On this page
This policy explains what personal information Forty Grams collects, why we collect it, who we share it with, how long we keep it and what your rights are. It covers our website, online orders, our waiting list, enquiries from gyms, shops and personal trainers, and feedback.
Who we are
Forty Grams Ltd ("Forty Grams", "we", "us") is responsible for your personal information. In data protection law we're the "controller".
- Forty Grams Ltd, a company registered in England and Wales, company number [company number]
- Registered office: [registered office]
- Email: hello@40grams.co.uk
- Phone: [phone number]
We're a small business, so we don't have a data protection officer. Send any question about your information to hello@40grams.co.uk.
What we collect, why, and our lawful basis
The law says we must have a lawful basis for each way we use your information. Here's what we collect and why.
| What you do | What we collect | Why we use it | Lawful basis |
|---|---|---|---|
| Join the waiting list | First name, postcode, email address, the bowl you'd have first (if you tell us) and your agreement to hear from us | To email you when ordering opens, and about delivery and stockists near you (your postcode tells us which) | Your consent. You can withdraw it at any time. |
| Order online | Name, email address, phone number, billing and delivery address, what you ordered, your bowl choices and cook day, how you're getting your bowls, any delivery notes and any discount code | To take payment, cook, pack and deliver your order, and to contact you about it | Our contract with you |
| Pay for an order | Card or wallet details | To take payment. Stripe handles your card details: we never see your full card number. | Our contract with you |
| Use a trainer's code | The code, linked to your email address and your orders for 12 months | To give you the discount, and to pay your trainer 50p for each bowl you order for 12 months. Trainers see totals of bowls and money only, never your name or details. | Our legitimate interests in running the trainer scheme and paying trainers correctly |
| Order the taster or use a code | Your email address, delivery address and past orders | To check the taster is your household's first order and a trainer's code is used on a first order only | Our legitimate interests in stopping offers being misused |
| Get marketing emails as a customer | Your email address | To tell you about our bowls and offers, unless you said no at checkout or have unsubscribed | Our legitimate interests in telling customers about our food. Every email has an unsubscribe link. |
| Contact us, or complain | Your name, contact details and what you tell us | To answer you and deal with problems, refunds and complaints | Our contract with you, our legitimate interests in looking after customers, and our legal duties |
| Tell us about an allergy, or that you felt unwell after a bowl | What you tell us about your health | To answer your question or look into what happened | Your explicit consent, or where needed to deal with a legal claim |
| Send feedback | Your answers and comments, and your email address if you'd like a reply | To make our bowls better, and to reply if you ask | Our legitimate interests in improving our food |
| Ask about stocking our bowls | Your name, business name, type of business, town or postcode, email address, and if you give them, phone number, VAT status and notes | To reply, talk about stocking our bowls and, if you go ahead, run the arrangement | Our legitimate interests in finding stockists, then our contract with your business |
| Sign up as a personal trainer | Your name, email address, mobile number, where you train clients, the code you'd like and any notes. Later, your bank details and what we've paid you. | To check you're a self-employed personal trainer, set up your member number and code, send your agreement, pay you and keep our accounts | Steps you ask us to take before a contract, then our contract with you, and our legal duty to keep accounts |
| Visit our website | Technical information such as your IP address, browser and the pages you ask for. If you follow a trainer's link, their code is kept in your browser for that visit. | To show you the website, keep it secure and fill in the trainer's code at checkout | Our legitimate interests in running a secure website |
| Any order or payment | Records of orders, payments and refunds | To keep the accounts and records the law requires | Our legal duty |
| Any order | Which batch your bowls came from, and your contact details | To contact you quickly if we ever need to withdraw or recall a bowl | Our legal duties on food safety, and our legitimate interests in keeping customers safe |
Health information. If you tell us about an allergy or a health condition, or that you felt unwell after eating a bowl, the law treats that as sensitive information. We use it only to answer you or look into what you've told us, and we keep it no longer than we need to. We can't change our recipes for allergies, so please only send the health information we need to answer you.
Do you have to give us your information? No one has to join our list, send feedback or contact us. To order, we need your name, email address and phone number, and your address if we're delivering. Without them we can't take or deliver your order.
Automated decisions. We don't make decisions about you using automated means alone. Stripe checks payments automatically to spot fraud and may decline one. If that happens, contact us.
Who we share it with
We don't sell your information. We share it only with the people and services that help us run Forty Grams, and only what each one needs.
| Who | What they do for us | What they see | Where |
|---|---|---|---|
| Stripe | Runs our checkout and payments, sends your receipt and handles refunds | Your order, contact and address details, payment details, and information about your device and browser | UK, US and other countries |
| Cloudflare | Hosts our website and protects it from attacks | Technical information such as your IP address | A global network, run from the US |
| Web3Forms | Receives what you send through our website forms and emails it to us. Its spam filters (CleanTalk and Akismet) check your IP address and email address. | Everything you type into a form, and your IP address. It keeps form messages for up to 3 years. | India and other countries |
| Runs our email | Emails you send us, and form messages | US and other countries | |
| The kitchen that cooks for us, and our drivers | Cook, pack and deliver your order | Only what they need: the first name and order number on your bag, and, for delivery, your address, phone number and delivery notes | UK |
| Stockists | Hold your bowls in their fridge if you pick up from a gym or shop | The first name and order number on your bag | UK |
| Our accountant, insurer and legal advisers | Help us keep accounts, stay insured and get advice | What they need for that job | UK |
| HMRC, the council's food safety team, the police or the courts | Carry out their legal duties | What the law requires us to give them | UK |
Stripe's own role. Stripe also uses payment information for its own purposes as a separate controller: to prevent fraud and to meet its legal duties, such as checks against money laundering. If you choose to save your details with Onelink, Stripe's wallet (called Link outside the UK), Stripe is responsible for that account. See Stripe's privacy policy.
Instagram. If you message us on Instagram, Meta also handles your message under its own privacy policy.
If the business changes hands. If Forty Grams is ever sold or restructured, your information may pass to the new owner, who must use it in line with this policy.
Information sent outside the UK
Some of these services handle information outside the UK, including in the US and India. Where the UK doesn't recognise a country as giving adequate protection, we rely on safeguards in each service's contract: the UK International Data Transfer Addendum to the EU standard contractual clauses (Stripe, Cloudflare and Web3Forms), or the UK Extension to the EU–US Data Privacy Framework (Stripe and Cloudflare). Email us for more detail or a copy.
How long we keep it
We keep your information only as long as we need it, then delete it.
| Information | How long we keep it |
|---|---|
| Waiting list | Until you unsubscribe. Each year we remove anyone who signed up more than 2 years ago and hasn't ordered or been in touch. |
| Orders, payments and refunds, including the name, address and phone number on the order | 6 years from the end of the financial year they belong to, as the law requires for company accounts |
| Link between your orders and a trainer's code | The 12 months the code links you to the trainer, then kept with our accounts for 6 years |
| Emails and messages | 2 years after we last dealt with you |
| Complaints, refund claims and reports of feeling unwell | 6 years after we close them, the time limit for most legal claims |
| Health information you send us that isn't part of a complaint | Deleted within 3 months of answering you |
| Feedback | 3 years. If you gave your email address for a reply, we delete it 12 months after replying. |
| Stockist enquiries that don't go ahead | 2 years after we last spoke |
| Stockist agreements and invoices | 6 years after the agreement ends |
| Trainer sign-ups we don't go ahead with | 12 months |
| Trainer agreements and payment records | 6 years after the end of the financial year of the last payment. We delete bank details when the agreement ends. |
| Form messages held by Web3Forms | Up to 3 years under its terms. We delete our copies in line with this table. |
| Website security logs | Cloudflare keeps these under its own policy. We don't use analytics. |
Keeping your information safe
- Our website only loads over a secure, encrypted connection (HTTPS). If you type an address starting http://, you're sent to the secure one.
- You pay on Stripe's secure checkout, so your card details never reach us.
- Only the people who need your information to run your order or answer you can see it.
- We protect the accounts that hold your information with strong passwords and two-step sign-in.
- If something goes wrong, we'll act quickly, and we'll tell you and the ICO when the law requires it.
Your rights
You have the right to:
- see the information we hold about you and get a copy;
- correct information that's wrong or incomplete;
- delete your information, where we no longer need it or have no lawful basis to keep it;
- restrict how we use it, for example while we check something you've told us;
- object to us using it where we rely on our legitimate interests. You can always object to marketing, and we'll stop;
- take it with you in a common electronic format, where we use it under your consent or our contract and by automated means;
- withdraw your consent at any time, where we rely on it. This doesn't affect what we did before.
To use any of these rights, email hello@40grams.co.uk. It's free. We'll reply within one month. If your request is complex, or you've sent several, we may take up to two more months, and we'll tell you why within the first month. We may ask you to confirm who you are, or to tell us more so we can find the information. The month starts once we have what we need.
To stop marketing emails, use the unsubscribe link in any email, or email us.
Complaints
If you're unhappy with how we've handled your information, please tell us first, so we can put it right. Email hello@40grams.co.uk with "Data protection complaint" in the subject line. We'll confirm we've received it within 30 days, look into it, keep you updated and tell you the outcome.
You can also complain to the UK's data protection regulator, the Information Commission, which is still known as the ICO:
- online: ico.org.uk/make-a-complaint
- phone: 0303 123 1113
- post: Wycliffe House, Water Lane, Wilmslow, Cheshire SK9 5AF
Children
Our website and food aren't aimed at children, and you must be 18 or over to order. We don't knowingly collect information about anyone under 16.
Cookies
We don't use advertising or analytics cookies. Our cookies notice lists what our website stores in your browser and why.
Changes to this policy
We'll update this policy when the way we use information changes, and change the date at the top. If a change affects you, we'll tell you by email or on our website first.