How your information is used

What happens to what you enter

• What we keep: the names and needs you type, and the time you sent them. Food and drink needs count as health information, and access needs count as health and disability information, so we ask your permission first. If your host set a menu, we also keep which dishes each person chose — that's a meal choice, not health information. If you tell your host you can't make it, we keep your name and the fact that you can't come, and never a reason — there is nowhere to write one.
• Why: so the host of your event can cater for you, and so you can get in and take part. Nothing else — never sold, never used for advertising. We only ask what you need, never why: there is no field anywhere for a condition, a diagnosis or a reason, and we never ask for proof of anything.
• Only what your host asked for: every event asks about food. Drinks and access are asked about only if that host turned them on — if they didn't, nothing about them is collected from you or stored.
• Who sees it: the host of this event, through their own private link. Not other guests.
• Where and how long: stored in the EU, and deleted automatically 14 days after the event (backups clear within about a month after that). The host can delete it sooner; you can delete yours any time.
• Changed your mind: your own link has a Delete my answer button — one tap, the same effort it took to agree.
• Once the host has it: if they copy your answer into a message or a caterer's form, that copy is theirs and beyond our reach — ask them directly.
• Telling us how it went: the box asking what worked and what didn't is optional. What you write is kept on its own so we can improve the tool — never attached to your answer, your event, or anyone's needs — and we read it and delete it as we go. Please leave names and health details out of it; there's no need for either.
• If you ask to be told when we launch: we keep your email address for that one message and nothing else, on a separate list, never linked to your needs or to any event or answer — they are stored apart, and nothing joins them up. We delete it once we've told you, and within 12 months whatever happens. It is asked for on its own, never as part of agreeing to share your needs, and you can tell us to remove it at any time. That list aside, we store no contact details at all — no email addresses, phone numbers or postal addresses anywhere else in this product.

The legal bit

The formal wording, for the record.

• Who's responsible (the "controller"): Legends Awaken Limited. Registered with the UK Information Commissioner's Office, reference ZC202242. Contact privacy@offurplate.com.
• Lawful basis: allergy information is special-category health data, and access needs are special-category data about health and disability, so we rely on your explicit consent under UK GDPR Articles 6(1)(a) and 9(2)(a). Menu choices are ordinary personal data, not health data, and are covered by the same consent as the answer they are part of.
• The launch list: an email you give us to be told when we launch is ordinary personal data, not health data. We keep it on your consent under Article 6(1)(a), for that single notification, and erase it after it — 12 months at the outside. Ask us to remove it sooner at privacy@offurplate.com; you need not tell us anything else.
• Your rights: you may ask to see, correct or delete your data, or withdraw consent, at any time — through your own link, or by emailing privacy@offurplate.com (tell us the event and the name you used; we may ask for a little more so we don't act on the wrong person's data).
• Complaints: you can complain to the Information Commissioner's Office at ico.org.uk.