Privacy Policy

DishRank allows users to vote for dishes in local rankings.

When you vote, we may collect information associated with the vote, including:

• the league or ranking being voted in;
• the dish and business receiving the vote;
• the date and time of the vote;
• technical or security information used to help maintain the integrity of the voting system.

DishRank uses this information to:

• operate the ranking system;
• prevent duplicate or fraudulent voting;
• detect abuse;
• maintain accurate rankings;
• calculate awards and rankings;
• protect the integrity of the DishRank community.

We do not need your name or email address simply to cast a vote unless the particular feature through which you vote requires this.

Where technically and operationally possible, we aim to minimise the amount of personal information associated with public voting activity.

Restaurants and other businesses may create, claim or manage profiles on DishRank.

Information displayed publicly may include:

• business name;
• address;
• postcode;
• telephone number;
• website;
• business description;
• dishes;
• dish photographs;
• rankings;
• awards;
• promotions;
• other information submitted for publication.

If you are a restaurant owner, employee or representative managing a business profile, some information you provide may therefore become publicly available.

You should only submit information that you are authorised to provide and publish.

DishRank may generate awards based on ranking results.

Award information may include:

• business name;
• dish;
• league;
• position;
• month;
• year;
• award type;
• award tier, such as Gold, Silver or Bronze.

Awards may be displayed publicly on DishRank and may be incorporated into certificates, badges or other promotional materials made available to winning businesses.

DishRank may offer paid Featured Listings that provide promotional placement within relevant ranking pages.

When a business purchases a Featured Listing, we may process information including:

• account information;
• business information;
• selected league;
• placement information;
• purchase information;
• start and end dates;
• impressions;
• clicks;
• related performance information.

This information is used to provide and measure the Featured Listing service.

Featured Listings are promotional placements. They do not guarantee votes, rankings, customers, sales or any particular business outcome.

DishRank may offer paid subscription plans providing additional business features.

If you subscribe, we may process:

• account information;
• subscription plan;
• subscription status;
• billing information;
• payment-related identifiers;
• subscription dates;
• transaction information;
• use of subscription features.

Payments are processed by third-party payment providers such as Stripe. DishRank does not normally receive or store your full payment card number.

We may retain limited payment and transaction information where necessary for accounting, legal, fraud-prevention and business-record purposes.

Subscribers may be able to create promotional content for their DishRank profile, such as:

• offers;
• specials;
• events;
• announcements;
• seasonal promotions;
• promotional descriptions;
• images;
• links;
• dates and times.

We may collect information about how these promotions perform, such as:

• views;
• clicks;
• interactions;
• dates and times of interactions.

This information is used to provide businesses with performance information and to improve DishRank.

DishRank does not currently use third-party analytics cookies on its website.

However, DishRank may collect certain technical and application-level information when you use the Service. This can include information such as:

• IP address;
• browser type;
• device type;
• operating system;
• pages or features accessed;
• date and time of interactions;
• votes;
• QR-code interactions;
• Featured Listing impressions and clicks;
• promotion impressions and clicks;
• technical errors and diagnostic information.

We use this information to:

• operate the Service;
• maintain security;
• prevent abuse and fraudulent activity;
• operate and maintain rankings;
• provide business performance information;
• measure Featured Listing and promotion performance;
• diagnose technical problems;
• improve DishRank.

Where appropriate, we may use aggregated or anonymised information for analysis and reporting.

DishRank provides QR codes that businesses can use to direct customers to DishRank rankings and voting pages.

When a QR code is scanned, DishRank may record information about the resulting interaction, such as:

• the relevant business;
• the relevant league or dish;
• date and time;
• technical information;
• subsequent interactions, including votes.

This information may be used to provide participating businesses with information about their QR-code activity and to help DishRank operate and improve the voting system.

A QR scan does not by itself require a person to provide their name, email address or other directly identifying information.

DishRank currently uses a limited number of cookies that are necessary to operate, secure and maintain the Service.

These include cookies used for:

• maintaining user sessions;
• authentication and "remember me" functionality;
• protecting against cross-site request forgery;
• remembering cookie preferences.

DishRank does not currently use advertising, marketing or third-party analytics cookies.

For detailed information about the cookies used by DishRank, their purposes and their categories, please see our Cookie Policy.

Where we introduce additional cookies or similar technologies that require consent, we will update our Cookie Policy and provide appropriate consent controls.

DishRank currently uses only cookies that are necessary for the operation and security of the Service, together with a cookie used to remember your privacy preferences.

Because we do not currently use non-essential analytics or marketing cookies, there are no optional cookie categories to enable or disable.

If DishRank introduces optional cookies or similar technologies in the future, we will provide appropriate controls allowing you to make and change your choices.

Depending on the circumstances, we may use personal information to:

• provide DishRank services;
• create and manage accounts;
• operate rankings;
• process votes;
• prevent voting abuse;
• provide restaurant profiles;
• provide awards;
• provide Featured Listings;
• provide subscription services;
• process payments;
• provide promotional tools;
• provide analytics;
• communicate with you about your account;
• send important service notifications;
• respond to enquiries;
• provide customer support;
• maintain security;
• detect and prevent fraud or abuse;
• troubleshoot technical problems;
• improve DishRank;
• comply with legal obligations;
• establish, exercise or defend legal claims.

Where UK data protection law requires us to identify a lawful basis, we may rely on one or more of the following:

Contract

Where processing is necessary to provide a service you have requested or to perform a contract with you.

For example:

• creating your account;
• providing subscription services;
• providing Featured Listings;
• processing transactions;
• providing account functionality.

Legitimate interests

Where processing is necessary for our legitimate business interests and those interests are not overridden by your rights and interests.

Examples may include:

• maintaining platform security;
• preventing fraudulent voting;
• improving DishRank;
• maintaining service records;
• understanding usage of the Service;
• providing business performance information;
• protecting our legal rights.

Where we rely on legitimate interests, we consider the impact of the processing on individuals and seek to balance our interests against their rights.

Legal obligation

Where processing is necessary to comply with a legal or regulatory obligation.

For example:

• accounting records;
• tax records;
• responding to lawful requests;
• complying with applicable legal requirements.

Consent

Where consent is required or where we choose to rely on consent.

For example, certain non-essential cookies and similar technologies, or certain forms of electronic marketing.

Where processing is based on consent, you can withdraw that consent.

Withdrawal of consent does not affect the lawfulness of processing that took place before withdrawal.

We may send service-related communications necessary to operate your DishRank account.

Examples include:

• account confirmations;
• payment notifications;
• subscription notifications;
• Featured Listing expiry reminders;
• award notifications;
• security notifications;
• important changes to the Service.

These are different from promotional marketing communications.

Where required, we will obtain appropriate consent or rely on another lawful basis permitted by applicable electronic marketing laws before sending marketing communications.

You can unsubscribe from marketing communications using the unsubscribe mechanism provided in the communication or by contacting us.

Unsubscribing from marketing communications will not necessarily stop essential service communications relating to your account.

We may share personal information with trusted service providers where necessary to operate DishRank.

These may include:

Payment providers

For example, Stripe, to process payments and subscriptions.

Hosting and infrastructure providers

To host and operate DishRank and its databases, storage and infrastructure.

Email providers

To deliver account, service and, where permitted, marketing communications.

Analytics providers

Where we use analytics services and where the relevant processing has been permitted in accordance with applicable law.

Professional advisers

Such as accountants, lawyers, insurers or other professional advisers where necessary.

Authorities and legal parties

Where required by law, legal process, court order or to protect our rights, users or the security of the Service.

We do not sell your personal information.

DishRank may use third-party services to provide functionality.

These services may process personal information on our behalf or independently depending on the particular service and circumstances.

Examples may include:

• Stripe;
• hosting providers;
• email providers;
• analytics providers;
• security providers;
• QR-code or image-processing services.

Where appropriate, we seek to ensure that third-party providers provide appropriate security and privacy protections.

We will update this Privacy Policy or associated privacy information where material changes are made to the services we use.

Some of our service providers may process information outside the United Kingdom.

Where personal information is transferred internationally, we will take appropriate steps to ensure that the transfer is carried out in accordance with applicable UK data protection law.

Depending on the circumstances, this may involve:

• an adequacy regulation;
• appropriate contractual safeguards;
• the UK International Data Transfer Agreement;
• the UK Addendum to EU Standard Contractual Clauses;
• another lawful transfer mechanism.

Where required, further information about applicable safeguards will be made available.

We retain personal information only for as long as reasonably necessary for the purposes for which it was collected, unless a longer period is required or permitted by law.

Retention periods depend on the type of information.

For example:

Where we do not have a fixed retention period, we determine retention based on factors including:

• the purpose for which the information was collected;
• whether the information is still required;
• legal and accounting obligations;
• security and fraud-prevention requirements;
• potential legal claims.

The ICO expects privacy information to explain how long personal information will be retained or the criteria used to determine the retention period.

You may request deletion of your DishRank account.

Where an account can be deleted directly through the Service, we will provide an appropriate account deletion facility.

When an account is deleted, we will delete or anonymise personal information where appropriate, subject to information that we are required or permitted to retain.

Some information may need to remain available for legitimate purposes.

For example:

• accounting and tax records;
• fraud and abuse prevention;
• legal claims;
• historical ranking information;
• award records;
• information necessary to maintain the integrity of DishRank.

Deleting a user account does not necessarily mean that every historical record associated with the account can immediately be removed.

We take reasonable technical and organisational measures to protect personal information against:

• unauthorised access;
• accidental loss;
• destruction;
• alteration;
• disclosure;
• misuse.

These measures may include:

• encrypted connections;
• authentication controls;
• access restrictions;
• secure password handling;
• server security;
• monitoring and logging;
• backups;
• payment processing through specialist payment providers.

No internet-based service can guarantee absolute security.

Depending on the circumstances, you may have rights under UK data protection law including:

• the right to be informed;
• the right of access;
• the right to rectification;
• the right to erasure;
• the right to restrict processing;
• the right to object to processing;
• the right to data portability;
• rights relating to automated decision-making and profiling where applicable;
• the right to withdraw consent where processing is based on consent.

These rights are not absolute and may depend on the circumstances and lawful basis for processing.

The ICO confirms that the rights available can vary depending on the lawful basis relied upon.

To exercise your rights, contact:

privacy@dishrank.uk

Please provide enough information for us to identify you and understand your request.

We may need to verify your identity before providing personal information or making changes to an account.

We will normally respond to valid requests within the period required by applicable data protection law.

If you have concerns about how we have handled your personal information, please contact us first using:

privacy@dishrank.uk

You also have the right to complain to the UK's data protection regulator:

Information Commissioner's Office (ICO)

You can find information about making a complaint through the ICO's website.

Information Commissioner's Office

We would encourage you to contact us first so that we have an opportunity to address your concern.

DishRank is primarily intended for people using the Service to discover, vote for or manage businesses.

We do not knowingly collect personal information from children where doing so would be unlawful.

If you believe a child has provided personal information to us in circumstances where it should not have been collected, please contact us so that we can investigate and take appropriate action.

DishRank does not currently use personal information to make decisions about individuals that produce legal or similarly significant effects through solely automated decision-making.

DishRank's rankings are generated from voting activity and ranking rules. Ranking outcomes relate to dishes and businesses rather than making significant decisions about individual users.

We may update this Privacy Policy from time to time.

Changes may be made where:

• the Service changes;
• we introduce new features;
• we introduce new service providers;
• our data processing practices change;
• legal or regulatory requirements change.

When we make significant changes, we will take reasonable steps to bring them to your attention.

The "Last updated" date at the top of this policy will indicate when it was most recently updated.