Last updated: 22 August 2026
This notice explains how Some Grub Ltd collects and uses personal information when you visit our website, contact us, join our mailing list, take part in a quiz or project, or buy from us.
Who we are
Some Grub Ltd is the controller of the personal information described in this notice.
Some Grub Ltd
Company number 13132625
10 Lower Bore Street, Bodmin, Cornwall, PL31 2JX
Email: [email protected]
Information we collect
Depending on how you deal with us, we may collect:
- your name, email address, telephone number, billing address and delivery address;
- account, order, payment-status, refund, delivery and customer-service information;
- your marketing choices and records of consent, withdrawal or objection;
- information about how you reached and used our website, such as your IP address, device and browser information, pages viewed, referring page, campaign and click references, cookie or browser identifiers and actions such as adding an item to your basket or completing an order;
- information you choose to give us in a survey, food trial, quiz, form or message; and
- information about your dog that you choose to provide so that we can supply a requested result, guide or service.
Please do not include information about your own health or other unnecessary personal information in free-text boxes. We do not send answers about a dog's health, quiz answers or free-text responses to Meta for advertising.
How and why we use personal information
We use personal information for the following purposes and legal reasons:
Orders and customer service
We use contact, order and delivery information to take payment, fulfil orders, deal with returns, answer questions and provide requested services. This is necessary to perform our contract with you or to take steps at your request before entering into a contract.
Legal, tax, security and business administration
We keep records where needed to comply with tax, accounting, consumer-protection and other legal obligations. We also use proportionate security and fraud-prevention measures and manage our business records. The legal basis is legal obligation or our legitimate interests in protecting and running the business.
Email and SMS marketing
We send marketing where you have consented or where the electronic-marketing rules permit us to contact an existing customer about our own similar products and we offered an opt-out when collecting the details and in every message. You can unsubscribe at any time.
Website measurement and advertising tracking
If you give advertising or analytics consent through our privacy controls, we and our providers may use cookies, pixels, local storage and similar technologies to understand visits, measure advertising, attribute orders or enquiries to campaigns and show or limit advertising. Providers can include Meta, Google, Microsoft, PostHog, Klaviyo, Shopify and Cloudflare. The legal basis for storing or accessing information on your device, and for the related personal-data processing where required, is your consent. You can reject or withdraw this consent at any time through Privacy and cookie choices. Rejecting optional tracking does not prevent you from buying from us.
Meta customer audiences, exclusions and similar audiences
Subject to the safeguards below, we may use eligible customer contact information with Meta to:
- match people to a customer audience;
- exclude existing customers from acquisition advertising;
- measure the effect of our advertising; and
- help Meta find prospective customers with characteristics similar to an eligible source audience.
The information used for customer-list matching may include email address, telephone number, name, town or city, postcode and country. For a value-based audience it may also include an order-value or customer-value field. We minimise each upload to the identifiers needed for matching and do not upload order contents, dog-health answers, quiz answers or free text.
Before a customer list is sent, identifiers are normalised and hashed locally for matching. Hashing is a security measure and does not anonymise the information. Meta compares the hashed identifiers with its own records and creates a matched audience. Meta says it deletes the uploaded hashed identifiers promptly after matching. The resulting audience remains until we update or delete it.
For UK customer-list matching, Some Grub is the controller and instructs Meta Platforms, Inc. to act as processor for the matching service under Meta's Customer List Custom Audiences Terms. Meta may have different roles for information collected through its Pixel and other Business Tools, as described in Meta's terms and privacy information.
We rely on our legitimate interests in using proportionate advertising to grow the business, avoid wasting advertising on existing customers and measure advertising effectiveness. We only rely on this basis after carrying out a legitimate interests assessment and a data protection impact assessment, telling people clearly about the use and providing an easy objection route. We do not use this basis where our interests are overridden by a person's rights or reasonable expectations.
You have an absolute right to object to the use of your personal information for direct marketing, including customer-list audiences and using your information as a source for similar-audience advertising. To object, email [email protected] with the subject Meta advertising objection or use our Advertising objection page. We will retain the minimum information needed on a suppression record so that your objection continues to be honoured.
If you unsubscribe from our email marketing, we will also exclude your contact details from future Meta customer-list uploads under our current operating policy. Rejecting advertising cookies in a browser is separate: it stops optional advertising tracking on that browser, but does not identify you or create a customer-list objection unless you also use the objection route above.
Who we share information with
We share personal information only where needed with service providers that help us run the business, including:
- Shopify and payment providers for ecommerce, checkout and payments;
- fulfilment, delivery and customer-service providers;
- Klaviyo and other approved communications providers;
- hosting, security, analytics and website providers including Cloudflare, Google, Microsoft and PostHog;
- advertising providers including Meta, but only as described above and subject to the relevant consent or audience safeguards;
- professional advisers, insurers, regulators, courts, law-enforcement bodies or prospective business purchasers where legally required or reasonably necessary.
Some providers process information as our processors. Others may act as separate or joint controllers for parts of their service. Their own privacy notices explain those activities.
International transfers
Some providers, including Shopify, Meta and other technology suppliers, may process personal information outside the UK, including in the United States. Where UK data-protection law requires it, we use an approved transfer mechanism such as UK adequacy regulations, the UK International Data Transfer Agreement or the UK Addendum to the EU standard contractual clauses, together with appropriate checks and safeguards.
How long we keep information
We keep personal information only for as long as needed for the purpose collected, including legal, tax, accounting, dispute and security requirements.
- Order and accounting records are normally kept for six years after the relevant accounting period, unless a longer period is required for a dispute or legal obligation.
- Marketing records are kept while the relationship or permission remains active and are reviewed regularly.
- A minimal suppression record is kept for as long as we may otherwise use the relevant details for direct marketing, so that we do not accidentally add the person again.
- Website and advertising data follows the periods in our Cookie Notice and the relevant provider settings. Meta states that Business Tools event data may be retained for up to two years. Meta audiences remain until we update or delete them.
- Quiz, project and free-text information is kept only for the period stated at collection or for as long as needed to provide and evaluate the requested service, then deleted or de-identified.
We review customer-list audiences at least every six months and delete an audience when it is no longer needed or no longer has an approved lawful basis.
Your rights
Depending on the circumstances, you may have the right to ask us for access to your personal information, correction, deletion, restriction, transfer, or to object to processing. Where processing is based on consent, you can withdraw consent at any time without affecting earlier lawful processing.
The right to object to direct marketing is absolute. We will stop using your information for that purpose when you object, although we may keep a minimal suppression record.
To exercise a right, email [email protected]. We may need to verify your identity. You can also complain to the Information Commissioner's Office at ico.org.uk, although we would like the chance to deal with the issue first.
Changes to this notice
We may update this notice when our services, suppliers or legal obligations change. We will show the latest date at the top. If we introduce a new use that people would not reasonably expect, we will bring it to the attention of affected people before starting that use rather than relying only on a silent website update.