Regulatory Compliance

法规合规

Effective date: 22 March 2026 · Last updated: 19 April 2026

Menuva takes legal compliance seriously. Although Menuva is a free, student-led pilot project, we have assessed and addressed the regulatory frameworks that apply to a UK-based digital service handling personal data and food information. This page summarises our approach.

1. Data protection

1.1 Menuva processes limited personal data (primarily analytics event data and online identifiers) and is subject to the UK General Data Protection Regulation (UK GDPR) and the Data Protection Act 2018.

1.2 We have completed a Data Protection Impact Assessment (DPIA) to evaluate risks, particularly in relation to younger users. A Legitimate Interests Assessment (LIA) is documented for each processing activity that relies on legitimate interests as its lawful basis. We maintain a Record of Processing Activities (ROPA) as required by Article 30 of the UK GDPR.

1.3 A data breach response procedure is in place to meet our notification obligations under UK GDPR Articles 33 and 34 and the Privacy and Electronic Communications (EC Directive) Regulations 2003 (PECR).

1.4 International data transfers (primarily to Google LLC and Apple Inc. in the United States) are protected by the UK Extension to the EU-US Data Privacy Framework and UK Standard Contractual Clauses, in accordance with UK GDPR Articles 44-49.

1.5 Our Privacy Policy sets out in full what data we collect, how we use it, who we share it with, and how you can exercise your rights.

2. Cookies and analytics

2.1 Menuva uses Google Analytics (GA4) for usage measurement. We have assessed our obligations under the Privacy and Electronic Communications (EC Directive) Regulations 2003 (PECR) Regulation 6, as amended by the Data (Use and Access) Act 2025 (DUAA).

2.2 Analytics operates under the statistical analysis exception in PECR Schedule A1, paragraph 5 (inserted by DUAA s.112). Its sole purpose is to collect statistical data about how the Service is used with a view to making improvements. Google data sharing is disabled, IP addresses are anonymised, and no personal identifiers are collected. The lawful basis for processing the resulting analytics data under the UK GDPR is legitimate interests (Article 6(1)(f)), documented in our Legitimate Interests Assessment.

2.3 You can opt out of analytics at any time using the Manage Analytics link in the footer of any page. Once opted out, the analytics script does not load and no usage data is collected.

2.4 Our Cookie Policy provides a full list of cookies, local storage keys, and similar technologies used on the Website.

3. Children's privacy

3.1 We have assessed Menuva against the ICO's Age Appropriate Design Code (AADC), introduced under Section 123 of the Data Protection Act 2018, which sets out 15 standards of age-appropriate design for online services likely to be accessed by children.

3.2 Key measures we have taken:

  • Data minimisation: we collect only what is necessary for the Service to function and improve. The Service is accountless and does not require registration.
  • No profiling: we do not profile users or make automated decisions based on personal data.
  • No advertising: ad storage, ad user data, and ad personalisation are all disabled. We do not collect the advertising identifier (IDFA) or use ATT-based tracking.
  • Child-friendly privacy information: our Privacy Policy includes a plain-language summary for younger users and their parents (Section 10.2).
  • Default privacy: analytics privacy protections are applied by default, not as an opt-in.

4. Food and allergen information

4.1 Menuva is not a food business operator (FBO) under Regulation (EU) No 1169/2011 or the Food Information Regulations 2014. Menuva does not prepare, sell, or supply food. We are a digital platform that displays menu and allergen information provided by participating restaurants.

4.2 Allergen data shown in Menuva is sourced from venue-provided information and is displayed as guidance only. Each menu clearly attributes the source restaurant, and data freshness timestamps indicate when the information was last updated.

4.3 Users are advised to confirm allergen information directly with the venue before ordering, particularly where allergies are severe. This guidance is displayed within the Service.

5. Business identification

5.1 In accordance with the Companies Act 2006 and the Electronic Commerce (EC Directive) Regulations 2002, we provide the following:

  • Operator: Duke DJ Saputra
  • Address: Warwick Business School, University of Warwick, Scarman Rd, Coventry CV4 7AL
  • Email: hello@menuva.co.uk

5.2 Menuva is a student-led project and is not a registered company.

6. Security

6.1 We apply technical safeguards appropriate to the nature and scale of the Service:

  • all connections use HTTPS encryption
  • Google Analytics is configured with IP anonymisation, no user ID, no advertising features, and all data sharing disabled, with a 14-month data retention period
  • the menus page uses Firebase App Check with reCAPTCHA v3 to prevent automated abuse of our backend services
  • database access is read-only with no server-side storage of personally identifiable information
  • administrative access is restricted and regularly reviewed

6.2 We do not load external dependencies beyond Google Analytics (gtag.js) and, on the menus page, Firebase and reCAPTCHA. The site has no build dependencies, no third-party JavaScript libraries, and no external stylesheets or fonts.

7. Related pages

8. Contact

8.1 For compliance enquiries or questions about this page: hello@menuva.co.uk

8.2 For complaints about how we handle your data or our compliance practices, please see our Complaints Procedure.

8.3 You also have the right under UK GDPR Article 77 to lodge a complaint with the Information Commissioner's Office (ICO): ico.org.uk, phone 0303 123 1113.

Contact

Email: hello@menuva.co.uk

More: Visit Contact page