Privacy notice
Last updated: 7 October 2026 · Version 1.1
This notice covers ordering food through J'Toye. It explains what happens to your information, which decisions are ours and which belong to the shop you ordered from, and how to ask us to do something about it.
Who we are
The J'Toye platform is operated by J'Toye Digital Ltd, registered in England & Wales under company number 16471464. Where you see a company number in any J'Toye legal document, that is the one that identifies us.
How to contact us about your data
Registered office: Crispins Manor Farm Lane, Michelmersh, Romsey, England, SO51 0NT
Who is responsible for what
This is one notice covering the whole platform. The particular shop you are buying from is named to you at the point of order, on the shop page and again on your order confirmation, so you always know which business is the other party.
Below is the essence of the written arrangement between J'Toye and the shops on it. We publish it because the law requires us to make it available to you.
Who is responsible for your information when you order
When you order food through J'Toye, two businesses are involved: J'Toye Digital Ltd (company number 16471464), which runs the platform, and the shop you ordered from, which makes and supplies your food. The shop is named to you when you order.
For the information created by your order — your name, contact details, delivery address, what you ordered and what you paid — J'Toye and the shop are jointly responsible. J'Toye decides how the platform collects and stores it; the shop decides what it needs in order to serve you.
Some things are J'Toye's responsibility alone. Your J'Toye storefront account and password are ours, not the shop's. Records a shop keeps about you for its own reasons — including any note it makes of your allergies — are the shop's responsibility, and J'Toye only stores them on the shop's behalf. J'Toye does not check your order against any allergy information a shop has recorded, and does not hold allergy information about you. What you are shown at checkout is what the shop has declared about the food in that order.
You can contact J'Toye about your information, once, for every shop you have ordered from. You do not need to contact each shop separately. We will act on your request across every shop that holds your details. You can also contact any shop directly, and you can complain to the Information Commissioner's Office at any time.
No J'Toye employee can browse across shops to look at your details. Requests are carried out by an automated process that works through one shop at a time. That is deliberate: it is how we can offer you a single place to ask while keeping each shop's records separate from every other shop's.
The full arrangement between J'Toye and the shops is a written document. This is its essence, which we publish because the law requires us to make it available to you.
The trading line and the GDPR line
Two different lines are drawn across this platform and both are true at the same time. They answer different questions, so they have different answers.
On our legal and company information page we say that the shops listed on J'Toye are run by their own businesses and remain responsible for their own trading disclosures. That is the trading line: who sells you the food, whose terms of sale apply, and who is answerable for the meal itself. It is the shop.
This notice draws the data protection line, and for the information created by your order the answer is both of us, jointly. A shop can be solely responsible for what it sells you and jointly responsible with us for the personal data created by selling it. Neither statement weakens the other, and neither page should be read as correcting the other.
What we collect and why
We collect the following, and no more than we need for each purpose.
Order information
Your name, email address, phone number, delivery address where the order is delivered, any notes you add, what you ordered, what you paid and the status of the order. We need this to take and fulfil your order, so our lawful basis is performance of a contract with you.
Account information
If you create a J'Toye storefront account, your sign-in identity and the order history we show back to you across shops. This is ours alone, on the basis of performance of a contract with you.
Payment information
We do not hold your card details. Card details are entered directly into Stripe's own payment form in your browser and never pass through J'Toye. We keep the payment status and reference against your order so we know it was paid.
Information stored in your browser
Your basket, your signed-in state and a small number of other items are held in your own browser rather than on our servers. Every one of them is listed, with what it does and how long it lasts, in our cookie and browser-storage policy. Two of them hold an email address, and that policy says which.
Allergen notes a shop records about you
A shop can record allergy and dietary notes against its own customer records. That information belongs to the shop, not to us — see the next section, which sets out exactly what we do and do not do with it.
Allergen and dietary information
This section is the one most likely to be misread, so it says four separate things plainly. They are recorded in full in our Article 9 determination of 30 July 2026, extended on 16 August 2026; this is a summary of that determination and not a fresh argument about it.
One — the shop is responsible for it, not us. Where a shop records allergy or dietary notes against your record, the shop decided to record them, for its own purpose of serving you safely. Allergy information is health information, and the shop is responsible for having a lawful reason to hold it. We store it on the shop's behalf and do not use it for our own purposes.
Two — we do not check your order against it. J'Toye does not consult any stored allergy note at checkout or anywhere else in the ordering flow. We never learn your allergies, and nothing in the ordering flow compares you against a product. This is a decision we took and recorded, not an omission.
Three — what you see at checkout is about the food, not about you. The allergen set shown to you at checkout is assembled from what the shop has declared about the products in that order, and you are asked to confirm you have read it. It is product information. It is not derived from anything we hold about you, and it is not a confirmation that the order suits your own needs.
Four — you can still ask us for it. If a shop has recorded allergen notes against your record, that information is included in the copy of your data you receive if you make an access request. Not using a piece of information for our own purposes is a different thing from withholding it from the person it is about, and we do not withhold it.
How long we keep it
Different categories of information are kept for different lengths of time, and some periods are set by law rather than by us.
The periods are published in one place so there is a single answer rather than several that can drift apart. See our data retention schedule, which lists each category, how long it is kept, the reason, and whether the period is enforced automatically or operationally. This notice deliberately does not restate those periods.
Emails
J'Toye only emails you about your orders, about data requests you make, and about your sign-in account when you ask us to (for example, to reset your password). We do not send marketing emails.
Order emails are sent through J'Toye in the name of the shop you ordered from. Data request emails come from J'Toye: the link to confirm a request, the link to collect a copy of your data, and a note when an erasure has been carried out.
To get a copy of your data or delete your account, use My account if you have a J'Toye account, or the routes in the next section.
Your rights, and how to exercise them
Under UK data protection law you have the right to:
- ask for a copy of the personal data we hold about you;
- have it corrected if it is wrong or incomplete;
- have it erased in the circumstances the law allows;
- receive it in a portable form, so you can take it elsewhere;
- object to, or ask us to restrict, what we do with it.
You may exercise these rights against J'Toye or against the shop directly. You do not have to choose correctly: a request that reaches either of us is a valid request.
How to make a request
You can also write to us at Crispins Manor Farm Lane, Michelmersh, Romsey, England, SO51 0NT, marking your letter for the attention of data protection.
How we confirm it is you
Before we act on a request we confirm that you control the email address it concerns, by sending that address a single-use confirmation link. We do this because acting on an unverified erasure request would let one person delete another person's records. Until the link is followed, nothing is actioned.
Once confirmed, an erasure request is carried out across every shop on the platform that holds your details, one shop at a time, by an automated process. We keep a record that the erasure happened — the record identifies you only by a one-way fingerprint of your email address, never the address itself — so that we can evidence it without keeping the very data you asked us to remove.
The law gives us one month to respond to a request, and we will tell you if we need longer, which the law allows in limited circumstances.
Complaints
If you are unhappy with how we have handled your information, please tell us first if you can — it is usually the quickest way to put something right.
You have the right to complain to the Information Commissioner's Office, the UK supervisory authority for data protection, at any time and whether or not you have raised it with us. You can reach them at ico.org.uk/make-a-complaint. Complaining to the ICO does not cost anything and does not affect any other right you have.
Changes to this notice
This notice carries a version number and a last-updated date at the top of the page, and our cookie and browser-storage policy carries its own. Those are how you can tell whether what you are reading is what was in force when something happened to your data.
If we change this notice in a way that materially affects you, we will raise the version number and say what changed, rather than editing the text silently. Small corrections that do not change its meaning may be made without a version change.
Version 1.1 (7 October 2026) added the section on the emails we send.