Last updated: 25 October 2026
1. Who we are
Welcome to BURGER-DROP. This website, www.burger-drop.com, is run by HQ Franchising Limited, a company registered in England and Wales with company number 14955600, whose registered office is at 50 Woodgate, Leicester, England, LE3 5GF ("BURGER-DROP", "we", "us" or "our").
This policy explains what personal information we collect when you use our website, contact us, sign up to hear from us or order from us, what we do with it, and the rights you have. We are the controller of the personal information collected through this website.
Each BURGER-DROP restaurant is run by its own separate limited company, some of which are franchisees using the BURGER-DROP brand under licence. When you order from, visit or deal with a particular restaurant, the company running that restaurant is also responsible for the personal information it handles about you. You can ask us at any time which company runs a particular restaurant.
Our restaurants are in Newcastle (Westgate Road and Fayre Play at The Gate), Sunderland, North Tyneside (Whitley Bay), Manchester (Fallowfield), Middlesbrough and Edinburgh.
If you have any questions about this policy or how we use your information, email us at smash@burgerdrop.co.uk.
2. The law we follow
We handle personal information in line with the UK General Data Protection Regulation (UK GDPR), the Data Protection Act 2018 and the Privacy and Electronic Communications Regulations 2003 (PECR), which cover cookies and marketing emails.
3. What we collect and why
When you contact us. If you use our contact form or email us, we collect your name, email address and whatever you tell us in your message. We use this to reply and help with your question, feedback or complaint. Our lawful basis is our legitimate interest in responding to customers and running our business well.
When you sign up to our emails. If you enter your email address in the sign up box on our website, we collect your email address so we can send you news about BURGER-DROP, such as new drops, offers and openings. We only send these emails with your consent, and you can unsubscribe at any time using the link in any email or by emailing us. Our lawful basis is your consent.
When you enquire about a franchise. If you use our franchise form, we collect your name, email address, phone number, preferred location, investment capability and your message. We use this to discuss franchise opportunities with you and to assess whether a franchise may be suitable. Our lawful basis is taking steps at your request before possibly entering into a contract, and our legitimate interest in growing our business. Franchise enquiries are handled by HQ Franchising Limited.
When you order online for collection or join our loyalty scheme. Our online ordering and loyalty accounts are provided through Vita Mojo, a third party ordering and restaurant technology platform, at burgerdrop.vmos.io. When you order or create an account, the information you give (such as your name, email address, phone number, order details and loyalty stamps) is collected through Vita Mojo on our behalf so we can prepare your order, contact you about it, run the loyalty scheme and keep proper records. Card payments are handled securely by a payment provider; we do not see or store your full card details. Our lawful basis is performing our contract with you, and keeping records we are legally required to keep. If you agree to receive marketing when you order, we rely on your consent for that.
When you order through a delivery app. If you order delivery through Uber Eats, Uber is responsible for the information you give it under its own privacy policy. Uber shares with the restaurant only what is needed to prepare your order (for example your first name and order details).
When you browse our website. Like most websites, our hosting and security providers automatically receive technical information such as your IP address, browser type, device and the pages you visit. This is used to deliver the website to you, keep it secure and protect our forms from spam. Our lawful basis is our legitimate interest in running a safe and working website. See section 9 for cookies.
We do not use your information to make automated decisions that have legal or similarly significant effects on you.
4. Marketing
We will only send you marketing emails if you have opted in, or, where the law allows, if you have bought from us before and did not opt out at the time (in which case we will only tell you about similar BURGER-DROP products and offers). Every email includes an unsubscribe link. Our email newsletters are sent using MailerLite, an email marketing service.
We will never sell your personal information.
5. Who we share your information with
We only share your information where we need to, and our service providers may only use it on our instructions. They are:
- Webflow, which hosts our website and receives the details you submit through our website forms.
- Cloudflare, which provides security and content delivery for our website.
- Google, whose reCAPTCHA service helps protect our forms from spam and abuse.
- Vita Mojo, which provides our online ordering, loyalty accounts and restaurant till systems, together with its payment provider.
- MailerLite, which we use to send marketing emails to people who have signed up.
- Our email and office software providers, which we use to receive and reply to your messages.
- The BURGER-DROP restaurant companies and franchisees, where your message, order, feedback or complaint relates to a particular restaurant.
- Our professional advisers (such as accountants, solicitors and insurers) where needed.
- Authorities and regulators, such as HMRC, the police or the Information Commissioner's Office, where the law requires it or to protect our rights or the safety of others.
- A buyer or investor, if we sell, transfer or restructure all or part of our business, in which case your information would continue to be protected in line with this policy.
Our website also links to other websites and apps, such as Uber Eats, Instagram and Google Maps. Those services have their own privacy policies and we are not responsible for how they use your information.
6. International transfers
Some of our service providers (including Webflow, Cloudflare, Google and some MailerLite systems) are based in, or may access information from, countries outside the UK, including the United States and the European Economic Area. Where your information is transferred outside the UK, we make sure it is protected by an approved safeguard, such as a UK adequacy decision (for example for the EEA, or for US companies certified under the UK Extension to the Data Privacy Framework) or the International Data Transfer Agreement or Addendum approved by the ICO. You can contact us for more information about these safeguards.
7. How long we keep your information
- Contact form messages, franchise enquiries and other enquiries: up to 2 years after our last contact with you, unless we need them longer to deal with a complaint or claim, or a franchise agreement follows.
- Order, payment and accounting records: 6 years, as required for tax and accounting purposes.
- Newsletter sign ups: until you unsubscribe. After that, we keep your email address on a suppression list so we do not email you again by mistake.
- Website technical and security logs: kept by our hosting and security providers for short periods in line with their own retention policies.
8. Keeping your information safe
We use appropriate technical and organisational measures to protect your information, including secure (HTTPS) connections on our website, access controls and choosing reputable service providers. No method of sending information over the internet is completely secure, but we work hard to protect your information and will act quickly if anything goes wrong.
9. Cookies
Cookies are small files placed on your device when you visit a website. Similar technologies, such as scripts that check whether a visitor is a real person, work in a similar way. Under PECR we must ask for your consent before using cookies, except those that are strictly necessary to provide the website or service you have asked for.
At the date of this policy, our website only uses strictly necessary cookies and technologies:
- _cfuvid (set by Cloudflare): helps keep the website secure and protect it from abuse. It lasts only for your browsing session.
- Google reCAPTCHA: helps protect our forms from spam and abuse by checking that submissions come from a real person. It may set or read cookies and collect technical information about your device and browser, which Google uses in line with its own privacy policy.
Our website also loads design and code files from content delivery networks (Webflow, jsDelivr and cdnjs, which is run by Cloudflare). These providers receive your IP address so they can deliver the files to your browser.
We do not currently use analytics or advertising cookies. If we start using them, we will ask for your consent first and update this policy.
When you click through to order with Vita Mojo or Uber Eats, or follow links to Instagram or Google Maps, those websites may set their own cookies, which are covered by their own cookie policies.
You can block or delete cookies in your browser settings. If you block strictly necessary cookies, some parts of our website, such as our forms, may not work.
10. Your rights
Under UK data protection law you have the right to:
- ask for a copy of the personal information we hold about you (a subject access request);
- ask us to correct information that is wrong or incomplete;
- ask us to delete your information;
- ask us to restrict how we use your information;
- object to us using your information where we rely on legitimate interests, and to stop direct marketing at any time;
- ask us to transfer information you gave us to you or to another organisation (data portability), where this applies;
- withdraw your consent at any time, where we rely on consent. This does not affect anything we did before you withdrew it.
To use any of these rights, email smash@burgerdrop.co.uk. We will reply within one month, and there is normally no charge. We may need to confirm your identity first. Some rights have exceptions, and we will explain if one applies.
11. Children
Our website is for a general audience and is not aimed at children. We do not knowingly collect personal information from children under 13 through our website, and our newsletter and online accounts are intended for people aged 13 and over. If you think a child has given us their information, please contact us and we will delete it.
12. Complaints
If you are unhappy with how we have handled your information, please contact us first at smash@burgerdrop.co.uk and we will do our best to put things right. You also have the right to complain to the Information Commissioner's Office (ICO), the UK data protection regulator: www.ico.org.uk, telephone 0303 123 1113, or by post to Information Commissioner's Office, Wycliffe House, Water Lane, Wilmslow, Cheshire, SK9 5AF.
We are registered with the Information Commissioner's Office as a data controller.
13. Changes to this policy
We may update this policy from time to time, for example if we start using a new service. The latest version will always be on this page with the date it was last updated. If we make important changes, we will let you know where appropriate.
14. Contact us
HQ Franchising Limited (trading as BURGER-DROP)
Registered office: 50 Woodgate, Leicester, England, LE3 5GF
Company number: 14955600
Email: smash@burgerdrop.co.uk
