Version 1.0. Last updated: 29 September 2026.

1. Who we are

1.1 SideDish Media Ltd (SDM, we, us or our) is the controller of the personal data described in this policy. We are a company registered in England and Wales with company number 10561053. Our registered office is c/o D & K Accountancy Services Limited, Solar House, 915 High Road, London, N12 8QJ, United Kingdom.

1.2 You can contact us about this policy or your personal data at hello@sidedishmedia.co.uk.

1.3 We handle personal data in line with UK data protection law, including the UK GDPR and the Data Protection Act 2018.

1.4 This policy covers personal data about visitors to our website, people who contact us or sign up to our updates, and contacts at our clients, prospective clients and suppliers. Where we process personal data on behalf of our clients, for example leads generated by their campaigns, we act as a processor and our client's own privacy notice applies. Our Data Processing Terms explain how we handle that data.

2. The personal data we collect

2.1 Enquiry forms: your first and last name, business or restaurant name, website, email address, phone number and anything you tell us in your message.

2.2 Newsletter and Exclusive Diners sign-ups: your email address.

2.3 Website use: your IP address, device and browser details, the pages you visit, how you reached our website (including ad click identifiers) and how you interact with it. We collect this through cookies and similar technologies, as explained in our Cookie Policy.

2.4 Visitor identification: if you accept marketing cookies, we use Leadsy, a website visitor identification service. Leadsy may identify you or your business from your visit and provide us with business contact details, such as your name, job title, company and business email address.

2.5 Phone calls: if you call us, we may record your phone number and details of the call. We do not routinely record calls. If we ever need to record a call, we will tell you at the start of the call.

2.6 Clients and suppliers: contact names, job titles, email addresses, phone numbers, billing details and our correspondence with you. Card payments are processed by our payment provider, Stripe. We do not store full card numbers.

2.7 Public sources: when researching potential clients, we may collect business contact details from public sources, such as business websites, Google Business Profiles and Companies House.

3. How we use your personal data and our lawful basis

3.1 To respond to your enquiry and prepare a proposal. Lawful basis: our legitimate interests in responding to people who contact us, and taking steps at your request before entering into a contract.

3.2 To provide our services and manage our relationship with our clients. Lawful basis: performance of our contract with the client, and our legitimate interests in managing relationships with individual contacts at client businesses.

3.3 To invoice, take payments and keep accounting records. Lawful basis: performance of a contract and compliance with our legal obligations, including tax law.

3.4 To send you our newsletter and Exclusive Diners updates. Lawful basis: your consent. You can unsubscribe at any time using the link in every email.

3.5 To send business-to-business marketing about our services to contacts at companies. Lawful basis: our legitimate interests in promoting our business. Every message includes a simple way to opt out. Where the law requires your consent, for example if you are a sole trader or in a partnership, we will only send marketing emails with your consent or where you are an existing customer who has not opted out.

3.6 To measure and improve our website and advertising, and to identify business visitors. Lawful basis: your consent, given through our cookie banner.

3.7 To keep our website and systems secure, and to establish, exercise or defend legal claims. Lawful basis: our legitimate interests and, where applicable, our legal obligations.

3.8 We do not use your personal data to make decisions based solely on automated processing that have legal or similarly significant effects on you.

4. Who we share your personal data with

4.1 We share personal data only where necessary, with:

(a) our service providers, including Webflow (website hosting and forms), Google (Workspace, Tag Manager, Analytics and Ads), Meta (advertising), WhatConverts (call and form tracking), Leadsy (visitor identification), Brevo (email marketing), Stripe (payments), Supabase and Vercel (hosting), Slack (internal communications) and Zapier (workflow automation);

(b) our accountants and professional advisers;

(c) regulators, law enforcement or other authorities where the law requires it; and

(d) a buyer or successor if we sell or restructure our business.

4.2 We do not sell your personal data.

5. International transfers

5.1 Some of our service providers process data outside the United Kingdom, including in the European Economic Area and the United States. Where this happens, we make sure the transfer is permitted by UK data protection law. This includes transfers to countries covered by UK adequacy regulations, to US organisations certified under the UK Extension to the EU-US Data Privacy Framework, or under the ICO's International Data Transfer Agreement or International Data Transfer Addendum.

6. How long we keep your personal data

6.1 Enquiries that do not lead to a contract: two years from our last contact with you.

6.2 Client and supplier records, including invoices: six years after our relationship ends, to meet tax and legal requirements and to deal with any claims.

6.3 Newsletter and Exclusive Diners subscribers: until you unsubscribe. After that, we keep your email address on a suppression list so that we do not contact you again.

6.4 Call details and any call recordings: no more than 90 days.

6.5 Cookie data: for the periods set out in our Cookie Policy.

7. Your rights

7.1 Under UK data protection law, you have the right to:

(a) access the personal data we hold about you;

(b) have inaccurate personal data corrected;

(c) have your personal data erased in certain circumstances;

(d) restrict how we use your personal data in certain circumstances;

(e) object to our use of your personal data where we rely on legitimate interests, and to object at any time to direct marketing;

(f) receive your personal data in a portable format in certain circumstances; and

(g) withdraw your consent at any time, where we rely on consent. This does not affect processing carried out before you withdraw it.

7.2 To exercise any of these rights, email hello@sidedishmedia.co.uk. We will respond within one month. For complex or multiple requests, we may extend this by up to two further months and will tell you if we do.

8. Complaints

8.1 If you are unhappy with how we have handled your personal data, please contact us first at hello@sidedishmedia.co.uk. We will acknowledge your complaint within 30 days and respond without undue delay.

8.2 You also have the right to complain to the Information Commissioner's Office at ico.org.uk or on 0303 123 1113.

9. Security

9.1 We use appropriate technical and organisational measures to protect your personal data, including access controls, multi-factor authentication where available and encryption in transit.

10. Children

10.1 Our services are for businesses and are not directed at children. Our Exclusive Diners updates are intended for adults aged 18 and over, and may include offers involving alcohol.

11. Changes to this policy

11.1 We may update this policy from time to time. The version number and date at the top of this page show when it was last changed.