What I do with your details

Tipsy Squirrel Events Ltd (company number 14694733, registered office 1434 London Road, Leigh-on-Sea, Essex SS9 2UL) is the data controller for the personal information described on this page — the organisation legally responsible for it. In practice that means me, Mike Sutton, the company’s only director: nobody else handles your details. Questions, requests and complaints come to mike@tipsysquirrelevents.com or 07960 862841.

What I collect, and where it comes from

When you enquire

Through the website forms, by email, WhatsApp, phone, or a message on Instagram or Facebook, you give me your name, an email address or phone number, the date, the number of guests, the occasion, a town or postcode, and whatever else you choose to tell me — including allergies and dietary requirements. The website forms also record that you ticked the consent box and whether you asked for occasional offers.

Both forms are stored in the site’s own database and emailed to me, and if you gave an email address you get an automatic acknowledgement straight back (the private-chef form also passes through Netlify’s form service, which keeps its own copy in my Netlify account). Alongside the form the site records the time you consented, your browser type, and a one-way scrambled version of your connection address that cannot be turned back into the address. That last item exists only to stop the forms being abused (five enquiries an hour per connection). Emails are sent through Resend, which sees the address and the content of each email it delivers.

When you book an event

The address where I’ll be cooking, dates and timings, the menu we agree, the headcount, dietary needs, deposit and balance payments, invoices, and the messages between us.

When I send you a booking link, the site’s database keeps the booking (date, guests, menu, price and payments) and your agreement to the booking terms: which version, each part you ticked, the card authorisation, the name you typed, the time, your browser type and a one-way scrambled version of your connection address. That is the record of what we agreed. Deposits and balances are paid by card through Stripe. Stripe saves the card you pay the deposit with so that the balance can be taken on the date you agreed; the card details stay with Stripe and never reach this website or me.

The final details you send on your booking page (numbers, timings, your kitchen, access, a phone number for the night, whether I may photograph the food, and your guests’ allergies and dietary needs) are kept with the booking and emailed to me and to you. Allergy and dietary details can be health information, so I ask for your explicit agreement before you send them, and for your confirmation that your guests are happy for you to share theirs.

Your guests

You will often tell me about your guests — how many, and who can’t eat what. Please pass on only what they would be happy for you to share, and let them know I will have it. I use it for that event only, and I never contact your guests.

Meal Prep

If you enquire, the details above. When you subscribe, the subscription is taken by Stripe: your name, email address, phone number, delivery address, any note about where to leave the box, and your card details. Card details never reach this website — Stripe holds them. Stripe passes me your name, contact details, address, delivery note and payment status, which the site’s database keeps so the boxes can be made and delivered, and which show on a private kitchen desk only I can open.

To plan delivery runs, delivery postcodes are turned into map coordinates by postcodes.io, journey times between those points are estimated by a routing service (OSRM), and the day’s addresses are opened in Google Maps on my phone for navigation. Postcodes, coordinates and addresses go to those services; your name does not.

When you browse this website

The site sets no analytics or advertising cookies. Netlify, which hosts it, keeps standard access logs (connection address, page requested, time) for security, for a limited period under its own policy. If you pay through Stripe, Stripe’s own checkout page sets cookies for fraud prevention; those are Stripe’s and are described in Stripe’s privacy policy. The kitchen’s private admin pages save a delivery tick-list in the browser that runs them — that is my browser, not yours.

Reviews and photographs

Reviews you post publicly (on Google or Facebook) or send me may be quoted on this site with your first name, the occasion and the month. If I photograph your event, I won’t publish anyone’s face on the website or on social media without asking first. Tell me and I will take a review or photograph down.

If you message me on WhatsApp, Instagram or Facebook

Those services hold your message and your number or handle as well, under Meta’s own privacy policies.

Why I use it, and the legal basis

UK data protection law requires a lawful basis for each use. These are mine:

• Replying to your enquiry and quoting — the steps you have asked me to take before we have a contract (UK GDPR Article 6(1)(b)).
• Cooking for your event, or making and delivering your boxes, taking payment and sending receipts — performing our contract (Article 6(1)(b)).
• Allergy and dietary details — your explicit consent (Article 9(2)(a)), given when you tick the box on a form or tell me directly. I need them to cook safely for you and your guests. You can withdraw consent at any time; I would then be unable to cater safely for that need.
• Accounts, invoices and tax records — a legal obligation (Article 6(1)(c)) under company and tax law.
• The occasional email about offers and new things — only if you ticked the box, or you are a past client who hasn’t opted out. This is my legitimate interest in keeping in touch with people who have used or asked about my cooking (Article 6(1)(f)), within the electronic marketing rules (PECR). Every such email says how to stop them, and replying “stop” always works.
• Keeping the website forms from being abused, keeping records of complaints, and defending any legal claim — my legitimate interests (Article 6(1)(f)), which I have weighed against yours: the data involved is minimal and the effect on you is nil unless you make a claim.
• Passing details to authorities — a legal obligation, for example to environmental health officers investigating a food-safety incident, or to HMRC.

I make no automated decisions about you. You don’t have to give me anything, but without contact details and a headcount I can’t quote, and without allergy details I can’t safely cater for that need.

Who sees it

Nobody buys or rents your details, and I don’t share them with advertisers. The companies below process them on my behalf, under contracts that limit what they may do with them:

• Google Workspace — email, calendar and files (quotes, menus, invoices).
• Netlify — hosting this website, its form service, and the site’s database.
• Resend — sends the site’s emails (acknowledgements, subscription emails, my notifications).
• Stripe — card payments for event deposits and balances (including keeping the card saved with a deposit until the balance is taken), and Meal Prep subscription payments and the customer portal.
• Xero — invoicing and the company’s accounts.
• WhatsApp, Instagram and Facebook (Meta) — if you contact me there.
• postcodes.io, OSRM and Google Maps — delivery postcodes, coordinates and addresses for planning and driving delivery runs.
• Professional advisers — my accountant, for the company’s accounts; solicitors or insurers if a dispute ever needed them.
• Authorities — HMRC, environmental health, the police or a court, where the law requires it.

Where it is stored

Google, Netlify, Stripe and Resend are US companies. Google, Netlify and Stripe are certified under the UK Extension to the EU–US Data Privacy Framework (the “UK–US data bridge”), which the UK government recognises as giving your information equivalent protection, and their contracts include the standard data protection clauses as a fallback. Resend transfers under the standard data protection clauses built into its data processing agreement (it also participates in the EU–US Data Privacy Framework). Xero is a New Zealand company; New Zealand’s data protection law is recognised by the UK as adequate. Meta operates its messaging services under its own published transfer safeguards.

How long I keep it

• Enquiries that don’t become bookings: twelve months after the last message, then deleted — including the copy held by Netlify’s form service.
• Bookings and Meal Prep subscriptions (contact details, what was ordered, invoices and payment records): six years after the end of the company’s financial year in which the event or payment fell — the period tax law requires accounting records to be kept.
• Allergy and dietary details: deleted twelve months after the event, or after your subscription ends — kept that long in case a food-safety question arises.
• Delivery address and delivery notes (Meal Prep): twelve months after your subscription ends.
• Offers opt-in: until you unsubscribe. I then keep only a note that you opted out, so I don’t email you again.
• Complaints, and requests you make under this notice: six years.
• Website access logs: Netlify’s own short retention period.

Your rights

You can ask me to:

• tell you what I hold about you and give you a copy;
• correct anything that is wrong;
• delete it — I will, unless the law requires me to keep it (tax records, for example), in which case I will say so;
• stop using it for a particular purpose, or restrict it while a dispute is sorted out;
• stop marketing — at any time, no reason needed;
• give you the details you provided for a booking or subscription in a portable format;
• withdraw consent you gave earlier, for example for dietary details.

Email mike@tipsysquirrelevents.com. There is no charge, I reply within a month, and I may ask you to confirm who you are before sending anything out.

Complaints

If something is wrong with how I have handled your information, tell me first — by email, by phone, or with the form below. I will acknowledge your complaint within 30 days (in practice far sooner), look into it, keep you posted, and tell you the outcome.

You also have the right to complain to the Information Commissioner’s Office, the UK’s data protection regulator: ico.org.uk/make-a-complaint, 0303 123 1113, or Wycliffe House, Water Lane, Wilmslow SK9 5AF.

Security

The website is served over HTTPS. The Meal Prep database is encrypted at rest by its host and is reachable only from the site’s own server code; the kitchen desk is password-protected. Card details are handled by Stripe, which is certified to the payment-industry standard (PCI DSS), and never touch this website. My email and files are in Google Workspace, protected by Google’s account security. If a breach ever put you at real risk, the law requires me to report it to the Information Commissioner within 72 hours and to tell you; I would.

Children

This website and the Meal Prep service are for adults. If you book a children’s party, the guest details you pass on are handled as described above.

About this notice

This version is dated 1 October 2026. I will update it whenever what I do with your details changes, and note the new date here. Earlier versions are available on request.