Last updated: [A CONFIRMAR: data em que for publicada, no formato 10 August 2026]

This policy explains what personal data EAT UP collects when you use eatupie.com, why we collect

it, how long we keep it and what rights you have over it. We are based in Dublin and we follow the

General Data Protection Regulation (GDPR) and the Irish Data Protection Acts 1988 to 2018.

Who we are

EAT UP prepares and delivers Brazilian meals in Ireland.

Legal entity: [A CONFIRMAR: nome legal completo, e se é limited company ou sole trader]

Company registration number: [A CONFIRMAR: número da CRO, ou remover esta linha se não houver]

Address: Reuben House, 1, Saint James, Dublin 8, D08 Y2Y3, Ireland

Email: [email protected]

Phone: +353 83 340 6714

For anything in this policy, write to us at [email protected]. We are the data controllerfor the personal data described here.

What we collect
When you place an order or subscribe:

Your name, email address, phone number, delivery address, delivery notes and the contents andvalue of your order. We also keep a record of your order history.

When you pay

We do not see or store your card details. Payment is processed by Stripe, and your card data goesdirectly to them. We receive only the outcome of the payment, the amount, the currency and thelast digits of the card, which is what lets us match a payment to an order and issue a refund.

When you fill in one of our business forms

Our catering and partnership forms ask for your name, email address, phone number, business name,location, expected volume, event date and the details of what you need. You also choose therewhether you want to receive messages from us.

When you join our points programme

We keep a balance of points, the purchases that generated them and the rewards you redeemed,linked to your contact record.

When you browse the site

Standard technical data such as your IP address, browser, device type, pages viewed and how youarrived. We use Microsoft Clarity, which records page interactions such as clicks and scrolling sowe can see where the site is difficult to use. Clarity masks text content by default and we do notuse it to identify individual visitors.
We do not knowingly collect data from children under 16.

Why we use it, and on what legal basis
Most of what we do with your data is simply what it takes to serve you, and the legal basis for it

is the contract between us. That covers taking, preparing and delivering your order, managing

your subscription along with its renewals and cancellations, taking payment and issuing refunds,

contacting you about an order or a delivery, and running the points programme once you have joined

it. When you send us a catering or partnership enquiry, we use your details to reply and to prepare

a quote, which is the same basis: steps taken at your request before a contract exists.

We keep invoices and tax records because Irish tax law obliges us to, and that legal obligation is the basis for holding them even after you stop ordering from us.

We send you offers, discounts and menu news only where you have given consent, by ticking thebox on a form or at checkout.

Two things rest on our legitimate interests. The first is understanding how the site is used sowe can fix what is broken and improve what is not working, which is why we use analytics. The second is preventing fraud and the abusive use of discount codes, which protects both the businessand the customers who use them properly. In each case we have considered whether this outweighsyour privacy, and we use no more data than the purpose needs. You can object to either, and youwill find how to do that in the section on your rights.

You can withdraw consent for marketing at any time, and doing so does not affect anything we sentbefore. Every marketing email has an unsubscribe link, and you can reply STOP to any marketingtext message.

Messages about an order you actually placed are not marketing. We will keep sending those whileyour order is being prepared and delivered, because that is part of the service.

Who we share it with
We share personal data only with the suppliers that make the service work, and only with whatthey need:
- Stripe Payments Europe, Ltd. processes payments and subscriptions.

- HighLevel Inc. hosts this website, our forms and our customer records.

- Cloudflare, Inc. hosts the service that calculates and stores your points balance.

- Microsoft Corporation provides Clarity, our site analytics.

- Our delivery arrangements receive your name, address and phone number so the order reaches you.

We do not sell your personal data, and we do not share it for anyone else's marketing.
We will disclose data if the law requires it, for example to Revenue, to the Food Safety Authorityof Ireland or under a court order.

Data outside the European Economic Area
Some of these suppliers are based in the United States, which means your data may be processedoutside the EEA. Where that happens, the transfer relies on the European Commission's StandardContractual Clauses or on an adequacy decision, which are the mechanisms GDPR provides for exactlythis. You can ask us for details of the safeguards in place.

How long we keep it
- Order and payment records: [A CONFIRMAR: recomendado 6 years, que é o prazo que a Revenue  exige para registro contábil na Irlanda]

- Customer contact record and order history: while you are a customer, and for 2 years after  your last order, so we can answer a question about it

- Points balance and history: while the programme account is active. Points themselves expire  12 months after they are earned

- Enquiry forms that did not become a customer: 12 months

- Marketing consent records: for as long as you are subscribed, and for 2 years afterwards, so  we can prove the consent existed

- Analytics data: as set by Microsoft Clarity, which is currently 13 months

After these periods we delete the data or anonymise it so that it can no longer identify you.

Cookies
The site uses cookies that are strictly necessary for it to work, such as keeping your basket andyour session, and analytics cookies from Microsoft Clarity. If you have a language preference, itis stored so that the site opens in the language you chose.

You can block or delete cookies in your browser settings. If you block the necessary ones, thebasket and the checkout will stop working.

Your rights
Under GDPR you have the right to:
- ask for a copy of the personal data we hold about you

- have inaccurate data corrected

- have your data deleted, where we are not required to keep it

- restrict or object to how we use it

- receive your data in a portable format

- withdraw consent at any time

- not be subject to a decision made purely by automated means.

We do not make any such decisions
Write to [email protected] and we will reply within one month. There is no charge.
If you are not satisfied with our answer, you can complain to the Data Protection Commission,21 Fitzwilliam Square South, Dublin 2, D02 RD28, at dataprotection.ie.

Security
Payments are handled by Stripe and never touch our systems. Our customer data sits in accesscontrolled accounts, the site is served over HTTPS and access to customer records is limited tothe people who need it to run orders. No system is perfectly secure, but we treat a breach thatputs your rights at risk as reportable to the Data Protection Commission within 72 hours, as GDPRrequires.

Changes
If we change this policy we will update the date at the top. If the change is significant, forexample a new use of your data, we will tell you by email before it takes effect.