Privacy Policy

Introduction

LabelFood ("we", "us", "our") is committed to protecting your privacy and personal data. This Privacy Policy explains how we collect, use, store, share, and protect your information when you use the LabelFood Printer SV2, our cloud software, and related services (the "Service").

Data Controller: DropCode Software Ltd, a company registered in England and Wales (Company Number: 12013087), trading as LabelFood, registered address: 71-75 Shelton Street, Covent Garden, London, WC2H 9JQ, United Kingdom.

This policy applies to:

• Food business owners and administrators who use LabelFood to manage labelling and compliance
• Staff members who use the LabelFood Printer SV2 in commercial kitchens
• Visitors to our website and users of our cloud dashboard via browser or our iOS and Android apps
• People who enquire about LabelFood or begin a registration without completing it

We are a UK-based company and comply with the UK General Data Protection Regulation (UK GDPR), the Data Protection Act 2018, and other applicable data protection laws. For details on the legal basis for each type of processing, please refer to Section 3 below.

1. Information We Collect

1.1 Information from Business Accounts

When you create a LabelFood business account, we collect:

• Account Information: Name, email address, phone number, business name, business address
• Business Details: Business type, industry, description, and branding information
• Payment Information: Billing address, payment method details (processed securely; we do not store full credit card numbers)
• Subscription Information: Plan type, subscription status, billing history
• Configuration Data: Branch locations, devices, staff accounts, product catalogue, allergen settings
• Staff Information: Names, PIN codes, and roles of staff members you add to your account

1.2 Product and Labelling Data

When you use LabelFood to manage your food labelling:

• Product Information: Product names, ingredients, allergen declarations, storage instructions, barcodes, use-by periods
• Label History: Records of labels printed, including timestamps, quantities, and associated products
• Waste Records: Wastage data recorded through the device, including product, quantity, reason, and optional photo
• Compliance Reports: Data generated for regulatory compliance and EHO reporting

1.3 Automatically Collected Information

When you use our Service, we automatically collect:

• Usage Data: Pages visited, features used, labels printed, time spent, actions taken
• Device Information: Device type, operating system, browser type, IP address, unique device identifiers
• Location Data: General location information (branch location) based on device configuration
• Log Data: Access times, error logs, performance data
• Cookies and Tracking Technologies: See our Cookies section below

1.4 Information from the LabelFood Printer SV2

When you use the LabelFood Printer SV2, we collect device usage data, print history, sync logs, and device status information to provide the service and for troubleshooting purposes.

1.5 Mobile Applications (iOS and Android)

When you use the LabelFood app for iOS or Android to access the cloud dashboard, we may collect:

• App Usage Data: Screens visited, features used, actions taken
• Device Information: Device model, operating system version, app version, push notification tokens
• Notifications: If you enable push notifications, we may send alerts about label expiry, sync status, and other service-related updates. Push notifications are delivered through a specialist provider based outside the UK — see the International Data Transfers section below

1.6 Enquiries and Incomplete Registrations

If you contact us through our website, live chat, or by email, we collect your name, email address, phone number where given, and the content of your message so we can answer you and keep a record of the conversation.

If you start a registration or a pricing enquiry and do not complete it, we keep the business details you entered — including your business name, postcode and contact details — so that we can follow up about your enquiry. We do this on the basis of our legitimate interest in responding to prospective customers. You can ask us to delete this record at any time, and we will do so without needing a reason.

1.7 Information from Other Sources

When you register, we look up the company registration number you provide against the public Companies House register in order to confirm your business details and reduce fraudulent sign-ups. The information we obtain is limited to what that public register holds about your company — such as the registered name, address and company status. We do not obtain personal data about you from any other external source.

2. How We Use Your Information

2.1 Service Provision

• Create and manage your account and devices
• Generate and print food labels with allergen and product information
• Store and manage your product catalogue and allergen data
• Track waste records and generate compliance reports
• Process payments and manage subscriptions
• Provide customer support and respond to enquiries

2.2 Service Improvement

• Analyse usage patterns to improve our Service
• Develop new features and functionality
• Fix bugs and technical issues
• Conduct research and analytics

2.3 Communication

• Send important service updates and announcements
• Respond to your support requests
• Send marketing communications (with your consent, which you can opt-out of at any time)
• Notify you about changes to our Terms or Privacy Policy

2.4 Legal and Security

• Comply with legal obligations and respond to legal requests
• Protect our rights, property, and safety
• Prevent fraud, abuse, and illegal activities
• Enforce our Terms of Service

3. Legal Basis for Processing (GDPR)

Under UK GDPR, we process your personal data based on the following legal grounds:

• Contract Performance: To provide the Service you have requested and fulfil our contractual obligations
• Legitimate Interests: To improve our Service, prevent fraud, ensure security, communicate important updates, and to respond to and follow up on enquiries from prospective customers. Where we rely on legitimate interests we have considered the impact on you, and you can object at any time
• Consent: For marketing communications, non-essential cookies, and optional features (you can withdraw consent at any time)
• Legal Obligation: To comply with applicable laws, regulations, and legal processes

We do not make decisions about you by automated means alone, and we do not carry out profiling that produces legal effects for you or similarly significantly affects you.

4. Data Sharing and Disclosure

We do not sell, rent, or trade your personal information to third parties. We may share your data only in the following circumstances:

4.1 Service Providers

We share data with trusted third-party service providers who assist in operating our Service:

• Payment Processors: For processing subscription payments and one-off orders; they handle payment data according to their own privacy policy
• Cloud Hosting: For hosting our Service and data storage
• Analytics and Advertising Measurement: To understand how our website is used and how our advertising performs. Their use is governed by your cookie choices, which you can change at any time
• Push Notification Provider: To deliver notifications to our mobile apps. This provider receives your device's notification token together with identifiers for your account, organisation and branch
• Customer Relationship and Support Platform: To run our live chat, hold our support conversations and keep records of enquiries from customers and prospective customers
• Email Delivery: To send service emails such as sign-in codes, order confirmations and billing notices

The specific third parties that set cookies on our website are named in the cookie preferences panel available on our site. If you would like the current list of the providers we use for the categories above, contact us at the address in Section 12 and we will tell you.

All service providers are contractually obligated to protect your data and use it only for the purposes we specify.

4.2 Legal Requirements

We may disclose your information if required by law or in response to:

• Court orders, subpoenas, or legal processes
• Government requests or regulatory requirements (e.g., Environmental Health Officer requests)
• Enforcement of our Terms of Service
• Protection of rights, property, or safety

5. Data Security

We implement robust technical and organisational measures to protect your data:

• Encryption: SSL/TLS encryption for data in transit; encryption at rest for sensitive data
• Access Controls: Role-based access controls, authentication, and authorisation mechanisms
• Secure Infrastructure: Hosting in secure data centres with physical and digital security measures
• Regular Updates: Security patches and updates applied regularly
• Monitoring: Continuous monitoring for security threats and vulnerabilities
• Backups: Regular automated backups with secure storage

While we implement strong security measures, no method of transmission or storage is 100% secure. You are responsible for maintaining the security of your account credentials and should notify us immediately of any unauthorised access.

International Data Transfers

Your account data, product and labelling data, and our backups are hosted on servers located within the European Economic Area (EEA). Transfers of personal data from the UK to EEA countries are permitted under UK GDPR, as the UK has recognised EEA countries as providing an adequate level of data protection.

Some of the providers listed in Section 4.1 are based outside the UK and the EEA, principally in the United States. This applies to our website analytics and advertising-measurement providers and to the provider that delivers push notifications to our mobile apps. Where personal data is transferred outside the UK, we rely on one of the following safeguards under UK GDPR: an adequacy decision covering the receiving country or certification scheme, or the UK International Data Transfer Addendum to the European Commission's Standard Contractual Clauses.

Your cookie choices control these transfers: if you decline the analytics and marketing categories, or withdraw them later, the transfers stop. We will update this section if our hosting or provider arrangements change, including any future migration to UK-based servers.

6. Your Rights (GDPR)

Under UK GDPR and applicable data protection laws, you have the following rights:

• Right of Access: Request a copy of the personal data we hold about you
• Right to Rectification: Request correction of inaccurate or incomplete data
• Right to Erasure: Request deletion of your personal data (subject to legal obligations)
• Right to Restrict Processing: Request limitation of how we process your data
• Right to Data Portability: Receive your data in a structured, machine-readable format
• Right to Object: Object to processing based on legitimate interests
• Right to Withdraw Consent: Withdraw consent for processing based on consent
• Right to Lodge a Complaint: File a complaint with the Information Commissioner's Office (ICO) in the UK

To exercise these rights, please contact us at hello@labelfood.co.uk. We will respond to your request within one month.

Please also tell us when your details change. A business address, billing contact or staff list that is out of date does not only sit wrongly in our records — it reaches your labels, your invoices and the notifications we send you. We can only keep your data accurate if you let us know it has moved on.

7. Cookies and Tracking

We use cookies and similar tracking technologies to maintain your session, remember your preferences, and analyse usage patterns. Our use of cookies is governed by the Privacy and Electronic Communications (EC Directive) Regulations 2003, as amended (commonly known as PECR), alongside UK GDPR. When you first visit our website, a cookie consent banner asks for your permission for non-essential cookies, and your choice is applied as soon as you make it.

• Necessary Cookies: Required for the website to function (cannot be disabled). These include session identifiers, security tokens, and the cookies set by our live chat (HubSpot), which loads on every page so that you can reach us at any point.
• Analytics Cookies: Help us understand how visitors interact with our website (Google Analytics, Google Tag Manager, Microsoft Clarity). Governed by your cookie choices.
• Marketing Cookies: Used to deliver relevant advertising and measure ad performance (Facebook Pixel). Governed by your cookie choices.
• Push Notifications: If enabled in our iOS or Android app, you may receive notifications about label expiry, sync status, and service updates. You can manage notification preferences in your device settings at any time.

You can change or withdraw your consent at any time using the Cookie Preferences link in the footer of every page on our website. Switching a category off takes effect immediately. You can also control cookies directly through your browser settings, or contact us if you would rather we handled it for you.

8. Data Retention

We retain your personal data for as long as necessary to:

• Provide the Service to you
• Comply with legal obligations (e.g., tax and payment records)
• Resolve disputes and enforce our agreements
• Maintain security and prevent fraud

• Active Accounts: Account data is retained while your subscription is active or your account remains open
• Label and Waste History: Activity records (labels printed, waste logs) are retained for as long as your account remains open, so that your history stays available to you. LabelFood is a labelling tool and does not provide official food safety records. You are responsible for maintaining any records required by applicable food safety law
• Technical Logs: Application logs are deleted after 90 days. Device activity and telemetry records are deleted after 30 days. Used sign-in codes are deleted after 7 days
• Enquiries and Incomplete Registrations: Retained for up to 24 months from your last contact with us, then deleted
• Closed Accounts: When your subscription ends, your account data is retained so the account can be reopened. If you ask us to delete it, we will delete or anonymise your data within one month, apart from the records we are legally required to keep
• Payment Records: Billing and payment data is retained for 6 years to comply with HMRC requirements, and this cannot be shortened by a deletion request

To request deletion, contact us at the address in Section 12 and we will confirm what has been deleted and what we are required to keep.

One practical limit is worth stating plainly. We take routine backups of our systems so that your data survives a failure on our side, and those backups are overwritten on a rolling schedule. When we delete something at your request, a copy can still sit inside a backup that has not yet been overwritten. We do not use backups to bring deleted records back, and the copy goes when that backup is replaced.

9. Children's Privacy

LabelFood is not intended for users under 18 years of age. We do not knowingly collect personal information from children. If you believe we have inadvertently collected information from a child, please contact us immediately.

10. Links to Services We Do Not Operate

Our website, dashboard and emails carry links to places we do not run — our social media pages, the video content in our help articles, the booking page for a call with us, and the ICO's website. Once you follow one of those links you are on someone else's service, under their privacy policy and not ours, and what happens to any information you give them is outside our control. It is worth reading their policy before you hand anything over.

11. Changes to This Privacy Policy

We may update this Privacy Policy from time to time. Material changes will be communicated by email notification or notice on our website. The "Last updated" date at the top of this page indicates when this Privacy Policy was last revised.

12. Contact Us

If you have any questions, concerns, or requests regarding this Privacy Policy or our data practices, please contact us:

Supervisory Authority: If you are not satisfied with how we have handled your personal data, you have the right to lodge a complaint with the Information Commissioner's Office, the UK's supervisory authority, at ico.org.uk.