Privacy Policy
This policy explains how the Kayana Group collects, uses, discloses, and protects personal data in connection with the Kayana Eats platform, across all the territories in which we operate.
Effective date: 5th August, 2026 · Last updated: 5th August 2026
1. Scope and Data Controller
This Policy explains how the Kayana Group collects, uses, discloses, and protects personal data in connection with the Kayana Eats Platform. It applies to Restaurants, Customers, Delivery Partners, and other individuals whose personal data we process in operating the Platform, across all territories in which the Kayana Group operates.
The data controller (or, in jurisdictions using different terminology, the equivalent responsible party) for your personal data is the Kayana Group entity that is your Contracting Entity, as identified in Clause 2.1 of Part A: Kayana World Limited (UK, and default for all other territories), Kayana For Business USA Inc (United States), Kayana Canada Inc (Canada), Kayana For Business Ireland (EU, including Spain and the Netherlands), and Kayana For Business Australia Pty Ltd (Australia). Where a Restaurant is itself the data controller for Customer personal data (for example, its own loyalty programme), Kayana acts as a data processor or service provider for that data.
Members of the Kayana Group may process personal data on each other’s behalf, or share it among themselves as reasonably necessary to operate the Platform and meet regulatory obligations, as described in Clause 2.3 of Part A.
2. Personal Data We Collect
Restaurant Data: business and contact details; food business registration, hygiene rating, and licence information; identity and verification documents for KYC, AML and sanctions screening; financial and banking details for settlement; tax identification numbers; Menu Item content, pricing, and Allergen Information; usage data; and communications with our support and compliance teams.
Customer Data: name, contact details, delivery address, and account preferences; payment card or payment account details (processed primarily by our Payment Service Providers); Order and payment history; dietary preferences or allergy information voluntarily provided; age-verification information where an Order includes age-restricted items; and records of support communications.
Delivery Partner Data: identity, right-to-work or contractor verification documents, vehicle information where applicable, banking details for payment, and real-time location data while an active delivery is in progress. Where the Platform supports proof-of-delivery confirmation, that image is collected from the Delivery Partner and shared with the Customer and Restaurant solely to confirm delivery and resolve disputes.
Technical, Usage, and Location Data: IP address, device and browser information, log data, app usage analytics, and information collected through cookies and similar technologies. With appropriate consent or permission, and only while relevant to fulfilling an Order, we collect device location data from Customers (to suggest nearby Restaurants and estimate delivery times) and from Delivery Partners (to enable live Order tracking).
Special Category / Sensitive Data: dietary, allergy, and religious or health-related food preference information (for example, “halal,” “kosher,” “vegan,” or allergen avoidance) that a Customer chooses to provide is treated with additional care and used solely to fulfil the Customer’s Order and to pass relevant Allergen Information to the Restaurant. We do not use this information for any other purpose, including advertising, without separate consent.
3. How and Why We Use Personal Data
We use personal data to: operate and provide the Platform; process Orders, payments, and delivery logistics; verify Restaurant, Customer, and Delivery Partner identity and eligibility, including age verification; detect, prevent and investigate fraud, money laundering, and sanctions violations; comply with legal and regulatory obligations, including food safety traceability and tax reporting; communicate about Orders, accounts, and support requests; improve and secure the Platform; and, where consented or otherwise lawful, send marketing communications.
Where the UK GDPR or EU GDPR applies, we rely on: performance of a contract; legal obligation (for example, food traceability, AML/KYC, and tax compliance); legitimate interests (for example, fraud prevention, Platform security, and service improvement, balanced against your rights); and consent (for example, for marketing communications and precise location tracking, both of which you may withdraw at any time). In jurisdictions that do not use the “legal basis” framework (including the United States, Canada, and Australia), we process personal data on equivalent grounds and in accordance with the specific requirements of Clause 34.
We use automated processing, including algorithms and risk-scoring models, for purposes such as detecting potentially fraudulent Orders or payments, estimating delivery times, and personalising Restaurant and Menu Item recommendations. Where automated processing produces a legal or similarly significant effect on you (for example, declining an Order or suspending an account on fraud grounds), you have the right, where required under Applicable Law, to request human review, express your point of view, and contest the decision by contacting us using the details in Clause 37.
4. Location Data and Delivery Tracking
We use location data to show nearby Restaurants, estimate delivery times, enable real-time Order tracking, and support Delivery Partner routing and safety. Customers can control location permissions through their device settings; disabling location services may limit certain Platform features, such as automatic address detection. Delivery Partner location is shared with the relevant Customer and Restaurant only while an active delivery is in progress, and retained thereafter only as long as necessary for the purposes described in Clause 32.
7. International Data Transfers
Because the Kayana Group operates across the United Kingdom, the European Union (through Kayana For Business Ireland, serving Spain and the Netherlands among other EU markets), the United States, Canada, and Australia, personal data may be transferred between these territories. In addition, several of the named service providers in Clause 30.8 are based in, or process data in, the United States (including Stripe, Amazon Web Services, Nash, and ImageKit Inc.) or Canada (including Unsplash Inc.).
Where we or these providers transfer personal data out of the UK or the EEA to a territory that has not been assessed as providing an adequate level of protection, we (or the relevant provider, under its own contractual commitments to us) put in place appropriate safeguards, such as the European Commission’s Standard Contractual Clauses, the UK’s International Data Transfer Addendum, certification under the EU-U.S. Data Privacy Framework (where the provider participates in it), or another lawful transfer mechanism, and, where required, carry out a transfer risk assessment.
8. Data Retention
We retain personal data for as long as necessary to fulfil the purposes described in this Policy, including to provide the Platform, comply with legal, tax, food-traceability, and regulatory retention obligations (which vary by jurisdiction and can extend for several years after an account is closed, particularly for AML/KYC and financial records), resolve disputes, and enforce our agreements. Real-time delivery location data is retained only for as long as necessary for delivery tracking, safety, and dispute-resolution purposes, and is then deleted or anonymised. When personal data is no longer needed, we securely delete or anonymise it, subject to any legal obligation to retain it for longer.
9. Security
We implement technical and organisational measures designed to protect personal data against unauthorised access, loss, misuse, or alteration, including encryption in transit, access controls, and vendor security assessments. No system is completely secure, and we cannot guarantee absolute security. If we become aware of a personal data breach that requires notification under Applicable Law, we will notify affected individuals and/or the relevant regulator (such as the UK Information Commissioner’s Office, Ireland’s Data Protection Commission, or applicable US state authorities) as required.
10. Your Rights — Jurisdiction-Specific Provisions
To exercise any of the rights described in this Clause, contact us using the details in Clause 37. We may need to verify your identity before responding, and may decline requests where an exemption applies under Applicable Law. We aim to respond within the timeframe required by the law applicable to your request.
- United Kingdom — if the UK GDPR and Data Protection Act 2018 apply to you, you have the right to access your personal data, request rectification or erasure, restrict or object to processing, request data portability, withdraw consent at any time, and lodge a complaint with the Information Commissioner’s Office (ICO).
- European Union (Spain and the Netherlands) — if the EU GDPR applies, you have equivalent rights, and may lodge a complaint with your local supervisory authority: in Spain, the Agencia Española de Protección de Datos (AEPD); in the Netherlands, the Autoriteit Persoonsgegevens; or with the supervisory authority of your EU Member State of residence.
- United States — depending on your state of residence, you may have rights under the California Consumer Privacy Act (CCPA/CPRA) and similar laws in Virginia, Colorado, Connecticut and Utah, including the right to know what personal data we collect, delete it, correct it, opt out of “sale” or “sharing” and targeted advertising, and non-discrimination for exercising your rights.
- Canada — if PIPEDA or applicable provincial privacy legislation applies to you (including Quebec’s Law 25), you have the right to access and correct your personal data and withdraw consent, and may lodge a complaint with the Office of the Privacy Commissioner of Canada or the relevant provincial regulator.
- Australia — if the Privacy Act 1988 and the Australian Privacy Principles (APPs) apply to you, you have the right to access and seek correction of your personal data, and to complain to the Office of the Australian Information Commissioner (OAIC) if you are not satisfied with our response.
11. Children’s Privacy
The Platform is not directed at, and we do not knowingly collect personal data from, children below the age required to hold an account or place an Order in their jurisdiction (see Clause 4.2 of Part A). Where a minor uses the Platform under parental or guardian supervision, personal data is processed in accordance with the parent’s or guardian’s instructions and this Policy. If we become aware that we have inadvertently collected personal data from a child in breach of this Clause, we will take steps to delete it.
12. Changes to This Policy
We may update this Policy from time to time to reflect changes in our practices or Applicable Law. Material changes will be notified in the same manner as amendments to Part A (Clause 23.2), with at least thirty (30) days’ advance notice where required. The “Effective Date” at the top of this document indicates when it was last revised.
13. Contact Us (Privacy)
For questions about this Policy or to exercise your data protection rights, please contact us at: info@kayanaforbusiness.com — www.kayanaforbusiness.com
If you are not satisfied with our response, you have the right to lodge a complaint with your local data protection authority, as identified in Clause 34.
- United Kingdom (Global) — Kayana World Limited (Company No. 12782000), Arch 58, Ingate Place, London, SW8 3AG, United Kingdom
- United States — Kayana For Business USA Inc (No. 2025-001835267), 30 North Gould Street, Ste R, Sheridan, Wyoming, 82801, United States
- Canada — Kayana Canada Inc (No. 1001438570), 75 Bayly St W, Unit 15, Ajax, Ontario, L1S 7K7, Canada
- European Union (incl. Spain and the Netherlands) — Kayana For Business Ireland (No. 737092), 3D North Point House, North Point Business Park, New Mallow Road, Cork, T23 AT2P, Ireland
- Australia — Kayana For Business Australia Pty Ltd (No. 693 838 014), 368 Sussex Street, 526, Sydney, New South Wales, 2000, Australia