Privacy notice

01 Who we are

K Kitchen Catering Ltd is the data controller for the personal information described in this notice. That means we decide what is held and why, and we are the people answerable for it.

Company

K Kitchen Catering Ltd

Company number

14848857, registered in England and Wales

Registered office

71–75 Shelton Street, Covent Garden, London WC2H 9JQ. This is a registered office address only. It is not a trading or collection address, and post about data protection is better sent by email.

Email

K.kitchencateringltd@gmail.com

Phone

07857 526830

This website

kkitchen.a2kai.co.uk

We are too small to be required to appoint a Data Protection Officer, and we have not appointed one. Krishna Sonecha, the director, deals with anything raised under this notice.

Back to contents

02 What this website collects

Nothing about you, beyond the ordinary record that every web server keeps of the files it sends.

This site is a set of plain files. There is no form to fill in, no account, no login, no newsletter sign-up and no basket, so there is nowhere on it for you to type your details. To be specific, the site does not:

• set cookies of any kind, including session cookies (see the cookies page)
• use localStorage, sessionStorage or any other store on your device
• run analytics, tracking pixels, session recording or advertising code
• load fonts, scripts, stylesheets or images from anyone else’s server: every file comes from ours, including the fonts
• embed a map, a video player, a social media feed or a comment system

The one record that does exist is the web server’s access log. Like every web server, the machine that serves this site writes a line each time it sends a file, containing:

• the IP address the request came from
• the date and time
• the page or file requested
• the address of the page that linked you here, if there was one
• the browser and operating system your device reports, known as the user agent

Those logs are written by our hosting provider as a normal part of running a server. They are used to keep the site up and to spot abuse, such as attacks and attempts to break in. They are not used to build a profile of you, they are not joined to anything else we hold, and no advertising is built on them. Our lawful basis is legitimate interests, Article 6(1)(f) UK GDPR: running a website securely and reliably is a normal expectation, and this is the least information that makes it possible.

When you tap something that leaves this site, such as the call, WhatsApp, email, Instagram, Facebook or Food Standards Agency links, you are then on someone else’s service and their terms apply from that point on.

Back to contents

03 What we hold when you get in touch

This is where real personal information starts, and it starts because you chose to send it to us.

When you ring, send a WhatsApp message, email, or message us on Instagram or Facebook about an event, we normally end up holding:

• your name, and the name of the person the event is for if that is someone else
• your phone number, email address or social media handle, depending on how you contacted us
• the date and the type of your event
• the venue, or the area it is being held in
• the number of guests
• what you would like on the menu, and any dietary or allergy requirements (see section 04)
• the messages between us: WhatsApp threads, emails, social media messages and our own notes of phone calls

If you go on to book, we also hold what is needed to do the job and account for it: the agreed menu and arrangements, delivery, setup and timing details, the venue address, and the invoice and payment record for your event.

We ask for what we need in order to quote and cook, and nothing more. If you tell us about your guests, including children, for menu or allergy reasons, that information is used only to plan and prepare the food. We do not use anything you tell us to make automated decisions about you, and we do not profile you.

Back to contents

04 Allergy and dietary information

We ask for it, and we need it, because there is no safe way to cook for someone without it. We use it only to plan the menu, to buy and prepare ingredients, to brief anyone helping to serve your food, and to tell you honestly what we can and cannot do.

Our lawful basis for holding it is your explicit consent under Article 9(2)(a), given when you volunteer the information in an enquiry or when confirming a booking, alongside Article 6(1)(b) for performing the catering agreement itself.

Consent can be withdrawn. If you tell us to stop using allergy or dietary information, we will. Please understand what that means: if it is withdrawn before or during a booking, we may not be able to cater safely for the person concerned, and we would have to say so rather than guess.

This information is never used for marketing, never shared with anyone who does not need it in order to prepare or serve your food, and never kept for longer than the booking record it belongs to.

K Kitchen is a pure vegetarian kitchen: no meat, fish or egg is prepared in it. That removes some risks, but it does not remove others, so please always raise allergies with us before you book rather than on the day.

Back to contents

05 Why we are allowed to hold it

UK GDPR requires a lawful basis for everything done with personal information. Ours are these.

Article 6(1)(b), contract

Quoting for your event, agreeing a menu, and delivering the catering you have booked. Without this information there is no way to do the job you asked us to do.

Article 6(1)(c), legal obligation

Keeping accounting and tax records, and keeping the food safety records that food hygiene law requires of a registered food business.

Article 6(1)(f), legitimate interests

Replying to enquiries that do not turn into bookings, keeping our own record of what was discussed, protecting the business if there is a dispute, and the web server access logs described in section 02. Our interest is running a small catering business properly and securely. We have weighed that against your interests and do not believe any of it is something you would find unexpected or intrusive, but you can object, and section 10 says how.

Article 9(2)(a), explicit consent

Allergy, dietary and any other health-related information, as described in section 04. This is the only special category data we hold.

Back to contents

06 Who else sees it

Only the people and companies that have to. Krishna Sonecha runs the business and is the person you deal with. Where somebody helps at an event, they are told what they need in order to serve your food safely, which can include allergy information.

Beyond that, your information reaches other companies mainly because of how you chose to contact us.

Meta Platforms: WhatsApp, Instagram and Facebook

If you message us on WhatsApp, Instagram or Facebook, that conversation sits on Meta’s systems as well as on our phone. Meta processes it under its own terms, as its own controller, and we have no control over what it does with it. WhatsApp messages are encrypted in transit, but Meta still holds account and metadata information about the exchange. If you would rather Meta was not involved at all, ring us or send an email instead.

Google: Gmail and the Google Business Profile

Our email address is a Gmail address, so anything you email us is stored on Google’s systems. If you leave a review or send a message through our Google listing, Google processes that as well, under its own terms.

Our mobile network

Calls and text messages pass through a mobile network in the ordinary way.

Our website hosting provider

The company that runs the server this website is served from. It handles the access logs described in section 02, and holds nothing else about you from us.

Accounts, tax and food safety

Anyone we use to prepare our accounts sees the financial records relating to your booking. HM Revenue and Customs receives what tax law requires. An environmental health officer may ask to see food safety records as part of an inspection or an investigation.

Anyone we are legally required to tell

For example where we receive a court order or a lawful request we cannot refuse.

We do not sell personal information, we do not share it for anyone else’s marketing, and we do not pass your details to other caterers or suppliers unless it is necessary to deliver your booking and you know about it.

Back to contents

07 Information sent outside the UK

We do not send your information overseas ourselves. It can still leave the UK through the companies named above: Meta and Google are United States companies and store and process data on servers in a number of countries.

Where that happens, those companies are responsible for having a transfer safeguard that UK law recognises, such as the UK extension to the EU–US Data Privacy Framework, or standard contractual clauses with the UK Addendum. We do not choose which one they use and we cannot change it. If this matters to you, contact us by phone or email rather than through social media.

Back to contents

08 How long we keep it

We keep information for as long as we actually need it, or for as long as the law tells us to, and then no longer.

Enquiries that do not become bookings

Kept while we are still talking to you and for a short time afterwards in case you come back to us, then deleted. Ask us to delete an enquiry sooner and we will.

Bookings, invoices and accounting records

Kept for six years from the end of the accounting period they fall in. This is not a figure we chose: HM Revenue and Customs requires company records to be kept for six years from the end of the accounting period they relate to, so we cannot delete them before then even if you ask.

Food safety records

Kept for as long as food hygiene law requires us to be able to show what was prepared and where the ingredients came from.

Allergy and dietary information

Kept as part of the booking record it belongs to, and no longer than that record.

WhatsApp, Instagram and Facebook threads

Kept on our phone for as long as the conversation is useful. You can delete your side of a conversation in the app whenever you like, and Meta’s own retention applies whatever we do.

Web server access logs

Kept for a limited period by our hosting provider as part of running the server, then rotated away. They contain nothing that identifies you by name.

Back to contents

09 How we look after it

This is a small business and we would rather be straightforward about what that means than imply something grander. Enquiries and bookings live on a phone and in an email account, both protected by a passcode or password. Devices are kept locked. We keep only what we need, and we do not copy customer details anywhere they do not need to be.

We do not run a customer database, and this website itself holds nothing at all, so there is nothing stored here to be breached. If a personal data breach did happen, we would report it to the Information Commissioner’s Office within 72 hours where the law requires it, and we would tell you directly if the risk to you was high.

Back to contents

10 Your rights

Under UK GDPR you have the right to:

• Be informed. To be told what we hold and why, which is what this notice is for.
• Access. To ask for a copy of the personal information we hold about you.
• Rectification. To have anything wrong or incomplete put right.
• Erasure. To ask us to delete information, where we are not required to keep it.
• Restriction. To ask us to pause what we do with it while a question about it is sorted out.
• Portability. To ask for the information you gave us in a portable electronic format, where that right applies.
• Objection. To object to anything we do on the basis of legitimate interests.
• Withdrawal of consent. To withdraw consent for anything held on consent, including allergy and dietary information.

To use any of these, email or ring us and say what you want. It is free, and you do not need to use any particular form of words.

We will reply within one month, and we will tell you if we need longer because a request is complicated. We may ask you a question or two to be sure we are speaking to the right person, so that we do not hand your details to somebody else. If we cannot do what you have asked, for example where tax law requires us to keep an invoice, we will tell you why.

Back to contents

11 Complaints and the ICO

If you are unhappy with how we have handled your information, please tell us first. We would much rather put something right than have you take it elsewhere unanswered.

You also have the right to complain to the Information Commissioner’s Office, the UK regulator for data protection, at any time and without asking us first.

Information Commissioner’s Office

Wycliffe House, Water Lane, Wilmslow, Cheshire SK9 5AF

Helpline

0303 123 1113

Website

ico.org.uk

Back to contents

12 Changes to this notice

This notice describes the website and the business as they are today, 10 August 2026. If we ever add an enquiry form, an online booking system, analytics, cookies, an embedded map or anything else that changes what is collected, we will update this notice before or at the same time as making the change, and we will ask for your consent first where the law requires it.

Related pages: cookies, terms and accessibility.