PRIVACY POLICY

Effective Date: May 12, 2024 | Revision: 4.0.1

Welcome to the official Privacy Policy of MEDINA FOOD GROUP LIMITED ("Medina", "we", "us", or "our"). This comprehensive document outlines our commitment to the protection of your personal information and our adherence to the United Kingdom's General Data Protection Regulation (UK GDPR) and the Data Protection Act 2018 (DPA 2018). As a technology-first logistics company, we recognize that data is the fuel of our innovation, but your privacy is the bedrock of our trust.

1. SCOPE AND DATA CONTROLLER

This policy applies to all digital platforms, mobile applications, and physical services operated by MEDINA FOOD GROUP LIMITED, registered in England and Wales at 83 Park Road Bradford BD5 0SG. For the purpose of the UK GDPR, we are the 'Data Controller' for all information collected through our suite of services. Our Data Protection Officer (DPO) can be reached at info@koikitchen.sbs for any queries related to this policy or your individual rights.

2. CATEGORIES OF DATA WE COLLECT

In order to provide our premium logistics and culinary services, we collect several categories of personal data, categorized as follows:

  • Identity Data: Legal name, professional titles, and biometric data where used for secure facility access.
  • Contact Data: Residential and commercial delivery addresses, verified email addresses, and mobile telephone numbers.
  • Financial Data: Encrypted payment card details and bank account information processed via PCI-DSS compliant gateways.
  • Technical & Usage Data: Internet Protocol (IP) addresses, browser telemetry, device identifiers, and heat-map interactions within our software interfaces.
  • Nutritional Preference Data: Voluntarily provided data regarding allergies, religious dietary requirements (including Halal certification preferences), and caloric intake goals.
  • Geolocation Data: Real-time GPS coordinates provided by your device during the delivery cycle to optimize the 'Last-Mile' handoff.

3. THE LEGAL BASIS FOR PROCESSING

Under UK law, we must have a valid legal basis to process your data. We rely on the following:

Performance of a Contract: Necessary for us to fulfill your food orders and logistics service agreements.

Legal Obligation: Necessary for us to comply with UK health and safety regulations, food traceability laws, and tax reporting requirements.

Legitimate Interests: Necessary for the optimization of our AI routing algorithms and the prevention of fraudulent activities within our network.

Consent: Explicitly obtained for marketing communications and the processing of 'Special Category Data' such as specific health-related dietary needs.

4. DATA RETENTION AND ARCHIVAL

We do not store data indefinitely. Our retention schedule is as follows:

  • Transaction Records: Retained for 7 years to comply with HMRC tax requirements and the Limitation Act 1980.
  • Customer Identity Data: Retained for 2 years following your last active interaction with our platform, after which it is programmatically anonymized.
  • Geolocation Logs: Purged every 30 days, retaining only aggregated, non-identifiable routing metadata for AI training purposes.

5. DISCLOSURE TO THIRD PARTIES

MEDINA FOOD GROUP LIMITED does not sell your data. We share information only with trusted partners who assist in our operations, including cloud hosting providers (e.g., AWS UK), payment processors (e.g., Stripe), and authorized logistics subcontractors who operate under our strict NDAs and Data Processing Agreements (DPAs).

6. YOUR STATUTORY RIGHTS

Under the UK GDPR, you possess the following rights: The Right to Access (Subject Access Requests), The Right to Erasure ('Right to be Forgotten'), The Right to Data Portability, and The Right to Object to automated decision-making. To exercise these rights, please submit a formal request to our DPO.