Privacy Policy

1. Who we are

This website (soup-r.co.uk) and the Compound workplace food service are operated by SOUP-R Ltd ("SOUP-R", "Compound", "we", "us", "our"), a company registered in England and Wales.

For any questions about this policy, to exercise your data rights, or to request deletion of your personal data, contact us at Charlie@soup-r.co.uk.

SOUP-R Ltd is the data controller for the personal data described in this policy.

2. What this policy covers

This policy explains how we collect and use personal data when you (a) browse our website, (b) contact us or book a meeting, (c) use the Compound app to purchase meals, snacks and drinks from a Compound fridge at your workplace, or (d) interact with us as a client, landlord or on-site contact.

3. The personal data we collect

a. When you visit the website

• Technical data: IP address, device, browser, operating system, referrer.
• Usage data: pages viewed, time on page, links clicked, approximate location (city/country) derived from IP.
• Cookies and similar technologies used for analytics and basic site function.

b. When you contact us or book a call

• Name, work email, phone number, company, role.
• Site details (location, headcount, building type) you share to scope a proposal.
• Meeting metadata captured by our scheduling tool (HubSpot Meetings).
• Correspondence content (emails, notes, messages).

c. When you use the Compound app at a site

• Account details: name, work email, workplace, and (where applicable) employer subsidy status.
• Purchase data: items unlocked from the fridge, prices, time, location.
• Payment data: handled by our PCI-compliant payment processor; we do not store full card details.
• Dietary preferences or allergens, only if you choose to share them.

d. When you are an on-site contact, landlord or client

• Name, work contact details, role, and delivery/operational notes needed to run the service at your site.

4. How we use your data and our legal basis (UK GDPR)

• Run the Compound service — fulfil purchases, manage deliveries, coordinate with on-site contacts. Legal basis: contract.
• Respond to enquiries and proposals — answer your questions, send quotes, book meetings. Legal basis: legitimate interests / steps prior to entering a contract.
• Improve the website and service — analytics, troubleshooting, product development. Legal basis: legitimate interests.
• Send service updates — operational emails about menus, deliveries, app changes. Legal basis: contract / legitimate interests.
• Marketing emails to business contacts — only where lawful and with an easy opt-out. Legal basis: legitimate interests or consent, depending on context.
• Comply with law — accounting, tax, food safety, health & safety, responding to lawful requests. Legal basis: legal obligation.

5. Third parties we share data with

We only share personal data with service providers we need to run the business. These providers act as processors on our behalf and are bound by contractual data protection terms. Current categories include:

• HubSpot — CRM, meeting booking, email correspondence.
• Cloud hosting and database providers — to run the website and Compound app backend.
• Payment processor — to take in-app payments securely.
• Email and communication tools — to send transactional and service emails.
• Analytics tools — to understand website usage in aggregate.
• Delivery, kitchen and food production partners — limited operational data needed to deliver meals to a site.
• Professional advisers — accountants, auditors and lawyers, where necessary.

We do not sell your personal data. Where data is transferred outside the UK/EEA, we rely on appropriate safeguards such as the UK International Data Transfer Addendum or EU Standard Contractual Clauses.

6. Cookies

We use a small number of cookies and similar technologies for essential site function and to measure how the site is used. You can control cookies via your browser settings. Disabling some cookies may affect site functionality.

7. How long we keep your data

We keep personal data only for as long as we have a lawful reason to. In practice:

• Enquiry and prospect data — for as long as there is an active commercial conversation, and afterwards while we have a legitimate interest in following up.
• Client and on-site contact data — for the duration of the contract and a reasonable period afterwards for legal, tax and operational records (typically up to 7 years for finance records).
• App purchase data — for as long as needed to operate the service and meet tax and accounting obligations.
• Website analytics — held in aggregated form for as long as it remains useful.

You can ask us to delete your data at any time and we will do so, except where we are legally required to retain it.

8. How we protect your data

We use appropriate technical and organisational measures including encryption in transit, access controls, role-based permissions, and trusted infrastructure providers. No system can be guaranteed 100% secure, but we treat your data with care and review our security regularly.

9. Your rights

Under UK GDPR you have the right to:

• Access the personal data we hold about you.
• Ask us to correct inaccurate data.
• Ask us to delete your data ("right to be forgotten").
• Restrict or object to certain processing.
• Request portability of data you provided to us.
• Withdraw consent at any time, where processing is based on consent.
• Opt out of marketing emails at any time.

To exercise any of these rights, email Charlie@soup-r.co.uk. You also have the right to lodge a complaint with the UK Information Commissioner's Office (ICO) at ico.org.uk.

10. Children

The Compound service and website are intended for business users and workplace audiences. We do not knowingly collect personal data from children.

11. Changes to this policy

We may update this policy from time to time. The latest version will always be available on this page, with the "Last updated" date at the top.

12. Contact

SOUP-R Ltd
Email: Charlie@soup-r.co.uk
London, United Kingdom