Privacy policy
What we collect when you use the Tikkas app and website, why, how long we keep it, who helps us, and your rights.
Who we are
The Tikkas app and app.tikkas.com are run by Tikkas Group Limited, a company registered in England and Wales (company number 16132072), registered office 1 Great Titchfield Street, London, England, W1W 8AU. We are the controller of the personal data described here. We registered with the Information Commissioner's Office on 24 October 2026; our ICO registration number will be shown here as soon as it is issued.
Your food is made and sold by Tikkas Oxford Circus Ltd, which runs the shop at 1 Great Titchfield St, London W1W 8AU. It receives the details of your orders so it can make them, take payment and keep its accounts.
Questions about your data: privacy@tikkas.com.
What we collect
- Your mobile number, to sign you in with a text code and to keep one account per number.
- Your name, and your email address if you add one.
- Your orders: what you ordered, when, the pickup time, any note or allergy information you give us, how you paid (for cards, only the brand and last four digits: Stripe holds the card itself), refunds, and orders you link at the till by scanning your code.
- Your Rewards Club points, store credit, rewards and codes used, and the history of each.
- Catering orders: company name, delivery address and access notes, the contact name and mobile for the day, the invoice email, a PO number, names and dietary needs on team orders, and messages with our team.
- How you use the app: screens opened, items added to the bag, orders started and finished, messages seen or tapped, with a random identifier for your device. We use this to run and improve the app and to send relevant offers if you have agreed to them.
- Push notification details: a token for each device where you allow notifications.
- Your marketing choices for email, text and push, and every change to them, with the time and where you made it.
- Technical details: your IP address and browser or phone type, used for security and to stop abuse.
- Where you use the app from, roughly: when you sign in, open the app or place an order, our network provider (Cloudflare) tells us the country, town and the first part of the postcode (such as "W1") that your connection appears to come from. We keep that, with the date, so we can see which areas our customers come from. We do not use your phone's location, we never ask for it, and we do not keep your IP address with it.
- Ratings and comments you leave about an order.
Why we use it
- To give you the service you asked for (our contract with you): your account, orders, pickup, catering, the Rewards Club and store credit, and receipts and order updates such as "your order is ready".
- Because we have a legitimate interest: keeping accounts secure, preventing fraud and misuse of codes and rewards, fixing problems, and understanding how the app is used so we can improve it.
- With your consent: offers and news by email, text or push. Email and text are off until you switch them on. For push, the app shows you a screen that says notifications include offers before your phone asks you to allow them: allowing notifications switches on order updates and offers; turn offers off any time in Account. You can switch any of them off at any time in Account, by tapping unsubscribe in an email, or by replying STOP to a text.
- To meet legal duties: tax and accounting records, and answering lawful requests.
Order updates and receipts are not marketing and are sent whatever your marketing choices. You can turn order notifications off in Account.
We do not sell your data, we do not show third-party adverts, and we do not track you across other companies' apps or websites.
Who helps us
These companies process data for us under contract, only to provide their service:
- Cloudflare: hosting, the database and file storage for the app and website.
- Stripe: card payments and saved cards. Stripe also acts as an independent controller for fraud prevention and its legal duties.
- Twilio: sign-in codes by text, and marketing texts if you agree to them.
- Resend: receipts, catering emails and, if you agree, marketing emails.
- Google: address lookup when you order catering, and Firebase Cloud Messaging, which delivers push notifications to the app.
- Apple: delivers push notifications to iPhones.
Some of these providers may handle data outside the UK. Where they do, they are bound by the UK's approved safeguards, such as the International Data Transfer Agreement or the UK addendum to the EU standard contractual clauses.
How long we keep it
- Your account, points and credit: while your account is open.
- When you delete your account (Account → Delete account), your name, number, email, push tokens and usage history are deleted or made anonymous straight away, and marketing stops.
- Order, payment and invoice records: six years, because tax law requires it. After deletion they no longer identify you.
- Your consent history, and the email address or number of anyone who asked us to stop messaging them: kept so we can prove consent and honour the opt-out.
- Sign-in codes: 10 minutes. Signed-in sessions: up to 180 days, or until you sign out.
- Usage events: 24 months.
Your rights
Under UK data protection law you can ask for a copy of your data, ask us to correct it, delete it, restrict or object to how we use it, or to send it to you or another company in a common format. Where we rely on your consent you can withdraw it at any time.
To use any of these rights, email privacy@tikkas.com. We reply within one month.
If you are unhappy with how we handle your data, please tell us first. You can also complain to the Information Commissioner's Office: ico.org.uk, 0303 123 1113.
Cookies and storage on your device
The website uses one essential cookie to keep you signed in. The app keeps your sign-in in your phone's secure keychain. Both keep your bag, your preferences (such as dark mode) and a random device identifier on your device. We use no advertising or third-party tracking cookies. Stripe sets its own cookies when you pay, to prevent fraud.
Children
Tikkas accounts are for people aged 16 and over. Anyone can browse the menu and order without an account.
Changes
If we change this policy we will update the date at the top and, for important changes, tell you in the app. Last updated 25 October 2026.