Privacy Policy
Legend Kebab & Grill ("we", "us", "our")
Website: thelegendkebab-grill.co.uk
Last updated: 04 August 2026
1. Who we are
Legend Kebab & Grill operates this website to take and fulfil your food orders. This site is built and run on the BiteLink platform, provided by BiteLink Ltd.
For most of your personal data, Legend Kebab & Grill is the data controller — we decide why and how it's used to give you the ordering service you've asked for. BiteLink Ltd acts as our data processor for the technology involved (hosting, checkout, order storage). There are two specific exceptions where BiteLink itself is the controller, described in Section 4 below: session-recording and error-tracking analytics (LogRocket and PostHog) and payment visibility via Stripe.
2. What personal data we collect
| Category | Examples | Where it comes from |
|---|---|---|
| Contact & account details | Name, email, phone number | You, when you order or register |
| Delivery details | Delivery address, delivery instructions | You, including via our address lookup tool (Ideal Postcodes) |
| Order details | Items ordered, order history, timezone | You, generated as you use the site |
| Payment details | Processed by Stripe — we don't store your full card number | You, entered into Stripe's secure payment form |
| Technical & usage data | IP address, device/browser type, session and theme cookies | Automatically, as you browse |
| Session recordings, logs & error data | Clicks, scrolling, page navigation, application error events | Automatically, via LogRocket and PostHog — see Section 4 |
See our Cookie Policy for the specific cookies we use.
3. How we use your data, and our legal basis
| What we use it for | Legal basis |
|---|---|
| Taking and fulfilling your order, processing payment | Performance of a contract with you |
| Fraud prevention and account security | Legitimate interests (ours and Stripe's), and legal obligation where applicable |
| Keeping the site working, remembering your session and preferences | Legitimate interests / strictly necessary |
| Analytics, error tracking, and session replay used to improve the BiteLink platform (LogRocket, PostHog) | Consent — see Section 4 |
| Marketing communications, if you've opted in | Consent |
| Accounting and tax records | Legal obligation |
We don't use your data for automated decision-making that produces legal or similarly significant effects on you.
4. Who we share your data with
Stripe (payment processing). Payments are processed through Legend Kebab & Grill's own Stripe account, set up as a Standard connected account using Direct charges. This means Legend Kebab & Grill is the merchant of record and can see your order and payment details directly in our own Stripe Dashboard, and BiteLink Ltd, as the platform connecting this site to Stripe, also has visibility into the same transaction data through Stripe's Connect API. Stripe processes your card details directly — we never see or store your full card number. See Stripe's Privacy Policy.
BiteLink Ltd (platform provider). BiteLink hosts this site and processes your order data on our behalf as our processor, under a data processing agreement between Legend Kebab & Grill and BiteLink.
LogRocket (session analytics) — where BiteLink is the controller, not us. BiteLink Ltd uses LogRocket to record and review how visitors use sites across the BiteLink platform, so it can identify bugs and improve the platform. Legend Kebab & Grill does not have access to these recordings. Because BiteLink decides why this data is collected and what it's used for, BiteLink — not Legend Kebab & Grill — is the data controller for this specific processing. LogRocket is a US company and processes this data in the United States. BiteLink relies on the UK Extension to the EU-U.S. Data Privacy Framework as the legal mechanism for that transfer, backed by a data processing agreement with LogRocket. See LogRocket's Privacy Policy.
PostHog (logs, error tracking & session replay) — where BiteLink is the controller, not us. BiteLink Ltd also uses PostHog, for the same platform-improvement purpose as LogRocket: application logs, error tracking, and session replay across the BiteLink platform. Legend Kebab & Grill does not have access to this data either. PostHog is hosted on PostHog's EU Cloud (Frankfurt), so this processing stays within the EU. See PostHog's Privacy Policy.
Ideal Postcodes (address lookup). When you use the address autocomplete field, your search input is sent to Ideal Postcodes (IDDQD Limited) to return matching addresses. Ideal Postcodes processes UK/EU data within the UK/EU. See Ideal Postcodes' Privacy Policy.
Hetzner (hosting & file storage). BiteLink runs its servers and object storage (for images and other files) on Hetzner infrastructure, based in Germany and Finland.
Resend (email delivery). We use Resend to send order confirmations and other transactional emails. Resend is a US company — see Section 5 for how that transfer is safeguarded. We don't use SMS to contact you.
Cloudflare (website hosting). This site is published as a static site via Cloudflare's network. Cloudflare is a US company operating a global network — see Section 5.
Delivery. Delivery is handled directly by Legend Kebab & Grill — we don't share your address or contact details with a third-party courier or delivery service.
We don't sell your personal data to anyone.
5. International data transfers
Most of your data stays within the UK/EU:
- Hetzner (servers and file storage) and PostHog (logs, error tracking, session replay) are based entirely within the EEA — Hetzner in Germany and Finland, PostHog on its EU Cloud in Frankfurt — so no additional transfer safeguard is needed beyond the UK's own adequacy finding for the EEA.
- Resend (email) and Cloudflare (website hosting) are US companies. Transfers to them rely on recognised safeguards — Resend is certified under the UK Extension to the EU-U.S. Data Privacy Framework, and Cloudflare relies on Standard Contractual Clauses (with the UK Addendum) and/or the same UK Extension — each backed by a data processing agreement.
- LogRocket (Section 4) is also US-based, with data processed exclusively in the United States. BiteLink relies on the UK Extension to the EU-U.S. Data Privacy Framework for that transfer, backed by a data processing agreement with LogRocket.
6. How long we keep your data
- Order and account data: kept while your account is active, and for 6 months after your account is closed, plus any longer period we're legally required to keep transaction records for accounting/tax purposes (HMRC generally requires business records to be kept for 6 years)
- Payment records: held by Stripe under their own retention rules
- Session recordings (LogRocket): kept for 1 month by default. Separately, if a BiteLink team member watches a session, it may be kept for up to 12 months from the recording date instead, up to a quota set by BiteLink's LogRocket plan. Turning that extended-retention feature off in future wouldn't delete sessions already kept this way.
- Logs and error tracking (PostHog): kept for 14 days
- Session replay (PostHog): kept for 30 days
7. Your rights
Under UK GDPR, you have the right to:
- Access the personal data we hold about you
- Have inaccurate data corrected
- Have your data deleted in certain circumstances
- Restrict or object to certain processing
- Receive your data in a portable format
- Withdraw consent at any time, where we rely on consent (e.g. analytics or marketing cookies)
To exercise any of these rights, contact us at [email protected]. Where your request involves deleting your data, we'll also submit a full erasure request for your account through LogRocket's and PostHog's GDPR tools, which removes your session recordings and stops any future recording of your activity. If you're not satisfied with our response, you can complain to the Information Commissioner's Office (ICO) at ico.org.uk or on 0303 123 1113.
8. Cookies
We use cookies and similar technologies as described in our Cookie Policy, which explains what we use, why, and how to manage your preferences.
9. Children
This service is not directed at children, and we don't knowingly collect personal data from children.
10. Keeping your data secure
We use appropriate technical and organisational measures to protect your personal data, including secure processing of payment data via Stripe (we never handle your full card details ourselves) and access controls on the systems BiteLink operates on our behalf.
11. Changes to this policy
We may update this policy from time to time. Material changes will be highlighted, and the "Last updated" date at the top will reflect the most recent version.
12. Contact us
Questions about this policy or your data: [email protected] / Golden Grill, 1 Coronation Buildings, Ham Road, Worthing, BN11 2NN.
This website is built and hosted using the BiteLink platform, provided by BiteLink Ltd, 44 Adelaide Square, Shoreham-By-Sea, England, BN43 6LN. See BiteLink's Privacy Policy for how BiteLink itself handles data across the platform.