Privacy policy

Last updated: 9 November 2026

This notice explains what personal information we collect, why we use it, who we share it with, how long we keep it, and what rights you have over it.

1. Who we are

London Veg Box Ltd is the data controller for the personal information described in this notice.

Company number: 17094117

Registered office: 71-75 Shelton Street, Covent Garden, London, WC2H 9JQ

Email: hello@londonvegbox.com

:

Until 16 March 2026 the London Veg Box business was run as a sole trader. On that date the business transferred to London Veg Box Ltd, and customer information transferred with it. London Veg Box Ltd has been the controller of that information since then.

We do not have a Data Protection Officer, as we are not required to appoint one. Questions about this notice, or about your information, should go to hello@londonvegbox.com.

This is a notice explaining what we do with your information. It is not a contract.

2. What we collect

Information you give us

  • Name, delivery address, billing address and email address
  • Delivery instructions, including any safe place or neighbour you nominate
  • Box preferences, including produce you like and dislike
  • Allergy and dietary information, where you choose to tell us (see section 4)
  • Messages you send us, including complaints and feedback
  • Survey and competition responses
  • The email address and order number you use to sign in to our app, and the one-time codes we email you
  • Your choices when you shape your box in our app, box ratings and saved recipes
  • Questions you ask Arti, our recipe assistant, and notes you give it
  • The name, email address and delivery address of a friend you send a gift box to
  • Your first name, email address and postcode if you join our waiting list
  • Requests you make through an AI assistant you connect to your account (see section 5)

Information we collect automatically

  • Your order and subscription history, including box sizes, skips, pauses and cancellations
  • How you interact with our emails, including whether you open them and what you click
  • Technical information about your device when you use our site, including IP address, browser type, operating system and time zone
  • Website usage, collected through cookies (see section 7)
  • A photo of where your box was left and, if it was left in a safe place, a short note of where. We do not track your location

Information we do not hold

We do not store your full payment card details. Card payments are handled directly by our payment providers, who give us only a confirmation and the last four digits.

3. Why we use it, and our legal basis

  • Taking and fulfilling your orders, delivering your boxes, managing your subscription
    Legal basis: Performance of our contract with you
  • Taking payment and handling refunds
    Legal basis: Performance of our contract with you
  • Answering your questions and dealing with complaints
    Legal basis: Performance of our contract, and our legitimate interest in running the service well
  • Keeping accounting and tax records
    Legal basis: Legal obligation
  • Sending marketing emails to existing customers about our own products
    Legal basis: Our legitimate interest in promoting our business, subject to your right to opt out at any time
  • Sending marketing emails to people who are not customers
    Legal basis: Your consent
  • Understanding how our site and emails are used, so we can improve them
    Legal basis: Your consent, given through cookie settings, or our legitimate interest where no cookie is involved
  • Preventing fraud and abuse of our offers
    Legal basis: Our legitimate interest in protecting the business
  • Surveys and competitions
    Legal basis: Your consent
  • Telling you when we start delivering to your area
    Legal basis: Your consent

Where we rely on legitimate interests, we have considered whether our interest is outweighed by your rights. You can object at any time (see section 9).

4. Allergy and dietary information

If you tell us about a food allergy or intolerance, that is information about your health. UK data protection law treats health information as a special category requiring extra protection.

We use it only to try to keep unsuitable items out of your box, and we rely on your explicit consent to do so. By telling us about an allergy you are consenting to us recording it and using it for that purpose.

Health or diet details you put in a note to Arti are used only to tailor recipe suggestions. We use them with your explicit consent, which you give by ticking the box when you add the note. Arti's AI service provider receives these notes (see section 5).

We do not share allergy information with anyone outside our own team, we do not use it for marketing, and you can ask us to delete it at any time by emailing hello@londonvegbox.com. If you do, we will no longer be able to take it into account when preparing your box.

We do not ask for, and do not want, any other special category information, such as your ethnicity, religion, political opinions or sexual orientation.

5. Who we share it with

We do not sell or rent your personal information to anyone.

We use the following service providers, who process information on our instructions:

  • Shopify
    What they do: Hosts our online store and processes orders
  • Recharge
    What they do: Manages subscriptions and recurring payments
  • Klaviyo
    What they do: Sends our marketing and service emails
  • Typeform
    What they do: Runs our surveys and box preference forms
  • Shopify Payments, and wallets such as Shop Pay, Apple Pay and Google Pay
    What they do: Process payments
  • Google
    What they do: Provides mapping for delivery routing, and website analytics where you have consented. Google Ads shows our adverts and measures how well they work, using cookies only where you have consented. We may also share customers' email addresses and phone numbers with Google Ads in scrambled (hashed) form. This lets it avoid showing our sign-up offers to current customers and show our adverts to past customers. When a customer pays for their second box, we also send Google Ads a hashed email address and phone number, the order number and the order value, so we can see which adverts led to a sale. You can ask us to leave you out at any time by emailing hello@londonvegbox.com.
  • A cloud database and hosting provider
    What they do: Stores the data behind our app and delivery system, in Ireland
  • A website hosting provider
    What they do: Hosts our app, keeping standard request logs that include IP addresses
  • An email delivery service
    What they do: Sends your sign-in codes, your order, delivery and box emails, and waiting list emails, from Ireland
  • A reviews service
    What they do: Sends a request to review your box
  • An AI service provider
    What they do: Powers Arti and the chat on our website. For Arti, we send your questions, your box contents, your past box choices, your preferences and your notes to Arti, but not your name, email address, delivery address or order number. The website chat sends whatever you type. Please do not type personal details you do not want shared, or any card or bank details
  • AI assistants you choose to connect (such as Claude, ChatGPT or Gemini)
    What they do: If you connect your London Veg Box account to an AI assistant, it receives the box, delivery and recipe details you ask about. It can make the changes you ask for: skip or restore a delivery, pause for up to about two months, change your box size, or add or remove extras. You sign in with your email, order number and a code we email you. You can disconnect at any time. Cancelling and address changes stay in our app
  • Map and postcode services
    What they do: Receive your delivery address or postcode, never your name, so our drivers can find you
  • Instagram (Meta)
    What they do: Instagram posts shown in our app load from Instagram, which receives your IP address and browser details when you view them

Our app shows a list of recipes that are popular this week, based on what customers saved, cooked or asked for. It never shows who.

We may also share information where we are required to by law, or with professional advisers such as our accountant.

If our business is sold or transferred, customer information may transfer with it. We would tell you if that happened.

6. Information sent outside the UK

Some of our providers are based outside the UK, mainly in the United States and Canada. Our app's database and our delivery emails are stored in Ireland.

Where information is transferred outside the UK, we rely on either an adequacy decision made by the UK government, or on the International Data Transfer Agreement or the UK Addendum to the EU Standard Contractual Clauses. These are approved legal mechanisms designed to give your information a similar level of protection to that it has in the UK.

You can ask us for more detail about a specific transfer by emailing hello@londonvegbox.com.

7. Cookies

Cookies are small files stored on your device when you visit our site.

Essential cookies keep the site working. They remember what is in your basket, keep you logged in, and support checkout security. These do not need your consent, because the site cannot function without them.

Analytics and marketing cookies help us understand how the site is used and measure our advertising. We only set these if you agree. You can change or withdraw your choice at any time through the cookie settings on our site, or by clearing cookies in your browser.

Some cookies on our site are set by third parties, including Shopify and Google. We are responsible for asking your permission before non-essential ones are set.

8. How long we keep it

  • Order and payment records
    How long: 6 years after the end of the tax year they relate to, as required for tax and accounting
  • Account and subscription details, including preferences and delivery notes
    How long: While your subscription is active, and for 12 months after it ends
  • Allergy and dietary information
    How long: While your subscription is active, then deleted, or sooner if you ask
  • Marketing contacts and email engagement
    How long: Until you unsubscribe, and for a short period afterwards to make sure we do not email you again
  • Emails and complaints correspondence
    How long: 2 years after the matter is closed
  • Website analytics
    How long: Up to 26 months
  • Box choices, ratings, saved recipes and notes to Arti
    How long: While your subscription is active and for 12 months after it ends, or sooner if you delete them
  • Questions to Arti and its answers
    How long: 90 days
  • Delivery photos
    How long: 30 days after delivery, or a year for your first box
  • Safe-place notes and delivery records
    How long: 12 months
  • A gift recipient's name, email and address
    How long: 30 days after their box is packed
  • Waiting list details
    How long: Until we deliver to your area and have told you, or 2 years, whichever is sooner, or sooner if you ask
  • AI assistant connections
    How long: Removed after 90 days unused, or when you disconnect

When information is no longer needed, we delete it or anonymise it so it can no longer identify you.

9. Your rights

You have the right to:

  • Be told how we use your information, which is what this notice does
  • Access a copy of the information we hold about you
  • Correct anything that is wrong or incomplete
  • Delete your information, where we have no continuing reason to keep it
  • Restrict how we use it while a concern is being resolved
  • Object to us using it for our legitimate interests, and to direct marketing at any time
  • Portability, meaning receiving information you gave us in a machine-readable format, or having it sent to another provider
  • Withdraw consent at any time, where we rely on consent, without affecting anything done before you withdrew it

To exercise any of these, email hello@londonvegbox.com. We will respond within one month. There is no charge.

To stop marketing emails, use the unsubscribe link in any email, or email us. We will still send service messages about your subscription, such as your delivery notification and box customisation link, because those are part of the service you have bought.

10. Complaints

If you are unhappy with how we have handled your information, please tell us first at hello@londonvegbox.com so we can try to put it right.

You also have the right to complain to the Information Commissioner's Office, the UK regulator for data protection:

Information Commissioner's Office Wycliffe House, Water Lane, Wilmslow, Cheshire, SK9 5AF Helpline: 0303 123 1113 ico.org.uk

11. Security

We protect your information with measures appropriate to the risk. Our site and checkout use encrypted connections, access to customer information is limited to people who need it to do their job, and our providers are chosen on the basis that they maintain appropriate security.

No system can be completely secure. If a breach occurs that is likely to put your rights at risk, we will tell you and report it to the ICO as the law requires.

12. Children

Our service is for adults. You must be at least 18 to order from us or subscribe to our emails. We do not knowingly collect information about children.

13. Automated decisions

We do not make decisions about you by automated means alone that produce legal effects or otherwise significantly affect you.

14. Changes to this notice

We may update this notice. The date at the top shows when it last changed. If a change materially affects how we use your information, we will email you.

London Veg Box Ltd Registered in England and Wales, company number 17094117 Registered office: 71-75 Shelton Street, Covent Garden, London, WC2H 9JQ Email: hello@londonvegbox.com