Privacy Policy
Introduction
This Privacy Notice explains how Nabzys Foods Limited. (“NFL”) (“we”, “our” or “us”) handles and uses personal data when providing services to individuals in the UK (“you”), and your rights in relation to that data.
NFL and Nabzys Holdings Limited (“NHL”) are joint controllers of certain personal data that is processed for the facilitation of providing services to you. Except with respect to Information that We Automatically Collect (as described at 1.2 below), NHL and NFL carry out these data processing activities as joint controllers, taking jointly the decisions regarding the purposes and means of processing your personal data. If you would like to exercise any of your rights described below, both companies will act jointly for the facilitation of your request. NHL and NFL are jointly responsible to you under the applicable data protection law for our processing. NHL’s privacy policy notice is available to view here. Hereafter, the term ‘joint controllers’ means NFL and NHL jointly considered when they process data as joint controllers.
This Privacy Notice explains why and how we will use the personal data that we have obtained from you or others, with whom we share it and the rights you have in connection with the data we use. Please read the following carefully.
This Privacy Notice also describes the way we handle and use the personal data that we obtain from all the different interactions you may have with us as a business, including when you visit our restaurants, social media pages or website currently located at https://www.nabzys.co.uk (“Website”), when you contact us, order online, sign-up for the newsletter, or take part in any of our competitions or promotions.
Please see the section at the end of this Privacy Notice for our contact and legal information, as well as that of NHL.
Personal data that you give to us
We collect the following information when you order online, sign-up for newsletters, visit our Website or social media pages, or when exercising your legal rights:
1.2 Information that We Automatically Collect
NFL acts as sole controller in relation to the information we automatically collect about you when you visit our Website. When you visit our Website, we automatically collect:
We use your personal data for a variety of reasons. We rely on different legal grounds to process your personal data, depending on the purposes of our use and the risks to your privacy, as detailed below. You will only receive marketing communications from us if you have consented and can opt-out of receiving them at any time. We do not share your personal data with companies that would send their marketing to you.
Purposes for which we use your Personal Data | Personal Data Processed | Legitimate Interest |
Account administration – Account administration purposes for any registered account(s) you hold with us. | Contact Information | This is both necessary for the performance of a contract with you for the operation of any account and is also necessary for our legitimate interests to ensure that our customers receive the services. |
Profiling – We may develop a profile for you based on the services you use and/or buy to target and develop content, advertisements and/or marketing materials that are most likely to be of interest and applicable to you. This could appear as advertising on third party websites or social media platforms that you visit. | Contact Information | On the basis of consent, specifically where you have opted to receive direct marketing materials via the preference centre in your account or indicated your consent to being tracked by using first and third party cookies as detailed in our Cookie Policy. |
Data Analytics – To conduct data analytics and analysis studies to review and better understand trends and improve our business, use of our website, app and social media related to us as well as to help us measure Website traffic and usage trends for the Services we provide and to better understand more about the demographics and behaviours of our users. | Contact Information, Account Information, Technical Information | This is both necessary for the performance of a contract with you for the operation of any account and is also necessary for our legitimate interests to improve the Services. We may also have legal obligations or be exercising a legal right to do this. |
Correspondence – To respond to correspondence you send to us and fulfill the requests you make to us. | Correspondence Information, Contact Information | This is necessary for the performance of a contract with you for the operation of any account. |
Order Fulfilment – To fulfil your order and complete your transaction. | Contact Information, Account Information, Technical Information | This is both necessary for the performance of a contract with you for the operation of any account and is also necessary for our legitimate interests to ensure that our customers receive the services. |
Custom Audiences – To help social media networks target you with tailored advertisements. | Contact Information | This is necessary for our legitimate interests to ensure that we can better understand customer needs and preferences. |
Legal Obligations – To comply with our legal obligations to:
| We may use the following types of data, if we have it, as necessary to fulfil these purposes: Contact information, Correspondence Information, Account Information, and Technical Information | This is necessary for our legitimate interests to fulfil our legal obligations and respond to any necessary legal requirements. |
Administrative and Technical Aspects - To operate the administrative and technical aspects of our business efficiently and effectively:
| We may use the following types of information, if we have it, as necessary to fulfil these purposes: Contact Information, Correspondence Information, Account Information, and Technical Information
| This is both necessary for the performance of a contract with you for the operation of any account and is also necessary for our legitimate interests so that we can better understand customer needs and preferences. |
Routine Contact – We may use your personal data to contact you by email to send you newsletters, to notify you of special offers, promotions, competitions or new products and services, or to survey you about our products and services. | Contact Information and Account Information | On the basis of consent, specifically where you have opted to receive direct marketing materials via the preference centre in your account or indicated you consent to being contacted. |
We only disclose your personal data outside our business in limited circumstances. If we do, we will put in place a contract intended to require recipients to protect your personal data, unless we are legally required to share that information (as described below). Any contractors or recipients that work for us will be obliged to follow our instructions. We do not sell your personal data to third parties.
We may disclose your information to our affiliated and third-party service providers, agents, and subcontractors (“Suppliers”) for the purposes of providing services to us or directly to you on our behalf, including the operation and maintenance of our Website, online ordering, CRM, Point of Sale and social media pages. Our Suppliers can be categorized as follows:
When we use Suppliers, we only disclose to them any personal data that is necessary for them to provide their services and only where we have a contract in place that requires them to take steps intended to keep your information safe and secure.
We may disclose personal data to other parties as follows, where permitted by law:
The personal data that we collect will be stored and processed primarily in the UK, though we may also transfer outside of the UK. Where we transfer personal data outside of the UK, we will ensure that:
(a) the personal data is transferred to countries deemed adequate for the purposes of UK data protection laws; or
(b) the transfer is made pursuant to appropriate safeguards, such as standard data protection clauses issued by the Information Commissioner's Office.
If you would like further information on the specific mechanism used by us when transferring your personal data outside the UK, please contact us using the details in Section 9.
Our Website and social media pages may contain links to other websites run by other organizations which we do not control. This Privacy Notice does not apply to those other websites‚ so we encourage you to read their privacy policies.
We store Personal Data as needed to accomplish the purposes identified in this Privacy Notice and to meet legal requirements, including record retention, resolving disputes, and enforcing our agreements. Our retention of your Personal Data is governed by applicable law. This storage period may extend beyond the term of your relationship with us.
As a general rule, we keep your data for as long as it is needed to complete the purpose for which it was collected, as long as you engage in services, or as required by applicable law. We may need to keep your data for longer than our specified retention period for the following reasons:
You have a number of rights in relation to your personal data under data protection law. If you submit a request to exercise your rights, we may ask you for information to verify your identity and, where applicable, to help us to search for your personal data. Except in rare cases, we will respond to you within 30 days after we have received this information or, where no such information is required, after we have received full details of your request.
You have the following rights, some of which may only apply in certain circumstances:
The accuracy of your information is important to us. If you change your name or address/email address, or you discover that any of the other information we hold is inaccurate or out of date, please let us know by contacting us in any of the details described at the end of this Privacy Notice.
Where we rely on our legitimate interests as the legal basis for processing your personal data for particular purposes, you may object to us using your personal data for these purposes by submitting a request through our online form, emailing or writing to us at the address at the end of this Privacy Notice. You also have the right to object to direct marketing including profiling for direct marketing purposes. If we agree that your objection is justified in accordance with your rights under data protection laws, we will permanently stop using your data for those purposes. Otherwise, we will provide you with our justification as to why we need to continue using your data.
Where we rely on your consent as the legal basis for processing your personal data, you may withdraw your consent at any time by contacting us using the details at the end of this Privacy Notice. If you would like to withdraw your consent to receiving any direct marketing to which you previously opted-in, you can also do so using the unsubscribe link in our emails. If you withdraw your consent, our use of your personal data before you withdraw is still lawful.
You may ask us to restrict the processing your personal data in the following situations:
In these situations, we may only process your personal data whilst its processing is restricted if we have your consent or are legally permitted to do so, for example for storage purposes, to protect the rights of another individual or company or in connection with legal proceedings.
In certain circumstances, you may ask for your personal data to be removed from our systems. Unless there is a reason that the law allows us to use your personal data for longer, we will make reasonable efforts to comply with your request.
You have the right to ask for a copy of the information that we hold about you. We may not provide you with a copy of your personal data if this concerns other individuals or we have another lawful reason to withhold that information.
Where we rely on your consent as the legal basis for processing your personal data or need to process it in connection with a contract in place directly with you, you may ask us to provide you with a copy of that information in a structured data file. We will provide this to you electronically in a structured, commonly used and machine readable form, such as a CSV file.
You can ask us to send your personal data directly to another service provider, and we will do so if this is technically possible. We may not provide you with a copy of your personal data if this concerns other individuals or we have another lawful reason to withhold that data.
You have the right to object to automated processing of your personal data based on our legitimate business interest, including profiling.
To exercise any of these rights, please submit your request through our online form, or email or write to us at the address at the end of this Privacy Notice.
You also have the right to lodge a complaint with the data protection regulator. The contact details for the Information Commissioner’s Office (ICO), the data protection regulator in the UK, are available below. However, where your personal data has or is being used in a way that you believe does not comply with data protection law, we encourage you to contact us before making any complaint and we will seek to resolve any issues or concerns you may have.
Telephone: +44 0303 123 1113
Email: casework@ico.org.uk
Website: www.ico.org.uk
Web-form: www.ico.org.uk/concerns/
Address: Wycliffe House, Water Lane, Wilmslow, Cheshire, SK9 5AF
This Privacy Notice is current as of the effective date set forth below. We may change this Privacy Notice from time to time, so please be sure to review the Privacy Notice at https://www.nabzys.co.uk/privacy-policy periodically.
You can contact us with your inquiries in relation to this Privacy Notice or for any other reason by post or email.
To contact us in relation to this Privacy Notice, including to exercise any of your rights in relation to your personal data, please contact us at https://www.nabzys.co.uk/privacy-policy or via post at:
Nabzys Head Office
37 Hesketh Road
Southport
PR9 9PB
For other general enquiries, please contact us by post at the address above.
To contact Nabzys Holdings Limited, please contact them via post at:
Nabzys Holdings Limited
37 Hesketh Road
Southport
PR9 9PB
Company number:
ICO Registration number:
Last Updated: 21 May, 2026
INTRODUCTION
Welcome to Nabzys. Nabzys Foods Limited (“we”, “our” or “us”) are committed to protecting and respecting your privacy.
This Privacy Policy explains how we handle and use your personal information and your rights in relation to that information. Under data protection law, Nabzys Foods Limited is the controller of that information. Information collected may be shared with Nabzys. Please note: All UK Nabzys restaurants are owned and operated by an independent franchisee. This Privacy Policy only applies to our processing of your personal information and does not apply to the processing of your personal information by an independent franchisee. To contact or view information about our franchisee and our franchisee’s privacy policies, please send an email to info@nabzysstores.co.uk.
This Privacy Policy explains why and how we will use the personal information that we have obtained from you or others, with whom we share it and the rights you have in connection with the information we use. Please read the following carefully.
This Privacy Policy describes the way we handle and use the personal information that we obtain from all the different interactions you may have with us as a business, including when you visit our restaurants, social media pages or website currently located at https://www.nabzys.co.uk (“Website”), when you contact us, order online, sign-up for the newsletter, or take part in any of our competitions or promotions.
Nabzys Foods Limited is the controller in relation to the processing activities described in this document. This means that Nabzys Foods Limited decides why and how your personal information is processed. Please see the section at the end of this Privacy Policy for our contact and legal information.
PERSONAL INFORMATION WE COLLECT ABOUT YOU
We receive personal information about you that you give to us, when you order online, sign-up for the newsletter, visit the website and social media pages, that our franchisee collects from your visits to Nabzys restaurants, and that we obtain from other sources. We only collect personal information which we need to fulfill services and that is relevant for the purposes for which we intend to use it.
Personal information that you give to us
We collect the following information when you order online, sign-up for the newsletter, visit the website or social media pages or when exercising your legal rights:
Information that we collect about you
When you visit our website, we automatically collect:
USE OF YOUR PERSONAL INFORMATION
We use your personal information for a variety of reasons. We rely on different legal grounds to process your personal information, depending on the purposes of our use and the risks to your privacy. You will only receive unsolicited marketing communications from us if you have consented and can opt-out of receiving them at any time. We do not share your personal information with companies that would send their marketing to you.
3.1 Where you have provided CONSENT
We may use and process your personal information for the following purposes where you have consented for us to do so:
You may withdraw your consent for us to use your information under any of the defined situations at any time. Please see Your rights in relation to your personal data for further details.
3.2 Where necessary to comply with our LEGAL OBLIGATIONS
We will use your personal information to comply with our legal obligations to:
3.3 Where necessary to pursue a LEGITIMATE INTEREST
We may use and process your personal information where it is necessary to pursue legitimate interests for the following purposes:
Processing necessary for us to promote our business, brands and products and measure the reach and effectiveness of our campaigns
Processing necessary for us to support our visitors and guests with their enquiries
Processing necessary for us to respond to changing market conditions and the needs of our guests and visitors
Processing necessary for us to operate the administrative and technical aspects of our business efficiently and effectively
Marketing communications: If you give your consent, we may use your personal information to contact you by email to send you newsletters, to notify you of special offers, promotions, competitions or new products and services or to survey you about our products or services. We try to adapt any marketing material that we send to you, for example by notifying you of special offers or promotions that apply to your interests and in your location. If you do not wish to receive communications from us, please inform us by using the unsubscribe link inside the email.
If you opt-out of receiving marketing communications from us, we keep your email address on our suppression list for a defined period to ensure that we comply with your wishes.
DISCLOSURE OF YOUR PERSONAL INFORMATION BY US
We only disclose your personal information outside our business in limited circumstances. If we do, we will put in place a contract intended to require recipients to protect your personal information, unless we are legally required to share that information, or we are sharing information for the purposes of a contact tracing scheme such as NHS Test and Trace in England. Any contractors or recipients that work for us will be obliged to follow our instructions. We do not sell your personal information to third parties.
We may disclose your information to our third party service providers, agents and subcontractors (Suppliers) for the purposes of providing services to us or directly to you on our behalf, including the operation and maintenance of our website, online ordering, CRM, Point of Sale and social media pages. Our Suppliers can be categorized as follows:
Supplier Types (Category/Type)
We may disclose personal information to other affiliated parties as follows:
DATA STORAGE AND TRANSFER OUT OF THE UNITED KINGDOM
If you are located in the UK, your information that we collect through our Service will be stored and processed primarily in the UK. If we transfer information outside of the UK, we will ensure that:
(a) the personal information is transferred to countries recognized as offering an equivalent level of protection; or
(b) the transfer is made pursuant to appropriate safeguards, such as standard data protection clauses adopted by the European Commission. Notwithstanding these measures, the country and jurisdiction to which data is transferred may provide for a lower standard of data protection than the one under the UK law.
SECURITY AND LINKS TO OTHER WEBSITES
We take the security of your personal information seriously and use a variety of measures based on good industry practice to keep it secure. Nonetheless, transmissions over the internet and to our Website may not be completely secure, so please exercise caution. When accessing links to other websites, their privacy policies, not ours, will apply to your personal information.
We employ security measures to protect the personal information you provide to us, to prevent access by unauthorized persons and unlawful processing, accidental loss, destruction and damage. Unfortunately, the transmission of information via the internet is not completely secure. Although we will do everything possible to protect your personal information, we cannot guarantee the security of any personal information during its transmission to us online. You accept the inherent security implications of using the internet and will not hold us responsible for any breach of security unless we are at fault.
Our website and social media pages may contain links to other websites run by other organizations which we do not control. This Privacy Policy does not apply to those other websites‚ so we encourage you to read their privacy policies. We are not responsible for the privacy policies and practices of other websites (even if you access them using links that we provide) and we provide links to those websites solely for your information and convenience. We specifically disclaim responsibility for their content, privacy practices and terms of use, and we make no endorsements, representations or promises about their accuracy, content or thoroughness. Your disclosure of personal information to third-party websites is at your own risk.
In addition, if you linked to our website from a third-party website, we cannot be responsible for the privacy policies and practices of the owners and operators of that third party website and recommend that you check the privacy policy of that third party website.
THE PERIODS FOR WHICH WE RETAIN YOUR PERSONAL INFORMATION
We store personal data for as long as necessary to fulfill the purposes for which we collect the data, except if required otherwise by law.
Exceptions to our retention policy include the following occasions:
YOUR RIGHTS IN RELATION TO YOUR PERSONAL DATA
You have a number of rights in relation to your personal information under data protection law. In relation to certain rights, we may ask you for information to verify your identity and, where applicable, to help us to search for your personal information. Except in rare cases, we will respond to you within 30 days after we have received this information or, where no such information is required, after we have received full details of your request.
You have the following rights, some of which may only apply in certain circumstances:
The accuracy of your information is important to us. If you change your name or address/email address, or you discover that any of the other information we hold is inaccurate or out of date, please let us know by contacting us in any of the details described at the end of this Privacy Policy.
Where we rely on our legitimate interests as the legal basis for processing your personal information for particular purposes, you may object to us using your personal information for these purposes by submitting a request through our online form, emailing or writing to us at the address at the end of this Privacy Policy. If we agree that your objection is justified in accordance with your rights under data protection laws, we will permanently stop using your data for those purposes. Otherwise, we will provide you with our justification as to why we need to continue using your data.
Where we rely on your consent as the legal basis for processing your personal information, you may withdraw your consent at any time by contacting us using the details at the end of this Privacy Policy. If you would like to withdraw your consent to receiving any direct marketing to which you previously opted-in, you can also do so using unsubscribe link in our emails. If you withdraw your consent, our use of your personal information before you withdraw is still lawful.
You may ask us to restrict the processing your personal information in the following situations:
In these situations, we may only process your personal information whilst its processing is restricted if we have your consent or are legally permitted to do so, for example for storage purposes, to protect the rights of another individual or company or in connection with legal proceedings.
In certain circumstances, you may ask for your personal information to be removed from our systems. Unless there is a reason that the law allows us to use your personal information for longer, we will make reasonable efforts to comply with your request.
You have the right to ask for a copy of the information that we hold about you. We may not provide you with a copy of your personal information if this concerns other individuals or we have another lawful reason to withhold that information.
Where we rely on your consent as the legal basis for processing your personal information or need to process it in connection with a contract in place directly with you, you may ask us to provide you with a copy of that information in a structured data file. We will provide this to you electronically in a structured, commonly used and machine readable form, such as a CSV file.
You can ask us to send your personal information directly to another service provider, and we will do so if this is technically possible. We may not provide you with a copy of your personal information if this concerns other individuals or we have another lawful reason to withhold that information.
You have the right to object to automated processing of your personal information based on our legitimate business interest, including profiling.
To exercise any of these rights, please submit your request through our online form.
You have the right to lodge a complaint with a data protection regulator in the United Kingdom. The contact details for the Information Commissioner’s Office (ICO), the data protection regulator in the UK, are available on the ICO Website, where your personal information has or is being used in a way that you believe does not comply with data, however, we encourage you to contact us before making any complaint and we will seek to resolve any issues or concerns you may have.
TERMS OF USE
Your use of our Website or Services, as well as any dispute over privacy, is subject to this Policy and our Terms of Use available at https://www.nabzys.co.uk/terms including applicable limitations on damages and the resolution of disputes.
CHANGES TO THIS PRIVACY POLICY
This Privacy Policy is current as of the effective date set forth above. We may change this Privacy Policy from time to time, so please be sure to review the Privacy Policy at https://www.nabzys.co.uk/privacy-policy periodically.
HOW TO CONTACT US ABOUT YOUR PRIVACY
You can contact us with your inquiries in relation to this Privacy Policy or for any other reason by post or email.
To contact us in relation to this Privacy Policy, including to exercise any of your rights in relation to your personal information, please contact us at https://www.nabzys.co.uk/privacy-policy or 37 Hesketh Road, Southport, PR9 9PB.
For anything else, including general enquiries, please contact us by post at 37 Hesketh Road, Southport, PR9 9PB.
