Privacy Policy

Last updated: 29 October 2026.

Introduction

This Privacy Policy explains how The Little London Vegan (“we”, “us” and “our”), operated by Macevery Limited collects, uses, stores, shares and protects your personal data when you use our website (thelittlelondonvegan.com) and install or access our web application (together the “Platform”), create an account, purchase a membership, subscribe to our newsletter, redeem offers or otherwise interact with our Platform.

Important information and who we are

The Little London Vegan is operated by Macevery Limited, a company registered in England and Wales company number 13086463 with our registered office at Loughborough Technology Centre, Unit 29, Epinal Way, Loughborough, Leicestershire, England, LE11 3GE.

For the purposes of the data protection law, Macevery Limited is the data controller responsible for your personal data when you use our Platform and our registration number is ZB357850.

If you have any questions regarding this privacy policy, please contact: support@thelittlelondonvegan.com

What personal data we collect

We collect and process different kinds of personal data about you. To make it easier for you to use this privacy notice, we group these into the following categories. Each of these categories is described in more detail:

Identity and Contact Data. Your display name, account identifier, email address, correspondence details, communications between you and us and any other information used to identify you or confirm that you are eligible to use the Platform.

Profile Data. Your username, password or other authentication credentials, account settings, preferences, subscription status, introductory access status and records of your acceptance of the terms. Passwords are processed through our authentication provider and are not accessible to us in readable form.

Transaction Data. Information relating to your subscription, purchases, payments, billing status, renewals, cancellations and refunds. This may include limited payment information received from our third-party payment provider, but we do not receive or store your complete payment card details.

Device Data. Technical information relating to the device used to access the Platform, which may include the IP address, browser type, device information, operating system, session identifiers, timestamps, error logs and security logs.

Content Data. Information that you enter, save or generate through the Platform, including your favourites, saved lists, plans, notes, venues marked as visited, preferences and shared content created through the Platform. Information provided by former step members to verify entitlement to legacy membership benefits.

Usage Data. Information about how you access and use the Platform, including pages viewed, searches performed, redeemed perks, click activity, feature usage, interaction with newsletters, subscription usage and error, crash or diagnostic information. Where you consent to analytics technologies, this may also include information collected through Google Analytics 4 regarding your interactions with the Platform.

Location Data. If you choose to enable location services through your browser or device, we may process location information in order to display venues and offers near you. We do not maintain a location history or permanently store this information against your account.

Security Data. Information used to protect the Platform, accounts and users and to investigate suspected misuse, fraud or unauthorised access, including login records, authentication information, security logs, Usage Data and relevant device information.

Cookies and Similar Technologies Data. Information collected through cookies, email tracking technologies, and other similar technologies used in connection with the Platform or any associated website.

Marketing and Communications Data. Your preferences for receiving marketing from us, records of your consent and the marketing communications sent to you, including records of newsletter subscriptions, unsubscribe requests and related marketing preferences.

We may also use aggregated or anonymised information for analytical, research and Platform development purposes. Information that does not directly or indirectly identify an individual is not personal data. If we combine aggregated information with personal data so that it can identify you, we treat the combined information as personal data.

How is your personal data collected?

We will collect personal information through different methods including:

Account registration and management. We collect your Identity Data, Contact Data and Profile Data when you create or manage an Account, accept the Terms, begin introductory access or update your details.

Subscription and Payment. We collect Transaction Data when you purchase, renew, manage or cancel a subscription or request a refund. We may receive this information from our third-party payment provider.

Information we collect from your use of the Platform. Each time you access and use the Platform, we collect Content Data, Usage Data and, where applicable Location Data.

Communication and Support. We collect Contact Data, Profile Data, Content Data and relevant Usage or Device Data when you contact us about the Platform, your account, a technical issue, a cancellation, a complaint or a privacy request.

Information we collect through monitoring the use of our Platform. When you use the Platform, we may automatically collect Device Data, Usage Data, Security Data and Cookies and Similar Technologies Data through the Platform and similar technologies.

Information we receive from third parties. We may receive personal data from third-party Platform providers where necessary to provide and administer the Platform. For example, Stripe may provide us with information relating to your subscription, payment status, billing events and refunds, and Supabase may provide account authentication and session management information.

Cookies and similar technologies

A cookie is a small file placed on your device when you access or use the Platform.

We use cookies and similar technologies to ensure the Platform functions properly, to enhance your user experience, and, where applicable, to understand how users interact with the Platform so that we can improve its performance and functionality.

Some cookies and similar technologies are strictly necessary for the operation of the Platform and do not require your consent. Other cookies are optional and will only be used where you have provided your consent.

Please see our cookie policy for further details.

How we use your personal data

We will only use your personal data when we have a lawful basis to do so. Our lawful basis for each purpose for which we use your personal data is specified below. Most commonly we will use your personal data in the following circumstances:

Consent. Where you have freely consented before the processing in a specific, informed and unambiguous indication of what you want. You can withdraw your consent at any time by contacting us.

Performance of a contract. Where we need personal data to provide you with access to the Platform or perform our contract with you and you do not provide that information, we may be unable to create or administer your Account or provide the relevant Platform functionality.

Legitimate interests. Where it is necessary for our legitimate interests (or those of a third party) and your interests and fundamental rights do not override those interests. We make sure we consider and balance any potential impact on you (both positive and negative) and your rights before we process your personal data for our legitimate interests. You can obtain further information about how we assess our legitimate interests against any potential impact on you in respect of specific activities by contacting us.

Legal obligation. Where we need to use your personal data to comply with a legal or regulatory obligation. Where we rely on legal obligation and you do not provide the necessary information, we may be unable to fulfil a right you have or comply with our obligations to you, or we may need to take additional steps, such as informing law enforcement or a public authority or applying for a court order.

Purposes for which we use your personal data

We have set out below a description of the ways in which we use your information, and the legal basis on which we rely to do so.

The following table uses certain definitions included in the ‘Types of personal data we collect about you’ and ‘How we use your personal data’ sections within this Privacy Policy.

Disclosures of your personal data

We may share your personal data with the following categories of recipient where necessary for the purposes set out in this Privacy Policy:

Payment processing providers to facilitate Subscription payments, renewals and refunds including Stripe;

Service providers that support the operation, security, delivery of our Platform, including providers of hosting, cloud storage, database management, information technology, system administration authentication, cybersecurity, communications, customer support, email delivery, analytics and marketing services;

Google Maps and Google Fonts (should you chose to use these optional services);

Professional advisers, including lawyers, accountants, auditors and insurers;

HM Revenue and Customs, regulators, law enforcement, public authorities and other parties where disclosure is required by law or necessary to protect legal rights; and

Third parties to whom we may choose to sell, transfer or merge parts of our business or our assets. Alternatively, we may seek to acquire other businesses or merge with them. If a change happens to our business, then the new owners may use your personal data in the same way as set out in this privacy notice.

Where a service provider processes personal data on our behalf, we only permit them to do so for specified purposes and in accordance with our instructions. We require all third-party Platform providers to implement appropriate technical and organisational measures to protect your personal data and to comply with applicable data protection laws.

Location, Maps and Third-Party Platforms

If you choose to enable location services through your browser or device, we may use your location information to identify and display venues, offers and other content that are relevant to your current location. Location information is used only for this purpose and is not routinely stored against your account. You can continue to use the core features of the Platform without enabling location Platforms.

Where you choose to enable Google Maps functionality through your cookie or external Platform preferences, Google acts as an independent controller in respect of personal data it collects through Google Maps and processes such information in accordance with its own privacy policy and terms of service. We do not control Google's processing activities once Google Maps has been enabled.

Our Platform may also contain links to third party websites, social media platforms, booking providers, affiliate partners and other external sites. If you choose to access these external sites, your personal data will be processed in accordance with the privacy policies and practices of those third parties. We are not responsible for the privacy practices or content of external websites and encourage you to review their privacy notices before providing any personal information.

Shared Plans and Shared Content

If you choose to share a plan or other content through the Platform, information contained within that plan, including titles, descriptions, venues and related content, may be visible to anyone who has access to the relevant sharing link.

You should take care not to include personal, confidential or sensitive information within any shared content.

We are not responsible for any onward sharing by individuals who have access to a shared link.

International data transfers

Some of our service providers are located outside of the United Kingdom or may access personal data from outside the United Kingdom in connection with providing support, security, administration, maintenance or other services to us.

Although a number of our systems are configured to store data within the United Kingdom or European Economic Area, certain providers may nevertheless carry out support, operational, security monitoring or other processing activities from other countries, including the United States.

Whenever personal data is transferred outside of the UK, we ensure that an appropriate safeguard is in place in accordance with UK data protection law. These safeguards may include:

transferring personal data to countries that have been recognised by the UK government as providing an adequate level of protection for personal data;

use of the UK International Data Transfer Agreement; or

use of the UK International Data Transfer Addendum to the European Commission’s Standard Contractual Clauses

Further details of the safeguards in place to protect your personal information when transferred outside the UK are available upon request.

Data security

Personal data is primarily hosted and processed using secure cloud-based servers.

We have implemented appropriate technical and organisational security measures, including appropriate access controls, encryption and authentication measures, to prevent your personal data from being accidentally lost, used or accessed in an unauthorised way, altered or disclosed.

In addition, we limit access to your personal data to personnel and service providers who have legitimate business need to know. They will only process your personal data on our instructions, and they are subject to a duty of confidentiality.

Any payment transactions carried out by us or our chosen third-party provider of payment processing services will be encrypted using Transport Layer Security (TLS) technology.

Where we have given you (or where you have chosen) a password that enables you to access certain parts of our Platform, you are responsible for keeping this password confidential. We ask you not to share your password with anyone.

We have also put in place procedures to deal with any suspected personal data breach and will notify you and any applicable regulator of a breach where we are legally required to do so.

Data retention

We will only retain your personal data for as long as reasonably necessary to fulfil the purposes we collected it for, including for the purpose of satisfy any legal, regulatory, tax, accounting or reporting requirements. We may retain your personal data for a longer period in the event of a complaint or if we reasonably believe there is a prospect of litigation in respect of our relationship to you.

To determine the appropriate retention for personal data, we consider the amount, nature and sensitivity of the personal data, the potential risk of harm from unauthorised use or disclosure of your personal data, the purposes for which it is processed and whether we can achieve those purposes through other means and the applicable legal, regulatory, tax, accounting or other requirements. When personal data is no longer required, we will securely delete or anonymise it.

By law we have to keep basic information about our customers (including Contact, Identity, Financial and Transaction Data) for six years from the end of the relevant customer relationship. Further details of our retention periods are set out in our Data Retention Schedule, available on request.

In some circumstances you can ask us to delete your data. Please see ‘Your legal rights’ section below.

Children

We do not knowingly collect children’s data. All account holders are required to be 18 years of age.

We seek to safeguard the privacy of all users through privacy protective settings and by limiting the personal data collected to which is reasonably necessary for the operation of the Platform.

If we become aware that personal data has been collected from a child in circumstances it should not have been collected, we will take reasonable steps to delete that information or otherwise comply with our legal obligations.

If you believe that a child has provided us with personal data in circumstances where they should not have done so, please contact us using the details set out in this Privacy Policy.

Our marketing communications

We may send you updates and information about the Platform, updates to our features, and, where you have chosen to receive them, newsletters or other electronic marketing communications about products, Platform, offers, content and promotions that we believe may be of interest to you.

We will only send electronic marketing communications where you have given us your consent.

Our newsletter is entirely optional and separate from any membership, trial or premium subscription. Creating an account, starting a trial or purchasing a subscription will not automatically subscribe you to marketing communications. Some newsletters may contain clearly identified partner content, affiliate links or promotional offers from third parties.

You can ask us to stop sending you marketing communications at any time by following the opt-out information within any marketing communication sent to you, or by contacting us using the contact details below. Where you unsubscribe from marketing communications, we may retain a limited record of your email address and unsubscribe request in order to ensure that your marketing preferences are respected and to comply with our legal obligations.

If you opt-out of receiving marketing communications, you will still receive service related communications that are essential for administrative or customer service purposes.

Your legal rights

You have the following rights under data protection laws in relation to your personal data.

Access. Request access to and/or a copy of the personal data we process about you (commonly known as a data subject access request). This enables you to check that we are lawfully processing it.

Correction. Request correction of any incomplete or inaccurate data we hold about you. (We may need to verify the accuracy of the new data you provide to us.)

Deletion. Request us to delete or remove personal data where there is no good reason for us continuing to process it. You also can ask us to delete or remove your personal data where you have successfully exercised your right to object to processing (see below), where we have processed your information unlawfully or where we need to erase your personal data to comply with law. (In some cases, we may need to continue to retain some of your personal data where required by law. If these apply, we will notify you at the time of our response.)

Objection. Object to us processing your personal data where (a) we are relying on legitimate interests as the lawful basis and you feel the processing impacts on your fundamental rights and freedoms, or (b) the processing is for direct marketing purposes. In some cases, we may refuse your objection if we can demonstrate that we have compelling legitimate grounds to continue processing your information which override your rights and freedoms.

Restriction. Request that we restrict or suspend our processing of your personal data:

if you want us to establish the data's accuracy;

where our use of the data is unlawful, but you do not want us to erase it;

where we no longer require it, but you need us to hold onto it to establish, exercise or defend legal claims; or

you have objected to our use of your data, but we need to verify whether we have overriding legitimate grounds to use it.

Data portability. Request we transfer certain of your personal data to you or your chosen third party in a structured, commonly used, machine-readable format. This right only applies to information processed by automated means that we process on the lawful bases of consent or performance of a contract.

Withdraw consent. Withdraw your consent at any time where we are relying on consent to process your personal data. Please know that this does not affect the lawfulness of any processing carried out before you withdraw your consent, and after withdrawal, we may not be able to provide certain products or Platforms to you. We will advise you if this is the case at the time you withdraw your consent.

Complain to us. If you are unhappy with how we use your personal data, please contact us using the contact details set out below so that we have an opportunity to investigate and address your concerns. We will acknowledge your complaint within 30 days and inform you of the outcome without undue delay.

Complain to the UK data protection regulator. If you are unhappy with how we process your personal data, we ask that you contact us first, as described above so that we have the chance to put it right. However, you also have the right to make a complaint to the ICO at any time.

Signed-in members can download app-held data at Account › Your privacy › Export my data.

You will not usually have to pay a fee to exercise your rights. We may, however, charge a reasonable fee or refuse to comply where a request is manifestly unfounded or excessive.

We may ask for information to confirm your identity and ensure that personal data is not disclosed to a person who is not entitled to receive it. We may also ask for further information to help us respond to your request.

We aim to respond to legitimate requests within one month. It may take longer where a request is particularly complex or where you have made a number of requests, in which case we will notify you.

We do not carry out solely automated decision making which produces legal or similarly significant effects on you.

Contact details

If you have questions, concerns or requests regarding this Privacy Policy, or wish to exercise any of your legal rights, please contact us via email at support@thelittlelondonvegan.com

Changes to this Privacy Policy

This Privacy Policy was last updated on 29 October 2026.

We may update this Privacy Policy from time to time to reflect changes in our practices, technology, legal requirements or other factors we consider necessary. Any changes will be notified to you either via email or when you next start the Platform or log onto your account. You may be required to read and acknowledge the changes to continue your use of the Platform.

It is important that the personal data we hold about you is accurate and current. Please keep us informed if your personal data changes during our relationship with you.