GDPR Policy

Last updated 9 November 2026.

This page is a short account of how we meet the UK GDPR and the Data Protection Act 2018. The detail of what the website collects is in the Privacy Policy. If the two ever differ, the Privacy Policy is the one that applies to people using this website. Cookies are covered by PECR and the Cookie Policy.

Controller

Dracula's Burgers, 321 Beverley Road, Hull, HU5 1LD, is the data controller. Call 07479 688736.

We are not a public authority, and we do not process personal data on a large scale as our core activity. We are not required to appoint a Data Protection Officer.

The seven principles

Article 5 of the UK GDPR requires personal data to be:

• Lawful, fair and transparent. This page and the Privacy Policy say what we do, and we only process on a lawful basis.
• Limited to a purpose. Security of the website, answering you, and fulfilling an order. We do not reuse details for marketing.
• Minimised. The website does not ask for an account, an email address or a payment card.
• Accurate. You can ask us to correct anything we hold.
• Kept only as long as needed. Then it is deleted.
• Secure. The site is served over HTTPS, it has no public form, and it stores no customer accounts.
• Accountable. We keep the processing this simple so we can show what we do.

Lawful bases

We only process personal data where a UK GDPR Article 6 basis applies:

• Legitimate interests. Keeping the website secure, and reading server logs for faults and abuse.
• Contract, or steps before a contract. An order or a question you send by phone or email, or on Instagram or Facebook.
• Legal obligation. Where UK law requires us to keep or disclose information.

We do not send marketing from this website. We do not use automated decision-making that has a legal or similarly significant effect on you. We do not ask you for special-category data. If you tell us about an allergy so we can prepare food safely, we use that only for that order.

Other organisations

The company that hosts the website processes server logs for us. We do not sell personal data.

If you message us on Instagram or Facebook, those companies are responsible for their own platforms. Google and TripAdvisor are the same when you choose to use them. Their notices apply to their services.

Your rights

You can ask for access, correction, erasure, restriction, and, where it applies, portability. You can object to processing based on legitimate interests. Call 07479 688736. We will reply within one month, or tell you if we need up to two further months for a complex request. We may ask you to confirm who you are. We will not charge a fee unless a request is clearly unfounded or excessive.

These rights are not absolute. We may refuse erasure if we still need the information for a legal claim or a legal duty. We will tell you if that is the case. You can also complain to the Information Commissioner’s Office.

Personal data breaches

If a breach is likely to risk people’s rights and freedoms, we will tell the ICO without undue delay and, where we can, within 72 hours of becoming aware of it. If the risk is high, we will also tell the people affected. We keep a note of breaches even where a report is not required.

Accountability

The processing is small: no marketing database, no advertising cookies, and no customer accounts on the website. We would carry out a data protection impact assessment if we ever planned high-risk processing. We do not do that now. Use of the site is also covered by the Terms of Service.

Changes

We will update this page if the law or our processing changes. The date at the top will change, and the Privacy Policy will be updated to match.