislation, regulatory guidance, technology or the way we operate our business.

The latest version will always be published on our Website.

Where changes materially affect how we process your personal information, we will provide appropriate notice where required by law.

2. Personal Information We Collect

2.1 Information You Provide to Us

Depending on how you interact with us, we may collect:
  • your name;
  • billing address;
  • delivery address;
  • email address;
  • telephone number;
  • delivery instructions;
  • dietary preferences;
  • allergen information that you choose to provide;
  • account information;
  • subscription preferences; and
  • order history.

2.2 Payment Information

Payments are processed securely by our authorised payment providers.

We do not receive or store your full payment card details.

We may receive limited payment information, including:
  • payment status;
  • payment method;
  • card type; and
  • the last four digits of your payment card.

2.3 Account Information

When you create an account we collect:
  • your email address;
  • encrypted login credentials;
  • subscription settings;
  • saved delivery information; and
  • communication preferences.
Passwords are stored using secure encryption and cannot be viewed by Planthood employees.

2.4 Customer Support Information

When you contact us, we may collect:
  • emails;
  • live chat messages;
  • contact forms;
  • telephone call records where applicable;
  • photographs you send us;
  • food safety reports;
  • complaint information; and
  • notes recorded by our Customer Success Team.

2.5 Website Usage Information

When you visit our Website, we may automatically collect information including:
  • IP address;
  • approximate geographic location;
  • browser type;
  • operating system;
  • device information;
  • pages visited;
  • referral source;
  • time spent on our Website;
  • search activity; and
  • cookie identifiers.
This information helps us understand how our Website is used and improve our services.

Further information can be found in our Cookie Policy.

2.6 Referral Programmes and Competitions

Where you participate in a referral programme, competition or promotional campaign, we may collect information relating to:
  • your referral activity;
  • promotional eligibility;
  • competition entries;
  • prize fulfilment; and
  • relationships between referral accounts where reasonably necessary to prevent fraud.

3. How We Use Your Information

3.1 Fulfilling Your Orders

We use your personal information to:
  • process orders;
  • prepare meal boxes;
  • deliver products;
  • manage subscriptions;
  • process payments; and
  • provide customer support.
Legal basis: Performance of a contract.

3.2 Customer Communications

We use your information to send:
  • order confirmations;
  • delivery updates;
  • subscription reminders;
  • renewal notifications;
  • important service announcements; and
  • updates to our Terms or policies.
Legal basis: Performance of a contract.

3.3 Marketing

Where permitted by law, we may send you marketing communications relating to our products and services.

Legal basis:
  • Consent; or
  • Legitimate Interests (soft opt-in under PECR).
You can unsubscribe at any time.

3.4 Fraud Prevention

We use your information to:
  • detect fraudulent activity;
  • investigate chargebacks;
  • prevent misuse of promotional offers;
  • prevent multiple account abuse;
  • investigate suspicious orders; and
  • protect our employees and customers.
Legal basis: Legitimate Interests.

3.5 Improving Our Services

We analyse Website usage, customer behaviour and product performance to improve our services.

Legal basis:
  • Legitimate Interests; and
  • Consent where cookies require it.

3.6 Advertising

Where you consent, we may use cookies and similar technologies to display relevant advertising on third-party platforms.

Legal basis: Consent.

3.7 Legal Compliance

We may process personal information where necessary to:
  • comply with legal obligations;
  • maintain food safety traceability;
  • meet accounting and tax requirements;
  • respond to lawful requests from regulators; and
  • protect our legal rights.
Legal basis: Legal Obligation.

3.8 Legitimate Interests

Where we rely on Legitimate Interests as our legal basis, we carefully balance our interests against your rights and freedoms.

You may request further information about these assessments by contacting us.

3.9 Withdrawal of Consent

Where processing is based on your consent, you may withdraw that consent at any time.

Withdrawal of consent will not affect processing already carried out before consent was withdrawn.

4. Sharing Your Personal Information

4.1 Who We Share Your Information With

We only share your personal information where it is reasonably necessary to provide our services, operate our business, comply with legal obligations or protect our legitimate interests.

Depending on the circumstances, we may share your information with:
  • payment service providers;
  • delivery partners;
  • technology and cloud service providers;
  • customer support platforms;
  • fraud prevention and identity verification providers;
  • analytics providers;
  • marketing service providers (where permitted by law);
  • professional advisers, including legal and accounting advisers; and
  • regulators, law enforcement agencies or public authorities where required by law.
All third parties are required to protect your personal information and only process it in accordance with our instructions or their own legal obligations.

4.2 Delivery Partners

To deliver your orders, we share the information necessary to complete the delivery, including your:
  • name;
  • delivery address;
  • contact telephone number (where required);
  • delivery instructions; and
  • order reference.
Our current delivery partner is DPD, although we may use alternative delivery providers from time to time.

4.3 Payment Providers

Payments are processed securely by our authorised payment providers.

We do not receive or store your full payment card details.

Payment providers process your payment information in accordance with their own privacy policies.

4.4 Business Transfers

If Planthood is involved in a merger, acquisition, investment, business restructuring or sale of all or part of its assets, your personal information may be transferred as part of that transaction, subject to appropriate confidentiality obligations.

5. International Transfers

5.1 Transfers Outside the United Kingdom

Some of our service providers may process personal information outside the United Kingdom.

Where this occurs, we ensure that appropriate safeguards are in place to protect your information in accordance with UK data protection legislation.

These safeguards may include:
  • UK International Data Transfer Agreements (IDTAs);
  • the UK Addendum to the EU Standard Contractual Clauses;
  • adequacy regulations approved by the UK Government; or
  • other lawful transfer mechanisms recognised under UK GDPR.

5.2 Protecting Your Information

Where personal information is transferred internationally, we take reasonable steps to ensure that it continues to receive an appropriate level of protection and is processed securely.

6. How Long We Keep Your Information

6.1 Retention Periods

We retain personal information only for as long as reasonably necessary for the purposes described in this Privacy Policy, including to:
  • provide our services;
  • comply with legal obligations;
  • resolve disputes;
  • investigate complaints;
  • prevent fraud; and
  • enforce our legal rights.

6.2 Typical Retention Periods

Retention periods vary depending on the type of information involved.

Examples include:
Information Typical Retention Period
Customer account information Until your account is deleted, plus a reasonable period where required for legal or fraud prevention purposes
Order history Up to 7 years
Payment records Up to 7 years
Customer support correspondence Up to 6 years
Food safety investigation records As required by applicable food safety legislation and business needs
Marketing preferences Until you unsubscribe or withdraw consent
Fraud prevention records For as long as reasonably necessary to protect our business and customers

6.3 Deletion

When personal information is no longer required, we securely delete or anonymise it unless we are legally required or permitted to retain it for a longer period.

7. Your Rights

7.1 Your Data Protection Rights

Under UK data protection law, you may have the right to:
  • access the personal information we hold about you;
  • request correction of inaccurate or incomplete information;
  • request deletion of your personal information in certain circumstances;
  • request restriction of processing;
  • object to certain types of processing;
  • withdraw consent where processing is based on consent;
  • request the transfer of your personal information to another organisation (data portability); and
  • complain to the Information Commissioner's Office (ICO).
Some of these rights are subject to legal limitations and exemptions.

7.2 Exercising Your Rights

To exercise any of your rights, please contact us at:

Email: support@planthood.co.uk

We may ask you to verify your identity before responding to your request.

We aim to respond within one month, although this may be extended where permitted by law.

7.3 Marketing Preferences

You may opt out of receiving marketing communications at any time by:
  • clicking the "unsubscribe" link in our emails;
  • updating your account preferences; or
  • contacting our Customer Success Team.
Even if you opt out of marketing communications, we will continue to send essential service communications relating to your orders and subscriptions.

7.4 Complaints

If you are unhappy with how we have handled your personal information, we encourage you to contact us first so that we can try to resolve your concerns.

You also have the right to lodge a complaint with the Information Commissioner's Office (ICO).

Website: https://ico.org.uk/
Telephone: 0303 123 1113

8. Security

8.1 Protecting Your Personal Information

We take the security of your personal information seriously and use appropriate technical and organisational measures designed to protect it against unauthorised access, loss, misuse, alteration or disclosure.

These measures may include:
  • encrypted data transmission;
  • secure servers;
  • restricted employee access;
  • password protection;
  • multi-factor authentication where appropriate;
  • regular security monitoring;
  • staff training on information security; and
  • supplier security assessments where appropriate.
While no method of storing or transmitting information over the internet can be guaranteed to be completely secure, we continually review and improve our security practices.

8.2 Personal Data Breaches

If we become aware of a personal data breach that is likely to result in a risk to your rights and freedoms, we will respond in accordance with applicable UK data protection legislation.

Where required, we will notify the Information Commissioner's Office (ICO) and affected individuals without undue delay.

9. Automated Decision-Making

9.1 Fraud Detection and Promotional Abuse

We may use automated systems to identify unusual account activity, suspected promotional misuse, suspected fraud or other activity that may affect the integrity of our services.

Examples may include:
  • multiple customer accounts;
  • repeated use of introductory promotions;
  • unusual ordering patterns;
  • suspected payment fraud; or
  • suspected abuse of referral programmes.
where reasonably necessary to prevent fraud or misuse.

9.2 Human Review

Automated systems are used only to assist our fraud prevention processes.

Where an automated system identifies activity requiring further review, a member of our team will assess the information before any significant action is taken, wherever reasonably practicable.

If you believe a decision has been made incorrectly, you may contact us at support@planthood.co.uk to request that the decision be reviewed.

10. Children's Privacy

10.1 Age Requirement

Our Website, products and subscription services are intended for individuals aged 18 years or over.

We do not knowingly collect personal information directly from anyone under the age of 18.

10.2 Children's Personal Information

If we become aware that personal information has been collected from a child without appropriate authorisation, we will take reasonable steps to delete that information as soon as reasonably practicable.

If you believe that a child has provided personal information to us, please contact us using the details provided in this Privacy Policy.

11. Changes to this Privacy Policy

11.1 Updating this Privacy Policy

We may update this Privacy Policy from time to time to reflect:
  • changes in applicable law or regulatory guidance;
  • changes to our business or services;
  • improvements to our security practices;
  • changes to the way we process personal information; or
  • other operational or legal requirements.
The latest version will always be published on our Website.

11.2 Notification of Changes

Where we make significant changes to this Privacy Policy that materially affect how we process your personal information, we will provide appropriate notice, which may include email notification or a notice on our Website, where required by law.

The "Last Updated" date shown at the top of this Privacy Policy indicates when it was most recently revised.