Last updated: 15 April 2024

This privacy notice tells you what to expect us to do with your personal data when you sign up to the GFaL Rewards app and/or become a customer of GFaL, and provides you with details of who controls that information.

If you have any questions or if anything is unclear you can contact us: Great Food at Leeds at gfal@leeds.ac.uk

Our data protection officer is Rebecca Messenger Clark. Contact details: dpo@leeds.ac.uk or 0113 243 1751.

The university’s data controller registration number provided by the Information Commissioner’s Office is: Z553814X

1.0. Where we get your personal data from

1.1. From you

You will be asked to provide personal data when you register as a customer with Great Food at Leeds and Deli(very). This includes:

  • When downloading and registering to use the GFaL Rewards app
  • Purchasing a Food Bundle
  • Placing a delivered catering order via the website, email or telephone

You may also be invited to subscribe to newsletters or other activities. When you are required to provide personal data the uses of this data will be explained at the point of collection.

1.2. From the University’s Residential Services

In order to allow staff and students to join Meal Plan, the personal data of members will be retrieved from the University’s Residential Services. This data includes:

  • first name
  • last name
  • student number
  • allocated location
  • allocated room
  • contract date start
  • contract date end
  • email address
  • date of birth

The data is used to verify your status as a student and is held securely on the University’s network.

1.3. From external sources

In order to notify you of news and information from Great Food at Leeds at the University of Leeds, we retrieve data from external sources deemed to have a legitimate interest in our activities. External sources include Its Lolly Limited for GFaL customers and Kinetic Solutions for Deli(very) customers.

1.4. Automated collection of personal data

As with most other web servers, when you access the Great Food at Leeds web pages certain information you provide will automatically be recorded by the University. This will include your IP address, browser type, and information relating to the page you last visited. This information is processed to estimate how much usage of the server is made by different categories of users and, in the event of a breach of security, may be used to aid detection.

1.5. Cookies

Our website uses first-party cookies; which are small text files placed on your device by the websites that you visit.

Find out more about the cookies we use and why in our cookie policy.

2.0. The purposes for which we process your personal data and the legal basis for that processing

The processing of your personal data is necessary for the performance of the contract that you have entered into with the University in order to process your catering requirements. If you do not want your personal data to be used in the manner described, then you will need to terminate your contract with Great Food at Leeds.

2.1. Marketing

As a GFaL customer, you may be invited to subscribe to newsletters or other activities which you have the option of consenting to. When you are required to provide personal data the uses of this data will be explained at the point of collection. Where personal data is requested for marketing purposes you will be given the opportunity to opt-out.

Food Bundles and Meal Plan students will be automatically subscribed to receiving email newsletters, offers, feedback requests under the basis of legitimate interest. You may opt out of these communications at any time using the preference centre.

2.2. How do we keep this information secure?

The information we hold about you will be stored on University of Leeds secure systems and accessible to university staff administering outreach.

Your data will not be transferred outside the EEA.

3.0. Who might we share your data with?

The information that you provide to the University will be stored securely and access will be restricted to those members of staff who need it. The University will not share your personal data with third parties other than those listed below.

3.1. Campaign Monitor

Great Food at Leeds uses an email service provider, Campaign Monitor, in order to communicate with our customers via email. Campaign Monitor is given access to/holds the email address which you supply; the ways in which Campaign Monitor can use and store your email address is strictly regulated by a data processing agreement.

3.2. Kinetic Solutions

Kinetic Solutions facilitate the event, catering and accommodation management at the University of Leeds. All data is held on University servers and not by Kinetic Solutions, however, Kinetic Solutions will from time to time need access to this data to provide support. This arrangement is covered by a data processing agreement.

3.3. Conferences and events at the University of Leeds

The Conferences and Event service at the University of Leeds access personal data through Kinetic Solutions as it relates to their delivery of your contract with Conferences and Events.

3.4 Its Lolly Limited

Its Lolly Limited is our electronic point of sale system (EPOS) and GFaL Rewards app developer.

3.4.1. Data collection

Its Lolly Limited are given access to:

  • Your full name
  • Your email address
  • A record of your purchases
  • Date of birth (optional)
  • Whether you are a student or non-student
  • Whether you are a Meal Plan student or not

A data processing agreement is in place to regulate the ways in which Its Lolly Limited can use your data.

3.4.2. Purposes of processing

This personal information will enable us:

  • To record your purchases for the purposes of administering a loyalty points system based on the volume of purchases.
  • To conduct analytics activities to help drive relevant offers personalised to your individual purchase history.
  • To conduct promotional and marketing activities, such as communicating personalised offers.
  • Your email address is your unique identifier to assign loyalty points to your user account and will be used to notify you of special offers and offers available in GFaL operated outlets, should you opt in via the GFaL Rewards app. Your email address used will be the one that you provide at the point of registration for the app.
  • If you consent at the point of registration, your date of birth will be used to provide personalised birthday rewards/offers. You can also opt in or opt out of providing this information after registration.

3.4.3. Push notifications

You are able to opt out of receiving our push notifications at any point, this can be amended within the app settings.

3.5. Jisc

Jisc provides IT services and digital resources to support research for the University of Leeds. Jisc is the data processor for market research surveys on behalf of Great Food at Leeds. Information provided by you as part of a survey will be used solely for research purposes. Surveys are anonymous and the data supplied will be used to improve our services. Your data will not be used in a manner which would allow identification of your individual responses. Your email address will be used to contact you should you win one of the prizes in our prize draw. Once the prize draw is complete, all email addresses will be deleted.

4.0. How long we keep this information

4.1. Customers of Great Food at Leeds and Deli(very)

We will hold your personal information on our systems as long as you remain a customer of Great Food at Leeds. Once you are no longer a customer we will securely delete your data after six years in line with the University of Leeds retention policy.

4.2 The GFaL Rewards app users

If a GFaL rewards account is not used for a period of 18 months or more, we will assume it is no longer in use and delete the account.

5.0. Your data protection rights

You have the right to:

  • withdraw consent at any time where that is the legal basis of our processing;
  • access your personal data that we process;
  • rectify inaccuracies in personal data that we hold about you;
  • be forgotten, that is your details to be removed from systems that we use to process your personal data;
  • restrict the processing in certain ways;
  • obtain a copy of your data in a commonly used electronic form;
  • object to certain processing of your personal data by us.

Please see ico.org.uk for further information on the above rights.

You may also contact the Great Food at Leeds team at gfal@leeds.ac.uk for further information about how we treat your data.

You have a right to complain to the Information Commissioner’s Office about the way in which we process your personal data. Please see ico.org.uk

Information Commissioner’s Office

Wycliffe House
Water Ln
Wilmslow
SK9 5AF

Telephone: 0303 123 1113