A company registered in Scotland with company number SC527065
Please note:
Our Guest Service team will respond to enquiries and complaints Monday - Friday 9 am-5 pm and are closed on public holidays.
Last updated: 19 June 2026.
This privacy policy explains how we use, collect, and protect your personal data in compliance with the UK General Data Protection Regulation (“UKGDPR”).
We ask that you read this privacy policy carefully as it contains important information on who we are, how and why we collect, store, use and share personal information, your rights in relation to your personal information and on how to contact us and supervisory authorities in the event you have a complaint.
This website is operated by GDK International Limited. We collect, use and are responsible for certain personal information about you. For the purposes of data protection legislation, the controller of any personal information collected through this website is GDK International Limited (company number SC551701), 5 Redwood Place, Glasgow, Scotland, G74 5PB (GDK). With regard to information received from third parties, GDK International Limited is the processor of your data.
If you have any questions about our privacy policy, you may raise them with our data protection officer by contacting dpo@gdk.com. You may also visit the the Information Commissioner’s Office to learn more about your rights as a data subject. Their website is at https://ico.org.uk/.
This privacy policy relates to your use of our website, www.gdk.com only. Throughout our website we may link to other websites owned and operated by certain trusted third parties to promote GDK's worldwide franchise opportunities (including www.franchisedirect.com, www.franarabia.com or any other international franchise recruitment or broker websites GDK deems relevant for such purposes). These other third party websites may also gather information about you in accordance with their own separate privacy policies. For privacy information relating to these other third party websites, please consult their privacy policies as appropriate.
This website is not intended for children under the age of 16, and we do not knowingly collect or use personal information about children.
We may collect personal information about you, which is categorised together as follows:
Personal data we collect | Where does this personal data come from? |
Identity data (such as name, date of birth, marital status, etc) | i) Application forms you submit to us; ii) Contact with us via our website, email, phone or post or similar, including registration for services, submission of feedback, enquiries and other interactions with us via our website or app; iii) When you complete a non-disclosure agreement with us; iv) When your information is passed to us by a franchisee broker, recruiter, or intermediary. |
Contact data (such as your address, email address, telephone numbers) | i) When you make an order with us via our website or app; ii) When you request marketing from us or register for any other services via our website or app; iii) When you Contact Us with a general enquiry, compliment, or complaint, via our website or app; iv) When you submit an application form to us; v) When your information is passed to us by a franchisee broker, recruiter, or intermediary. |
Financial and Transaction Data (such as bank and payment details, business and financial details) | i) When you complete an order with us on our website or app; ii) When your information is passed to us by a franchisee broker, recruiter, or intermediary. |
Technical and Usage data (such as IP address, browser type and version, location, operating system details etc). | i) When you use our website or app. We collect this information by using cookies and similar technologies. Our Cookie Policy gives further details. |
Marketing data (such as your selected marketing preferences in relation to communications from us and selected third party partners). | i) When you sign up to receive our newsletter though our website or app. ii) In the newsletter form you provide us with your email and tick two checkboxes, one confirming that you have read our privacy policy, and one that you give us consent to process your data. |
Other general personal types of data (including language proficiencies, information relating to other skills and work experience etc). | i) When you submit an application form to us; ii) When your information is passed to us by a franchisee broker, recruiter, or intermediary. |
We only use your personal data where we are allowed to do so legally. We rely on certain lawful bases for this. The most common bases we rely on are:
i) Where we need to process your personal information in order to fulfil the contract we have, or are about to, enter into with you;
ii) Where it is in the legitimate interests of ourselves, or a third party, that the processing takes place and your data rights do not override these legitimate interests;
iii) Where we need to comply with a legal or regulatory obligation;
iv) We may also rely on consent, where we seek your agreement that you would like to receive marketing material from us.
We use your personal information to:
Purpose of processing | Data type(s) | Lawful basis for processing |
Register as a customer | Identity, contact | Contract. Without this information we would not be able to register you as a customer. |
Process and deliver orders | Identity, contact, financial and transaction data. | Contract. Without this information, we would not be able to fulfil your orders. |
Contact you about worldwide franchise opportunities | Identity data, contact data | Contract. Without this information, we would not be able to respond to your request to learn more about entering into a franchisee agreement with us. |
Assess your suitability to become a GDK franchisee | Identity data, general personal data | Contract. Without this information, we would not be able to proceed through the process through which you may become a franchisee with us. |
Customise our website/app and its content to your preferences | Identity data, contact data, marketing data, technical data | Legitimate Interest. Without this data, we would not be able to offer you the best experience on our website/app. |
Notify you of changes to website or services which may affect you | Identity data. contact data, technical data | Consent. We would seek, with your permission, to keep you informed of changes to your favourite services. |
Retain records of correspondence | Identity data, contact data | Legitimate Interest. Without retaining such data, we would not be able to deal with complaints, nor be in a position to resolve such matters at a later date. |
Administer website including internal operations such as troubleshooting, data analysis, surveys etc. | Identity data, contact data, marketing data, technical and usage data. | Legitimate Interest. Without such data, we would not be able to ensure that the website always behaves as our customers expect it to, nor to understand how to give you the best experience on our site/app. |
We will only use the data collected for the purposes we have specified above, unless we reasonably consider we need to use if for another purpose which is compatible with the original purpose. If there is any change in purpose, we will inform you both of the purpose and the legal basis upon which such processing will take place. There may be instances where we process your personal data without your knowledge or consent, if this is legally required.
We would like to send you information about GDK franchise opportunities or other brands owned by our parent company, Hero Brands Limited, or associated group companies, which may be of interest to you. Where we have your consent, we may do this by e-shot, personal email or the appropriate website/app. We would also like to share your information with other companies within the group in order to promote other group owned franchise opportunities to you. We will only ask whether you would like us and our group companies to send you marketing messages when you tick the relevant boxes when you submit an application or make an enquiry. Click here . to see what this form looks like. If you have previously agreed to being contacted in this way, you can opt-out of receiving further marketing materials at any time by:
We share your data within the GDK group and with selected third parties to provide certain services to you. These selected third parties are:
· Google
· Meta
· Reputation.com
· Mailjet and Mailchimp
· CND networks (jsDelivr, CloudFront)
· Pepper
· Uber Direct
· Global Payments
When doing so, we ensure that your data is transferred only to jurisdictions with equivalent data protection standards in place, affording your data a similar level of protection. The above mentioned parties operate in jurisdictions such as the USA, European Union, and Canada, Sweden or India.
Further, some limited technical data, such as IP addresses, may pass between the systems of GDK's establishments in the UK, USA (http://www.gdkusa.com/), Sweden (www.gdksweden.se), Canada (http://www.gdkcanada.com/), United Arab Emirates and Saudi Arabia, where you navigate between our main website and local websites operated by GDK.
In other cases, we may specify in an agreement with third parties with whom we share your data that they must have in place data protection safeguards which meet the standards in the UK. Such agreement is known as the International Data Transfer Agreement ("IDTA").
Some providers are also certified confirming they meet such standards and we will always seek reassurance on this score.
You can set your browser to reject any cookies which are not strictly necessary. Please note that if you do choose to reject certain cookies, this may mean that you will not be able to use some website components. Please see our Cookie Policy for more information relating to cookies used on the website.
We will only retain your data for as long as it is needed for the purpose it was collected for. However, we may have to retain some types of data (such as transactional records) for up to 5 years for regulatory reasons. We may also retain your data for longer if you have made a complaint, including if there is a reasonable prospect of legal proceedings resulting from our relationship with you.
Below please see how long your information is retained in particular use cases. Note that most data is shared with third parties in order to fulfil the purposes for which it was collected. Further information on third parties we share your data with appears in the relevant section immediately below this table.
System | Purpose | Data Type | Retention |
Reputation.com | Forms, enquiries | Name, email, message content | Kept for 1 year by default, though exact retention period is determined by your activity on the website/app. |
Mailchimp / Mailjet | Email marketing | Email, subscription status | Data retained until you unsubscribe from marketing or we manually delete it. |
Pepper | Online ordering | Name, delivery detains, order information | Retained in platform dashboard as long as necessary to fulfil the purposes outlined. |
Global Payments | Payment processing | Transaction metadata | Data is retained for as long as is required by financial regulators. |
Uber Direct | Delivery fulfilment | Adress, contact information | Uber standard retention of 3 months for delivery data. |
Meta/Facebook | Marketing | Pseudonymised identifiers | 3 months. |
Ads & Analytics | Aggregated user activity | This depends on the cookie, and can vary between 24 hours and two years. |
We may share your personal data with third parties in order to carry out the purposes laid out above. In these cases, we will be the controller of your data.
Some of the types of third parties we may share with include:
i) Group companies (e.g., Hero Brands)
ii) Facebook (via tracking)
iii) Email platforms (Mailchimp, Mailjet)
iv) Google
v) Reputation.com
vi) Payment processors (Global Payment)
vii) Ordering platforms (Pepper)
viii) Delivery partner (Uber Direct)
ix) Sanity.io
x) CloudImage;
xi) Government bodies, such as HMRC, who may require data from us for financial and regulatory purposes;
xii) Legal and regulatory professional partners, who may be required to advise us in relation to data protection or other matters.
We may also require to share your data with a third party where any part of our business is being acquired by another company. In such a case, the new owner(s) may use your personal data for similar purposes.
All third parties are obligated to use your personal data in accordance with the law and only for the purpose of carrying out services for us.
We will receive personal data about you from various third parties, where we will act as the processor of your data. Some of these include:
· Franchise brokers;
· Third-party recruitment platforms (e.g., fanchisedirect.com);
· API data from Pepper.
Note that generally there will be no fee attached to your exercise of any of the rights below, unless your request is complex or the related information has to be delivered to you in an usual manner. We may require proof of identity to verify that the individual making the request is entitled to copies of any personal data.
Right of access
You are entitled to access any data we hold about you. To do so, you should make a Subject Access Request to us. Where you do so, we will seek to acknowledge your request within three working days, and to fulfil it within one month. More complex requests make take longer than this, but we will keep you informed should we need more time.
To make a subject access request, you may contact our Data Protection Officer at dpo@gdk.com.
Should you be unhappy with our handling of a request that you make, you may make a complaint to us, which we will consider in line with the Data Protection Complaints Policy and Procedure laid down at the end of this policy.
Right to correction
Should you be of the view that we hold inaccurate or incomplete information about you, then you may ask us to correct this. In such a case, you can contact our Data Protection Officer at dpo@gdk.com, to ask for this and we will update things, pending checks on the veracity of any new data that you send us. Where you do so, we will seek to acknowledge your request within three working days, and to fulfil it within one month. More complex requests make take longer than this, but we will keep you informed should we need more time.
Right to erasure
You may request that we erase data in cases where you believe that there is no good reason why we retain it. In such a case, you can contact our Data Protection Officer at dpo@gdk.com, to ask for this. We will consider whether there is any legal, regulatory or other reason blocking fulfilment of your request and inform you of our decision and any actions to be taken. Where you do so, we will seek to acknowledge your request within three working days, and to fulfil it within one month. More complex requests make take longer than this, but we will keep you informed should we need more time.
Right to object
You may object to the processing of your data where this is based on our legitimate interests to carry it out, if you feel it damages your data rights and freedoms. In such a case, you can contact our Data Protection Officer at dpo@gdk.com, to ask for this. We will consider your request, although we may reject it if we believe there are compelling legitimate grounds that the processing should continue and that these prevail over your rights and freedoms. Where you make such an objection, we will seek to acknowledge your request within three working days, and to fulfil it within one month. More complex requests make take longer than this, but we will keep you informed should we need more time.
Right to request processing restriction
You may make a request that we restrict processing where you do not want us to erase your data but you would like us suspend processing and ascertain that the data held is accurate, or because you await our decision on a request to object to processing of your data. In such a case, you can contact our Data Protection Officer at dpo@gdk.com, to ask for this. Where you do so, we will seek to acknowledge your request within three working days, and to fulfil it within one month. More complex requests make take longer than this, but we will keep you informed should we need more time.
Right to request data transfer
You can request that we transfer your personal data to a third party. Where you make such a request, we will provide the data in a commonly-used format. This right holds true for cases in which processing took place where you consented to it, or where it was undertaken in order to fulfil a contract with you. It does not apply in other circumstances. To make such a request, you can contact our Data Protection Officer at dpo@gdk.com, to ask for this. Where you do so, we will seek to acknowledge your request within three working days, and to fulfil it within one month. More complex requests make take longer than this, but we will keep you informed should we need more time.
Right to withdraw consent
You can withdraw any consent previously given at any time of your choosing. We will take steps to ensure that processing founded on such grounds no longer takes place and that you do not receive any further marketing materials from us, unless you give us fresh consent at a later date.
GDK International understands that there are occasions when things may go wrong, and that you may feel that we have not addressed a data protection concern appropriately or that you may feel that you have not enjoyed the full exercise of your rights and freedoms under the UK General Data Protection Regulation (“UK GDPR”) or General Data Protection Regulation (“GDPR”).
We take your data protection concerns seriously and, accordingly, have in place a process for dealing with complaints about this.
How to make a data protection complaint
Should you have a complaint about the way we have handled any aspect of data protection, or feel that we have infringed data protection laws, you can make a complaint to our Data Protection Officer at dpo@herobrands.com.
This is the best way to ensure your complaint reaches the appropriate person in a timely manner. Where other members of our team receive a complaint about data protection matters via some other mechanism, they will nonetheless pass this along as appropriate.
When we respond to a data subject access request, or other exercise of data rights, we will include details of how to complain to us within the response.
Complaints via social media
As noted above, we would ask that complaints be made to the Data Protection Officer. However, should you raise a data protection complaint via social media, the person who receives it will ask for a more secure means by which you can be contacted to address the complaint. This is because, per Information Commissioner’s Office (ICO) guidance, social media is not a secure means by which to do so.
Our pledge on data protection complaints
We will acknowledge receipt of your complaint within 30 days of receiving it. For this purpose, the 30-day period begins on the day after we receive the complaint. If the final day falls on a weekend or public holiday, we will acknowledge it by the next working day
Where we will be able to respond to your complaint within thirty (30) days, we will simply do so rather than sending both an acknowledgement and then a final response.
We will take appropriate action to respond to your complaint, including any required investigation, and keep you informed during this process, particularly if there ae any undue delays in responding to the complaint.
We will inform you of the outcome of your complaint without undue delay.
Types of data protection complaint we can deal with
We can deal with any complaint that relates to data protection legislation and requirements, but some examples include:
Cases which we will not consider to be a data protection complaint
Should you be complaining about some other aspect of GDK International’s service, for instance a transaction or general communication with customer service personnel and seek to exercise your data rights in the process, we will not treat this as a data protection complaint.
What this means is that we will not treat, for example, a data subject access request which is made alongside a more general complaint as a data protection complaint.
Should you wish to make a data protection complaint, please let us know and give us details of your complaint so that we can begin addressing in as quickly as possible.
Where we are unsure about your intent, we may ask you to clarify whether you are making a data protection complaint.
Mixed complaints
Sometimes a complaint may include both data protection issues and wider customer service, account, transaction, gambling, or operational issues. Where this happens, we will identify and handle the data protection element under this procedure. If we can provide an outcome on the data protection element sooner than the wider complaint, we will do so unless there is a justified reason not to.
Proving your identity and making a complaint on behalf of another person
On occasion, your complaint may relate to a situation where we have not met your expectations due to uncertainty on our behalf that addressing your initial effort to exercise your data rights could result in sharing personal data with a person who should not have it.
In such cases, though we will also ask for this at the time of your initial request in any case, we may request proof of identity if this is what it will take for us to be sure we would not be committing such a breach in satisfying your complaint.
If you make a request on behalf of another person, we will again have to satisfy ourselves that you have the authority to do this. Ordinarily, we will ask for such proof at the time your initial query or request. However, there may be occasions upon which the person making the data protection complaint differs from the person who made initial contact with the request or query. In such cases, we will ask you to prove that you have authority to deal with the complaint ion behalf of the data subject before we fulfil the request.
Investigating your complaint
We may ask you to confirm what your complaint relates to if we are unsure.
We will consider any material held internally and any previous actions in relation to the matter you are raising, and will begin investigating it as soon as we become aware of it.
The amount of time it takes us to issue a final response to your complaint will depend on how complex it is and how much investigation is involved, but we will respond without any undue delay.
Informing you of the outcome of your complaint
We will let you know the outcome of your complaint and, in doing so, explain the steps we have taken to resolve it. If we take any actions following on from the investigation, we will inform you of these at the same time.
Where we believe that we have complied with data protection legislation, we will explain to you how we have arrived at that conclusion.
If you are still unhappy
Should you remain dissatisfied following our investigation, as always you have the right to complain to the Information Commissioner’s Office, who can be contacted at https://ico.org.uk/make-a-complaint/.
