Privacy Policy

Last updated: 29 October 2026

This policy explains how Highland Prep ("we", "us", "our") collects and uses your personal data when you visit highlandprep.co.uk, join our waiting list or order from us, and the rights you have under UK data protection law (the UK GDPR and the Data Protection Act 2018).

1. Who we are

Highland Prep is a meal prep business run by Marton Fekete, trading as Highland Prep, based in 155 Balloan Road, Inverness IV2 4PW, Scotland. We are the data controller for the personal data described in this policy. If you have any questions about it, or want to use any of your rights, email us at hello@highlandprep.co.uk.

2. What we collect

When you join the waiting list

• Contact details: your first name, email address and postcode.
• Your marketing choice: whether you ticked the box to receive updates and offers.
• Your survey answers (optional): for example what you'd use us for, how many meals you'd want, your budget, your views on our proposed prices, delivery preferences, how you heard about us and any dietary requirements you choose to share.
• Signup details: the date and time you joined and which button on the site you used.

When you order

• Account: your email address, which you use to sign in (we email you a sign-in link).
• Delivery details: your name, mobile number, delivery address and postcode, any delivery notes, or the pickup point you chose.
• Your orders: your plan, the meals you choose each week, skipped or paused weeks, and what you paid.
• Payments: your card details are entered on Stripe's secure page and held by Stripe. We never see or store your full card number; we only keep Stripe's customer and payment references.

Dietary requirements

Some dietary information (for example "gluten-free" or "halal") could reveal something about your health or religious beliefs, which the law treats as "special category" data. Answering this question is entirely optional. If you choose to answer it, we rely on your explicit consent, and we only use it to plan our menu. You can ask us to delete it at any time.

If you turn on WhatsApp updates

When you order you can choose to get updates on WhatsApp. If you do, we use your mobile number to send a message on delivery day, ask how your meals were, and remind you before the Friday cutoff. We keep the messages we send and receive, and any rating or comment you give us, so we can reply and improve our meals. You can turn this off in your account at any time, or reply STOP.

When you visit the website

Like any website, our hosting provider automatically receives technical information such as your IP address, browser type and the pages you request, and keeps short-term server logs for security and to keep the site running. Your browser also fetches our fonts from Google Fonts and some photos from Pexels, which means those services receive your IP address.

3. How we use your data and our legal basis

We do not sell your data, and we do not use it for automated decision-making or profiling that has legal or similarly significant effects on you.

4. Cookies and analytics

With your permission, we use Google Analytics to understand how people find and use our website, for example which pages are visited, roughly where visitors are (city level), what device they use, which link brought them here, and whether they opened or joined the waiting list. This helps us improve the site and see which of our adverts and posts work.

• Google Analytics only runs if you click Accept on our cookie banner. If you click Reject, or ignore the banner, no analytics cookies are set.
• It sets cookies named _ga and _ga_*, which last up to 2 years, and we keep analytics data for 14 months. We never send your name, email or postcode to Google Analytics.
• You can change your mind at any time using the Cookie settings link at the bottom of every page.
• We also store your cookie choice in your browser so we don't ask again. This is strictly necessary and doesn't identify you.

We do not use advertising cookies, and we do not track you across other websites.

5. Who we share your data with

We only share your data with service providers who help us run the website, acting on our instructions:

• Vercel hosts the website.
• Supabase hosts the database where accounts, orders and waiting-list signups are stored, on servers in London, and sends sign-in emails.
• Stripe (Stripe Payments Europe Ltd and Stripe, Inc.) takes and stores card payments.
• Brevo (Sendinblue SAS) delivers our order and account emails.
• Google Fonts and Pexels provide fonts and images that your browser loads.
• Google Analytics (Google Ireland Ltd and Google LLC) measures website usage, only if you accept analytics cookies.
• WhatsApp (Meta Platforms Ireland Ltd) delivers our WhatsApp messages, only if you turn on WhatsApp updates.

We may also share data if the law requires it, or with a buyer of our business if Highland Prep is ever sold (they would have to use it in line with this policy).

6. International transfers

Your account, order and waiting-list details are stored in the UK. Some of our providers, such as our website host, Stripe, Brevo, Google Analytics and Google Fonts, are based in, or may process data in, countries outside the UK, including the United States and the EU. Where this happens we make sure appropriate safeguards are in place, such as the UK's adequacy regulations (including the UK–US data bridge) or the UK International Data Transfer Agreement or Addendum.

7. How long we keep it

We keep waiting-list data until you ask us to remove it, or for up to 24 months after you join if you don't become a customer, whichever is sooner. If you order from us, we keep your account and delivery details while you're a customer and for up to 2 years after your last order, and records of sales and payments for 6 years after the end of the tax year they relate to, as tax law requires. Anonymous totals (which don't identify you) may be kept longer.

8. Your rights

Under UK data protection law you have the right to:

• ask for a copy of the personal data we hold about you;
• ask us to correct data that is wrong or incomplete;
• ask us to delete your data;
• ask us to restrict or stop using your data, or object to how we use it;
• ask for your data in a portable format;
• withdraw your consent at any time, for example by using the unsubscribe link in any email or by emailing us. This won't affect anything we did before you withdrew it.

To use any of these rights, email hello@highlandprep.co.uk. We will reply within one month. There is normally no charge.

9. Complaints

If you're unhappy with how we've handled your data, please contact us first so we can put it right. You also have the right to complain to the Information Commissioner's Office (ICO), the UK data protection regulator, at ico.org.uk or on 0303 123 1113.

10. Children

Our website and waiting list are intended for adults. We don't knowingly collect data from children under 16.

11. Keeping your data safe

Your data is sent over an encrypted connection (HTTPS). Our database is set up so you can only see and change your own account and orders, and the public website can add a waiting-list signup but cannot read anyone's details. Only we can access everyone's data.

12. Changes to this policy

We may update this policy. The date at the top shows when it last changed. If we make significant changes, we'll let our customers and people on the waiting list know.