Privacy Policy — UK (GDPR)

📍 Select Your Region: UK (GDPR) USA (CCPA) Japan (APPI) France (RGPD)

CompliChef Lite is operated by CompliChef, a UK-based food safety compliance software company. Our servers are located in the UK. This Privacy Policy explains how we collect, use, store and protect your personal data in compliance with UK GDPR.

Data Controller: CompliChef Ltd, UK
Data Protection Enquiries: privacy@complichef.me

2. Data We Collect

Account Data

Name, email address, authentication provider (email or Apple ID), and account role.

Business Data

Business name, address, type, and region for compliance localisation.

Compliance Records

Temperature logs, hot holding sessions, reheating records, delivery checks, cooldown records, probe calibrations, cleaning tasks, checklists, and daily diary entries you create in the app.

Subscription Data

Plan type and renewal status. Payment processing is handled entirely by Apple — we never store card or payment details.

Device Data

Device UUID (for offline sync conflict resolution only) and API request metadata.

3. How We Use Your Data

We use your data solely to provide and improve CompliChef Lite:

Create and maintain your account and business profile
Store, sync, and display your compliance records
Calculate CompliClub rewards points and ranks
Generate reports and PDF exports (PDFs are processed locally on your device)
Power the opt-in CompliClub leaderboard (business name and points only)
Verify your subscription status with Apple
Send essential transactional communications

We do not use your compliance records for advertising, profiling, or any purpose beyond providing the service.

4. CompliClub Leaderboard

If you opt in to the CompliClub leaderboard, only your business name and total Chef Points are visible to other opted-in users. No personal data, staff data, or compliance records are shared. You may opt out at any time via Settings → CompliClub → Join the Leaderboard toggle, and your entry is removed immediately.

Contract Performance (Article 6(1)(b)) — Processing required to deliver the service you subscribed to.
Legitimate Interests (Article 6(1)(f)) — Service improvement, security, and fraud prevention.
Consent (Article 6(1)(a)) — Optional features such as the CompliClub leaderboard.
Legal Obligation (Article 6(1)(c)) — Where processing is required by law.

Compliance records are retained for a minimum of 12 months to support UK food safety audit requirements (HSE and local authority standards).

Account data is retained for the duration of your subscription and up to 12 months after closure to comply with UK tax and accounting obligations.

You may request full account and data deletion at any time by emailing privacy@complichef.me.

Data Location: All personal data is stored on servers located in the United Kingdom.

We use:

TLS 1.2+ encryption for data in transit
bcrypt password hashing with cost factor 12
JWT-based authentication with signed tokens
Regular security audits and penetration testing

Records created offline are stored on-device and synchronised securely over encrypted channels when connectivity is restored.

Apple Inc. — Subscription validation and Sign in with Apple (USA-based, adequacy decision applied)
UK/EEA Hosting Providers — Infrastructure partners under Data Processing Agreements compliant with UK GDPR

International transfers to USA-based services (Apple) rely on adequacy decisions and Standard Contractual Clauses.

You have the following rights under UK GDPR:

Right of Access: Obtain a copy of your personal data
Right to Rectification: Correct inaccurate data
Right to Erasure: Request deletion of your data ("right to be forgotten")
Right to Restrict Processing: Limit how we use your data
Right to Data Portability: Receive your data in machine-readable format
Right to Object: Object to profiling and automated decision-making
Right to Withdraw Consent: Withdraw consent at any time (does not affect prior processing)

To exercise your rights, contact privacy@complichef.me.

If you have a complaint about how we process your data, you may lodge a complaint with the Information Commissioner's Office (ICO).

10. Changes

We will notify you of material changes to this policy via in-app notice or email. Continued use after changes take effect constitutes acceptance.