Cook application privacy notice

1. Controller

OMILY LABS LTD, trading as SupperMarket, is the controller for this recruitment service. Company number 17376796; registered in England and Wales; registered office 71–75 Shelton Street, Covent Garden, London, United Kingdom, WC2H 9JQ.

2. What the application collects

• Account details: name, email, optional phone number and a securely hashed password.
• Application information: intended area, trading setup, eligibility acknowledgements, identity details, council-registration information, training, insurance, kitchen-readiness information and photographs, menu/allergen drafts and planned fulfilment capacity.
• Private evidence you upload to support these requirements, such as identity documents, registration records, certificates and insurance evidence; file-safety, ownership, review and deletion records.
• Consent record: the server-owned terms version and digest accepted, with time of acceptance.
• Support messages you choose to send.
• Limited technical and security information needed to operate and protect the service, such as request and login records.

Only provide the information requested in the private application. Do not put identity or other private evidence in public photo fields or support messages. Bank and payout details, real orders and payment data are not collected for application submission. The platform preview uses sample data and does not save its edits to your account.

3. Why we use it

• To create and secure your requested account and save your private recruitment draft.
• To review your application and supporting evidence, request corrections where needed, and understand where prospective cooks plan to operate.
• To answer support requests and maintain an audit trail of your choices.
• To prevent abuse, diagnose faults and protect applicants and the service.
• To comply with legal obligations and establish, exercise or defend legal claims where necessary.

The proposed lawful bases are steps at your request before a possible agreement, our legitimate interests in reviewing and protecting applications, and legal obligation where one applies. We do not use this release for automated eligibility decisions or unrelated advertising.

4. Who receives it

Access is limited to authorised SupperMarket personnel and service providers needed for hosting, database, private file storage, malware scanning, security and necessary service communication. Private evidence is not a public menu image. Access is restricted to its applicant and authorised review or operational access. We do not share recruitment data with buyers, couriers or payment providers, and we do not sell it. We may disclose data where law requires it. The prepared service uses Railway for application hosting and databases and a separate Cloudflare R2 bucket restricted to the European Union for private evidence. EU file storage does not mean all processing is UK-only or EU-only. The scanner hosting, other processing locations and international-transfer safeguards must be confirmed in the approved notice before collection opens.

5. Retention and deletion

Active account and draft information is kept while you participate. Private evidence has an expiry recorded at upload, not calculated from the later review decision; expired evidence cannot be viewed or used to support an application. Expiry is distinct from physical deletion, which is handled by an authorised cleanup process. Replacement and account-deletion requests are handled separately. The production evidence period, cleanup responsibility, application and audit-record retention, and backup deletion/restore arrangements must be finalised before collection opens. This candidate notice does not promise an automatic deletion schedule that has not been put into operation.

6. Your rights

Depending on the circumstances, UK data-protection law gives you rights to access, correct, erase, restrict, object and receive a portable copy of personal data. You can export or delete through your account where available, or contact us. You may complain to the UK Information Commissioner’s Office atico.org.uk.

7. Security and contact

We use access controls, encryption in transit, private application records and operational audit controls. Private uploads are quarantined and checked before they can support an application. No system is risk-free; upload only the evidence specifically requested in the application. Privacy requests can be sent to privacy@omily.ai or by post to our registered office. See also our cookie notice.