Allbites Privacy Policy

Allbites is an online platform connecting market operators, traders, space owners and shoppers.

“Allbites” is currently a trading name used by Mike Norledge (“Allbites”, “we”, “us” or “our”).

For the purposes of UK data protection law, Mike Norledge trading as Allbites is the controller of personal information processed by Allbites unless stated otherwise.

You can contact us at: Email: hello@allbites.co.uk. Correspondence address: [BUSINESS ADDRESS TO ADD].

This Privacy Policy explains what personal information we collect, why we use it, who we share it with and the rights you have in relation to it.

This policy applies to anyone using or interacting with Allbites, including:

• Market operators and their staff;
• Traders and their staff;
• Space owners and representatives of councils, schools, BIDs, property owners, sports clubs and community organisations;
• Shoppers;
• People who contact us or express an interest in Allbites; and
• Visitors to our website.

The information we collect depends on how you use Allbites.

Account information — when you create an account, we may collect information such as your:

• Name;
• Email address;
• Telephone number;
• Password or authentication information;
• Business or organisation name;
• Role;
• Location; and
• Account preferences.

Operator information — if you create an operator profile or market, we may collect:

• Business and contact information;
• Information about markets you operate;
• Market addresses and locations;
• Trading dates and times;
• Pitch information and fees;
• Photographs;
• Market terms;
• Trader applications;
• Booking and attendance information;
• Communications with traders and Space Owners; and
• Transaction and payout information.

Trader information — trader profiles may contain:

• Business and trading name;
• Contact information;
• Business description;
• Product categories;
• Photographs and branding;
• Social-media information;
• Trading locations and preferences;
• Booking history;
• Payment information; and
• Compliance documentation.

Depending on the trader and market, compliance documentation may include public liability insurance, risk assessments, food hygiene information, gas or electrical safety documentation and licences. Allbites' existing platform is designed to allow operators to review relevant trader documentation and monitor expiry dates.

Compliance documents are not intended to form part of your public trader profile. They may be made available to relevant market operators, authorised market staff and Allbites personnel where required to operate the service.

Space Owner information — when you submit a space or existing market opportunity, we may collect:

• Your name and organisation;
• Contact information;
• Your role within the organisation;
• Site address and location;
• Site photographs;
• Access and capacity information;
• Availability;
• Utilities;
• Existing market information;
• Proposed commercial arrangements; and
• Communications relating to the opportunity.

Shopper information — we may collect:

• Account information;
• Markets and traders you follow;
• Pre-orders;
• Order history;
• Reviews;
• Communications; and
• Preferences.

Payment and transaction information — payments on Allbites are processed using Stripe. We may receive transaction information including payment status, amount, currency, fees, refunds, payouts and identifiers associated with a payment. We do not generally receive or store your full payment-card details.

Communications — we may retain messages sent through Allbites and communications you have with us, including support enquiries.

Technical information — when you use Allbites, we may collect technical information such as:

• IP address;
• Browser and device information;
• Pages viewed;
• Login information;
• Referral source;
• Website activity; and
• Cookie and similar technology information.

Some information you provide is intended to be public. This may include:

• Market names, locations, photographs and trading dates;
• Operator information;
• Trader display names and business names;
• Trader photographs and descriptions;
• Products;
• Markets at which a trader is appearing; and
• Reviews.

We will aim to make clear when information you provide will be publicly visible.

Sensitive account information, private messages, payment information and trader compliance documents are not intended to be publicly displayed.

We may use personal information to:

• Create and manage accounts;
• Provide Allbites' platform functionality;
• Publish markets and trader profiles;
• Match operators with market opportunities;
• Help operators discover traders;
• Alert traders to relevant stalls;
• Process applications and bookings;
• Facilitate payments and payouts;
• Manage waitlists;
• Support trader compliance;
• Facilitate shopper pre-orders;
• Provide favourites and notifications;
• Enable messaging;
• Prevent fraud and misuse;
• Provide customer support;
• Improve Allbites;
• Analyse platform performance;
• Comply with legal obligations; and
• Market Allbites where permitted by law.

Depending on the activity, we rely on one or more lawful bases under UK data protection law.

Contract — we process information where necessary to provide the services you request or to take steps at your request before entering into a contract. For example, this may include creating your account, processing a booking or providing platform functionality.

Legitimate interests — we may process information where necessary for our legitimate business interests, provided those interests are not overridden by your rights. These interests can include:

• Operating and improving Allbites;
• Preventing fraud;
• Providing support;
• Developing the Allbites network;
• Connecting relevant businesses and opportunities; and
• Appropriate business-to-business marketing.

Legal obligation — we may process information where necessary to comply with a legal obligation.

Consent — where consent is required, including for certain marketing communications or non-essential cookies, we will ask for it.

The ICO requires privacy information to explain both the purposes for processing and the relevant lawful basis.

Allbites may identify potential operators, traders, Space Owners and business contacts using publicly available business information. Sources may include:

• Company and organisation websites;
• Market websites and directories;
• Public business directories;
• Professional networking platforms;
• Social-media business profiles; and
• Publicly available council or organisational information.

The information we collect may include a person's name, job title, organisation, business email address, business telephone number, location and publicly available information relevant to their business or market activity.

We may use this information to make relevant business-to-business contact about Allbites. You can object to direct marketing at any time.

Where personal information is obtained from another source rather than directly from the person, UK data protection rules require additional transparency about the categories and source of that information. The ICO also states that business contacts whose personal information is obtained from public sources generally need to receive the relevant privacy information within a reasonable period and no later than one month after collection.

Operators — relevant trader information may be shared with operators where necessary to assess applications, manage bookings, operate markets and manage compliance.

Traders — relevant booking, shopper and pre-order information may be shared with traders where necessary to fulfil orders or provide their services.

Space Owners — relevant operator information may be shared with a Space Owner where an operator applies for or is considered for an opportunity.

Service providers — we may use providers that support Allbites with services such as:

• Hosting and infrastructure;
• Email and communications;
• Analytics;
• Customer support;
• Authentication;
• Payments; and
• Fraud prevention.

These currently include Stripe for payment processing.

Legal and regulatory purposes — we may disclose information where required by law, court order, regulatory requirement or to protect the rights, property or safety of Allbites, our users or others.

Allbites uses Stripe and Stripe Connect to provide payment services.

Operators or other users receiving payments may be required to create or connect a Stripe account.

Information may be shared between Allbites and Stripe to facilitate account onboarding, transactions, payments, refunds, payouts, fraud prevention and compliance.

Stripe has a direct contractual relationship with connected accounts under its Connected Account Agreement, and its terms provide for information about connected-account activity and transactions to be shared with the relevant platform.

We may send communications about:

• New market opportunities;
• Available stalls;
• Relevant traders;
• Market reminders;
• Platform functionality;
• Allbites services; and
• Other relevant business opportunities.

Where required, we will obtain consent. You can unsubscribe from marketing emails using the unsubscribe option provided or contact us at hello@allbites.co.uk.

Service messages necessary for your account, booking, payment or transaction may still be sent even if you opt out of marketing.

Allbites may use cookies and similar technologies to operate the website, remember preferences, understand how the platform is used and, where applicable, measure marketing activity.

Strictly necessary cookies may be used without consent where legally permitted.

Where consent is required for non-essential cookies, they should not be placed until the appropriate consent has been obtained. ICO guidance requires users to receive clear information about cookies and generally requires agreement for cookies that are not strictly necessary.

A separate Cookie Policy may provide further information about the technologies used by Allbites.

Some of our service providers or users may be located outside the UK.

Where personal information is transferred internationally, we will take appropriate steps required by applicable data protection law to protect that information.

Because Allbites is intended to support international markets, information may also be shared with operators, traders or other users in the country relevant to a particular market or transaction.

We retain personal information only for as long as reasonably necessary for the purposes for which it was collected, including providing Allbites, maintaining transaction and booking records, resolving disputes and satisfying legal, tax, accounting or regulatory requirements.

Different categories of information may therefore have different retention periods.

Where an account is closed, some information may continue to be retained where reasonably necessary or legally required.

We use reasonable technical and organisational measures designed to protect personal information.

However, no internet service or electronic storage system can guarantee complete security.

Users are responsible for protecting their account credentials and should notify us promptly if they believe their account has been compromised.

Depending on applicable law and the circumstances, you may have rights including:

• Accessing personal information we hold about you;
• Correcting inaccurate information;
• Requesting deletion;
• Restricting processing;
• Objecting to certain processing;
• Objecting to direct marketing;
• Requesting transfer of certain information; and
• Withdrawing consent where processing relies on consent.

To exercise your rights, contact hello@allbites.co.uk.

You also have the right to complain to the UK's Information Commissioner's Office.

Allbites is not designed for children to create operator, trader or Space Owner accounts.

If we introduce services specifically intended for children, we will review the privacy arrangements applying to those services.

We may update this Privacy Policy as Allbites develops or where legal or regulatory requirements change.

The latest version will be published on the Allbites website with the date it was last updated.