Privacy Policy
Last updated: 13 October 2026
1. Who we are
This Privacy Policy explains how Umbak Technologies Ltd, trading as Irish Flavours ("we", "us", "our"), collects, uses and protects your personal data when you use our website, mobile site and apps (the "Platform") to order food, drink and other goods from takeaways, restaurants, retail stores and other businesses ("Merchants").
We are a company registered in Ireland, company number 813183, with our registered office at The Conifers, Barran, Blacklion, Co Cavan.
For most of the personal data described below, we are the data controller. This means we decide how and why your data is used. We comply with the EU General Data Protection Regulation (GDPR) and the Irish Data Protection Act 2018.
Contact for privacy matters: info@umbaktechnologies.com
2. Personal data we collect
Information you give us
- Account details: name, email address, phone number, password and delivery addresses.
- Order details: what you ordered, from which Merchant, order time, delivery or collection preference, special instructions (which may include dietary or allergy notes) and tips.
- Payment details: payments are handled by our payment provider. We receive confirmation of payment, the last four digits and type of card, and transaction references, but we do not store your full card number.
- Communications: messages, emails, chats and calls with our customer support team, and any complaints or feedback.
- Reviews and ratings you submit.
- Marketing preferences and competition or survey responses.
Information we collect automatically
- Device and technical data: IP address, browser type, device type, operating system, language and app version.
- Usage data: pages and features used, search terms, items viewed, time and date of visits, and referring pages.
- Location data: your delivery address, and, with your permission, approximate or precise location from your device to show nearby Merchants. You can turn this off in your device settings.
- Cookies and similar technologies: see section 9.
Information from others
- Merchants and delivery partners: information about your order status, delivery, refunds or issues.
- Payment provider and fraud prevention services: payment confirmation and fraud-risk signals.
- Social login providers, if you choose to sign up with them: basic profile details you authorise.
We do not knowingly collect special category data (such as health data). If you include allergy or dietary information in an order note, that note is passed to the Merchant to fulfil your order, and by including it you consent to us doing so.
3. How and why we use your data
We must have a lawful basis for using your data. The table below summarises ours.
| Purpose | Examples | Lawful basis |
|---|---|---|
| Provide the Platform and process orders | Creating your account, sending your order to the Merchant, taking payment, arranging delivery, order updates, refunds | Contract (performing our contract with you) |
| Customer support | Answering queries, handling complaints and problems with orders | Contract; legitimate interests |
| Security and fraud prevention | Verifying accounts, detecting fake or fraudulent orders, protecting the Platform | Legitimate interests; legal obligation |
| Improve and develop the Platform | Analytics, troubleshooting, testing new features, understanding how customers use the service | Legitimate interests; consent for non-essential cookies |
| Marketing | Emails, texts or push notifications about offers, new Merchants and promotions | Consent, or legitimate interests for existing customers where the law allows ("soft opt-in") |
| Personalisation | Recommending Merchants and dishes based on your past orders and location | Legitimate interests; consent where required |
| Legal and regulatory compliance | Tax and accounting records, responding to lawful requests from authorities | Legal obligation |
| Protect legal rights | Establishing, exercising or defending legal claims | Legitimate interests |
Where we rely on consent, you can withdraw it at any time (for example, by using the unsubscribe link in a marketing email or changing your settings). Withdrawing consent does not affect processing carried out before you withdrew it.
Where we rely on legitimate interests, we have weighed those interests against your rights and freedoms. You can ask us for details of this assessment.
4. Marketing
We will only send you electronic marketing where you have agreed, or, if you are an existing customer, about similar goods and services, and you were given the chance to opt out when we collected your details and in every message since. You can opt out at any time by using the unsubscribe link or emailing info@umbaktechnologies.com. We will still send you service messages about your orders and account.
5. Who we share your data with
We do not sell your personal data. We share it only as described below.
- Merchants: to fulfil your order, we share your name, order details, delivery address, phone number and any notes. Merchants use this data to prepare and deliver your order, and may act as independent controllers of that data under their own privacy notices (for example, for their own order records and legal obligations).
- Delivery partners and couriers, where delivery is arranged through us or a third party: name, address, phone number and order details needed to deliver.
- Service providers (processors) who work for us under contract and only on our instructions, such as: payment processing (Stripe, AIBMS]), cloud hosting (Railway and AWS), email and SMS delivery (Resend, Twilio), customer support tools (Salesforce, Hubspot, Zendesk, Zohodesk), analytics (Google), and fraud prevention (docusigm, ID Pal, Onfido).
- Professional advisers, such as lawyers, accountants, auditors and insurers.
- Authorities and regulators, including the Revenue Commissioners, An Garda Síochána or courts, where we are legally required or it is necessary to protect rights, safety or prevent crime.
- Business transfers: if we are involved in a merger, acquisition, financing or sale of assets, your data may be transferred to the other party, who must continue to protect it in line with this Policy.
- With your consent or at your direction, for any other purpose.
6. International transfers
We aim to keep your data within the European Economic Area (EEA). Some of our service providers may process data outside the EEA (for example, in the United States or the United Kingdom). Where they do, we make sure the transfer is protected by an approved safeguard, such as an adequacy decision of the European Commission (including the EU–US Data Privacy Framework where the recipient is certified), or the European Commission's Standard Contractual Clauses together with any additional measures needed. You can contact us for a copy of the safeguards we use.
7. How long we keep your data
We keep personal data only as long as necessary for the purposes it was collected, including to meet legal, accounting or reporting requirements. As a guide:
- Account data: for as long as your account is active, and then 12 months after closure or 24 months of inactivity, unless we need to keep it longer for legal reasons.
- Order and transaction records: 6 years after the end of financial year, to meet Irish tax and accounting obligations.
- Customer support records: 24 months after the issue is closed.
- Marketing data: until you unsubscribe or withdraw consent, then a minimal record to honour your opt-out.
- Cookies and analytics data: as set out in our Cookie Policy.
- Records needed for a legal claim or investigation: until the matter is concluded.
When we no longer need the data, we delete or anonymise it.
8. Your rights
Under data protection law, you have the right to:
- Access a copy of the personal data we hold about you;
- Rectification of inaccurate or incomplete data;
- Erasure ("right to be forgotten") of your data in certain circumstances;
- Restriction of processing in certain circumstances;
- Data portability – to receive data you provided to us in a structured, commonly used, machine-readable format, and have it transferred to another controller where technically feasible;
- Object to processing based on legitimate interests, and to direct marketing at any time;
- Withdraw consent where we rely on it; and
- Not be subject to solely automated decisions that have legal or similarly significant effects. We do not currently make such decisions.
To exercise any right, email info@umbaktechnologies.com. We may need to verify your identity first. We will respond within one month, which we can extend by up to two further months for complex or numerous requests (and we will tell you if so). We do not charge a fee unless a request is manifestly unfounded or excessive.
Complaints. If you are unhappy with how we handle your data, please contact us first. You also have the right to lodge a complaint with the Irish supervisory authority:
Data Protection Commission, 6 Pembroke Row, Dublin 2, D02 X963, Ireland. Website: www.dataprotection.ie.
9. Cookies and similar technologies
We use cookies and similar technologies (such as pixels and local storage) to make the Platform work, remember your preferences, understand how it is used and, where you agree, for analytics and marketing.
- Strictly necessary cookies: needed for the Platform to function (for example, keeping you logged in and your basket). These do not require consent.
- Preference and functional cookies: remember choices such as your location.
- Analytics cookies: help us understand how visitors use the Platform. Used only with your consent.
- Marketing cookies: used to show relevant offers. Used only with your consent.
When you first visit, we will ask for your consent to non-essential cookies, and you can change your choices at any time through cookie settings link. A full list of the cookies we use is in our Cookie Policy. You can also control cookies through your browser settings.
10. Security
We use appropriate technical and organisational measures to protect your personal data against unauthorised access, loss, misuse or alteration. These include encryption in transit, access controls, staff confidentiality obligations and regular reviews of our systems. No online service can be completely secure, so please use a strong, unique password and keep it confidential.
If a personal data breach is likely to put your rights and freedoms at risk, we will notify the Data Protection Commission within 72 hours and tell you without undue delay where required.
11. Children
The Platform is not intended for anyone under 18, and we do not knowingly collect personal data from children. If you believe a child has given us personal data, please contact us and we will delete it.
12. Automated processing and profiling
We use basic profiling, such as recommending Merchants based on your location and previous orders. This does not produce legal or similarly significant effects on you. You can object to profiling used for marketing at any time (see section 8).
13. Third-party links
The Platform may link to third-party websites and services, including Merchant sites and social media. We are not responsible for their privacy practices, so please read their privacy notices.
14. Changes to this Privacy Policy
We may update this Policy from time to time. We will post the latest version here with a new "last updated" date, and notify you by email or on the Platform if changes are significant.
15. Contact us
Umbak Technologies Ltd (trading as Irish Flavours) Email: info@umbaktechnologies.com