This policy explains what personal data TakeawaysNearMe.ie uses, why, who else sees it, how long we keep it and how you can control it. It covers visitors, account holders, restaurant owners, advertisers and the business contacts we keep records about.
1. Who we are
TakeawaysNearMe.ie is an online directory of takeaways in Ireland. It is run by [Legal entity name], [Registered office address] (company number [CRO company number]), the controller of your personal data.
- Privacy contact: hello@takeawaysnearme.ie (subject line “Data protection”)
- Website: takeawaysnearme.ie
We have not appointed a Data Protection Officer: we are not a public body, and we do not monitor people on a large scale or process special category data on a large scale (GDPR Art. 37). Our lead supervisory authority is the Data Protection Commission (DPC) in Ireland.
2. At a glance
- You can browse the whole directory without an account.
- We do not sell personal data and we do not build profiles of visitors.
- Our own “Sponsored” ads are chosen by the page you are on (county, town, cuisine), never by who you are.
- Google ads and their cookies only use your data for personalised ads if you agree in the consent message.
- Restaurant statistics are daily totals with no cookie, IP address or identifier stored.
- Some listing text is written by AI (Azure OpenAI) and is labelled on the page. No AI system makes decisions about you.
3. Visiting the site
Security and rate limits
Every request carries your IP address. We use it in memory to limit how often one address can sign in, submit forms or send counters, and it appears in our server logs, which we use to find faults and attacks. We do not store it against your browsing. Location searches and ad click details are removed from the logs. If your browser blocks something on one of our pages under our security policy, it may send us a report; we log the page path (without its query), the blocked resource's origin, the rule involved and the script file and line, but no IP address, browser details or page content.
Takeaways near me
On the “Takeaways near me” page, your browser asks before sharing your location. If you allow it, your location is rounded to about 100 metres and sent only to find takeaways within the distance you pick. It is not saved on your device, in an account or in our logs.
Restaurant statistics
When a restaurant page is viewed, a card is shown, or someone taps call, directions or website, the page sends a small counter to us. We add it to that restaurant's total for the day. We store no cookie, device storage, IP address, browser details or user ID with it, and known bots are ignored. The totals are shown only to that restaurant's verified owner and to our staff.
Sponsored ad counters
When one of our Sponsored ads is at least half visible, or is clicked, we add one to that ad's daily total for the kind of page, county, town and cuisine. Nothing that identifies you is stored.
Maps
Restaurant and listing pages have space for a Google map. It loads only if you agreed to Google in our consent message, or when you press “Show map” (that choice lasts for the page you are on and is not stored). Until then nothing is sent to Google, and the address, directions and “Open in Google Maps” links still work. When the map loads, your browser connects to Google, which receives your IP address and browser details and may read or set its own cookies, under Google's Privacy Policy.
4. Accounts
To create an account we need your name and email address. We email you a one-time 6-digit code; entering it confirms the address is yours and signs you in, so a password is not needed. Codes are kept only as a secure hash, work once and expire after 10 minutes. You can also set a password (stored only as a secure hash); a sign-in with a password always needs an emailed code as well. Accounts created with a password before codes were introduced must confirm their email before they can sign in. When you sign in we record a session with your IP address and browser type, so we can keep you signed in and spot misuse.
With an account you can save favourites. You can also choose to receive occasional news emails (off by default); we record your choice and its date, and every email has a one-click unsubscribe.
Your account's Profile page lets you download your data (JSON) and delete your account. Deletion removes your account, sessions, favourites, profile and claims straight away, releases any listing you managed, and replaces your email with “deleted-user” in our change history.
5. Claiming a listing
To claim a listing you give your name, an email for the claim, optionally a phone number, your role in the business and a message. Our staff use these to check that you are connected to the business, and we email you when you submit and when we decide. The claim details are also sent to our staff inbox.
A claim also creates a business contact record in our CRM (section 8), so we can follow up about the listing. If a claim is rejected, your name, email, phone and message are removed from it 12 months after the decision; we keep the fact that a claim was rejected and the reason.
6. Restaurant owners
When your claim is approved you can manage the listing. Changes to details go to our staff as a request, and the result is recorded in our change history with your account. Photos you upload are stored in Microsoft Azure Blob Storage and shown publicly on your listing. You can see your restaurant's statistics, including Google Search totals for your page, which Google gives us as page-level totals with no data about individual searchers.
7. Advertising enquiries and ads
The form on /advertise collects your name, business name, email, optionally a phone number and your listing, the counties you are interested in, your message and the page you came from. We email you an acknowledgement and our staff a copy, reply to you, and record you as a business contact in our CRM. If you book an ad, we keep the booking (advertiser name, ad text and image, link, targeting, dates) and its daily totals so we can report results to you.
8. Business contacts (CRM)
We keep records of people we deal with at listed takeaways and advertisers: owners, managers and staff. A record can hold a name, role, work phone, work email, preferred contact method, notes, a “do not contact” flag and a log of calls, emails and visits with their outcome and follow-up date.
- Where it comes from: you (a claim, an enquiry, a call or email), or public business sources such as the restaurant's own listing or website.
- Why: to tell restaurants about their listing, claims, verification and advertising, and to keep track of what was agreed.
- Lawful basis: legitimate interest (GDPR Art. 6(1)(f)). Business-to-business contact about a listing that is already public is expected, and the records are limited to work details, seen only by our staff.
- Your right to object: tell us and we mark you “do not contact” straight away, or delete your record. Email hello@takeawaysnearme.ie.
- Retention: records with no activity for 24 months are reviewed and deleted unless still needed.
We do not send unsolicited marketing emails to individuals. Any marketing call or email to a business follows the Irish ePrivacy Regulations (S.I. 336/2011), including the National Directory Database opt-out for phone calls.
9. Listing data and removal
Listings start from public business details supplied by the Google Places API: name, address, location, phone, website, opening hours, services, price level, type and Google's overall rating and number of reviews. We do not copy individual reviews. Owners and our staff may then add or correct details. Most of this is about a business, but for a sole trader a name or phone number can be personal data.
We rely on legitimate interest: people expect a public takeaway's contact details and hours to appear in directories, the data is already public, and you can object.
Removal: email hello@takeawaysnearme.ie from an address linked to the business (or tell us how we can check you are connected to it). We take the listing off the site and add its Google Place ID to our exclusion list, so it is not added again. Removal and all data protection requests are free.
10. Lawful bases
| What we do | Personal data | Lawful basis (GDPR Art. 6) |
|---|---|---|
| Run your account: sign-in by emailed code, sessions, email verification, an optional password, password reset, favourites | Name, email, one-time codes (stored hashed), password if you set one (stored hashed), favourites, session IP address and browser | Contract (6(1)(b)) |
| Send you occasional news emails, only if you switch it on | Email, name, your choice and when you made it | Consent (6(1)(a)); withdraw any time |
| Review an ownership claim and manage an approved listing | Name, email, phone, role in the business, your message, change requests, photos | Contract (6(1)(b)) and legitimate interest in preventing false claims (6(1)(f)) |
| Reply to and manage an advertising enquiry, and run a booked ad | Name, business name, email, phone, counties, message, the page you came from | Steps before a contract and the contract (6(1)(b)) |
| Keep business contact records (CRM) | Name, role, work phone and email, preferred contact method, call and email notes | Legitimate interest (6(1)(f)): see section 8 |
| Publish listings about takeaways | Business details that may identify a sole trader (name, phone, address) | Legitimate interest (6(1)(f)): see section 9 |
| Security, rate limits and abuse prevention | IP address (in memory for limits; in server logs) | Legitimate interest (6(1)(f)) |
| Change history (audit log) for staff and owner edits | The account and email that made a change, the fields changed | Legitimate interest in accountability and security (6(1)(f)) |
| Count page views and clicks per restaurant | None: daily totals only, no cookie, IP or identifier stored | Legitimate interest (6(1)(f)) for the transmission |
| Show Google ads and remember your consent choice | Cookie and device identifiers, IP address (handled by Google) | Consent (6(1)(a)) under the ePrivacy rules; see the Cookie Policy |
| Find takeaways near you (only if you allow it) | Your browser location, rounded to about 100 m | Your request; your browser asks for permission first |
| Meet legal obligations (tax records for paid services, responses to authorities) | Invoices and the details needed for them | Legal obligation (6(1)(c)) |
Where we rely on legitimate interest we have weighed our interest against yours, and you can object (section 16). Where we rely on consent you can withdraw it at any time, without affecting what we did before.
11. AI and automated systems
- AI-written listing text. Summaries, descriptions, FAQs and town and county introductions may be written by Microsoft Azure OpenAI from the business details in section 9. It runs in Azure's Sweden Central region with EU Data Zone processing, so the text is generated in the EU. No visitor or account data is sent. Each AI-written text is labelled on the page; see our AI content notice.
- No automated decisions about you. We do not make decisions with legal or similarly significant effects based solely on automated processing (GDPR Art. 22). Ownership claims are decided by a person.
- Automated checks. Software applies fixed rules: it blocks venues that mainly sell alcohol, checks listing names, limits request rates and ignores bots in statistics. These rules apply to listings and traffic, not to profiles of people.
- Ordering. Listings are ordered by Google rating weighted by the number of reviews (by distance on the near-me page), never by anything about you. Paid ads sit apart from the list and are always labelled “Sponsored”.
12. Ads on the site
Our Sponsored ads are sold by us directly. They are picked by the page you are viewing (type of page, county, town, cuisine), not by your behaviour. We do not use cookies or profiles for them.
Google AdSense may show ads on some pages. Google's consent message (an IAB TCF certified consent tool) asks whether Google and its ad partners may use cookies and personal data. If you do not agree, Google may still show non-personalised or limited ads. Google is a separate controller for this; see how Google uses data from partner sites. Details and how to change your choice are in our Cookie Policy.
13. Processors and recipients
These providers handle personal data for us under data processing terms (GDPR Art. 28), except where marked as Google's own use. We may also disclose data where the law requires, for example to An Garda Síochána or a court.
| Recipient | What for | Data | Where |
|---|---|---|---|
| Hosting provider ([Hosting provider and country of the app server and database]) | Runs the website, API and database | All data held by the service | [Hosting provider and country of the app server and database] |
| Microsoft (Azure Blob Storage, Azure Front Door) | Stores uploaded photos and ad images; delivers the site and protects it from attacks | Images; IP address and request details as traffic passes through | [Azure region(s), e.g. North Europe (Ireland)] |
| Microsoft (Azure OpenAI) | Writes listing summaries, descriptions, FAQs and town and county introductions | Business details only (no visitor or account data) | Sweden Central (EU Data Zone: processed in the EU) |
| Microsoft (Azure Communication Services Email) | Sends account and service emails | Name, email address, email content | [Azure region(s), e.g. North Europe (Ireland)] |
| Resend (fallback email provider) | Sends emails if Azure email is unavailable | Name, email address, email content | United States |
| Google (Maps Platform) | Shows maps on restaurant and listing pages | Your IP address and browser details, sent by your browser to Google when a map loads | Google’s global network |
| Google (AdSense and its consent tool) | Shows Google ads and records your consent choice | Cookies, device identifiers, IP address (Google is a separate controller for its own use) | Google’s global network |
| Google (Places API, Search Console) | Supplies public business details; reports how our pages appear in Google Search | No visitor data is sent; Search Console gives us page totals only | Google’s global network |
14. Transfers outside the EEA
Resend and Google are based in the United States, and Microsoft and Google may access data from outside the EEA. We rely on the EU–US Data Privacy Framework where the provider is certified (you can check at dataprivacyframework.gov) and on the European Commission's Standard Contractual Clauses (2021) otherwise. The Framework was upheld by the EU General Court in September 2025; an appeal is pending at the Court of Justice, and we will update this policy if the position changes. Ask us for a copy of the safeguards at hello@takeawaysnearme.ie.
15. How long we keep data
| Data | How long |
|---|---|
| Account (name, email, favourites, preferences) | Until you delete your account; deletion is immediate |
| Sign-in sessions (with IP address and browser) | A session lasts 7 days (renewed while you use the site); the record is deleted 30 days after it expires |
| One-time sign-in, sign-up and password codes (stored hashed) | Valid for 10 minutes and used once; deleted 30 days after they expire |
| Email verification links and older password-reset links | Valid for 24 hours (reset links 1 hour); deleted 30 days after they expire |
| Pending and approved claims | While the listing relationship lasts, or until you delete your account |
| Rejected claims | 12 months after the decision, then your name, email, phone and message are removed (the decision itself is kept) |
| Advertising enquiries | 12 months after the enquiry is closed |
| Booked ads and invoices | For the life of the booking, then as long as Irish tax law requires (usually 6 years) |
| Business contacts (CRM) | Reviewed after 24 months without activity and deleted unless still needed; deleted sooner on request |
| Restaurant statistics (daily totals, no personal data) | 25 months |
| Ad impression and click totals (no personal data) | For the life of the ad and its reporting |
| Server logs (contain IP addresses) | [log retention, e.g. 30 days] |
| Change history (audit log) | [audit log retention, e.g. 6 years] |
| Exclusion list for removed listings | Only the Google Place ID (not personal data), kept so the business is not re-added |
16. Your rights
| Your right | What it means |
|---|---|
| Access (Art. 15) | Get a copy of your data. Signed-in users can download it at Account → Profile → Data export. |
| Rectification (Art. 16) | Correct wrong or incomplete data. You can edit your name in your profile. |
| Erasure (Art. 17) | Have your data deleted. You can delete your account yourself at Account → Profile → Delete account. |
| Restriction (Art. 18) | Ask us to pause using your data, for example while you contest its accuracy. |
| Portability (Art. 20) | Receive data you gave us in a machine-readable file (the download above is JSON). |
| Objection (Art. 21) | Object to anything we do on the basis of legitimate interest, including the CRM and listings. We then stop unless we have compelling grounds. |
| Withdraw consent (Art. 7(3)) | Turn off news emails in your profile or via the unsubscribe link; change ad and cookie consent from the link in our Cookie Policy. |
For anything else, email hello@takeawaysnearme.ie with the subject “Data protection request”. It is free. We may ask you to confirm your identity, and we reply within one month (up to three months for complex requests, in which case we tell you within the first month).
17. Children
The site is for adults and businesses. Accounts are for people aged 16 or over (the digital age of consent in Ireland, Data Protection Act 2018, s. 31). If you think a child under 16 has given us data, email hello@takeawaysnearme.ie and we will delete it.
18. Security
- HTTPS everywhere; the sign-in cookie is HTTP-only, secure and same-site.
- Passwords and one-time codes are hashed; a password sign-in also needs an emailed code; sign-in, sign-up, code emails and password reset are rate-limited.
- Staff access is role-based, and staff changes are recorded in a change history.
- Contact details in the CRM are never shown in public pages or logs.
If a breach is likely to put your rights at risk we tell the DPC within 72 hours, and we tell you without undue delay if the risk is high.
19. Cookies
We set one first-party cookie for signing in, and Google's ad and consent tools set their own. The full list, and how to change your consent, is in our Cookie Policy.
20. Changes
We update this policy when our services or the law change and show the date at the top. If a change materially affects how we use your data we will say so on the site, and email account holders where appropriate.
21. Contact and complaints
Email hello@takeawaysnearme.ie, or write to [Legal entity name], [Registered office address]. If you are unhappy with our reply you can complain to the Data Protection Commission, or to the authority where you live or work in the EU:
- Online: dataprotection.ie contact form (complaints must be made in writing)
- Post: Data Protection Commission, 6 Pembroke Row, Dublin 2, D02 X963, Ireland
- Phone: (01) 765 01 00 or 1800 437 737