Last updated: April 2026
1. Who We Are
The Student Food Project Limited (‘we’, ‘us’, ‘our’) is a company registered in England and Wales. We operate the website at www.thestudentfoodproject.com, run cooking workshops at universities and student events, and conduct research into student food habits across the UK.
ICO Registration Number: ZC064765
If you have any questions about this policy or how we handle your personal data, please contact us:
Email: hello@thestudentfoodproject.com
Website: www.thestudentfoodproject.com
2. What Personal Data We Collect
Website visitors
When you visit our website, we automatically collect:
IP address (anonymised) and approximate location
Browser type and version
Device type and operating system
Pages visited, time spent, and navigation patterns
Referral source (how you arrived at our site)
Cookie identifiers — see our Cookies Policy for full details
Email newsletter subscribers
When you sign up to our email newsletter — whether via our website or at a workshop event — we collect:
Your name
Your email address
Your university of study (optional)
Your consent record (date, time, and method of consent)
Where sign-up takes place at a workshop event (for example, via a form on a tablet), you will be asked to explicitly consent to our privacy policy at the point of sign-up.
Workshop attendees
When students attend one of our cooking workshops, we may collect personal data in the following circumstances:
If you sign up to our email newsletter at the event (see above)
If you enter a competition or prize draw at the event, in which case we collect your name, email address, and any other details required to administer the prize
If you provide feedback via a form, we may collect your responses alongside optional identifying information
Workshop attendees are individual members of the public. All data collected at events is processed in accordance with this policy and the lawful basis of consent, which is obtained explicitly at the point of data collection.
Institutional contacts (universities and Students’ Unions)
When a university, Students’ Union, or other institution enquires about or books a workshop, we collect data relating to the individual making the enquiry or booking on behalf of their organisation.
This typically includes:
Name and job title of the contact person
Institutional email address and telephone number
Institution name and relevant department
Correspondence and booking records
This processing takes place in a business-to-business context.
The lawful basis is legitimate interests or contract performance, and the ICO recognises that B2B contacts have a reduced expectation of privacy compared to individual consumers. We handle this data with the same care as all other personal data.
Prospective partner organisations (cold outreach)
As part of our business development activity, we contact universities, Students’ Unions, and other organisations that we believe may be interested in our workshops or research. To do this, we collect contact details of relevant individuals at those organisations, typically from publicly available sources such as institutional websites, professional directories, or LinkedIn.
This may include:
Name and job title
Institutional email address
Telephone number
Organisation name and department
This processing is carried out on the basis of legitimate interests. We have a legitimate interest in promoting our services to organisations that are likely to benefit from them, and we consider this to be balanced against the limited privacy impact on individuals acting in a professional capacity using work contact details.
Our email outreach to corporate and institutional addresses is conducted in accordance with the Privacy and Electronic Communications Regulations (PECR). Every outreach email clearly identifies us as the sender, includes our contact details, and gives the recipient a straightforward way to opt out of further contact. We honour all opt-out requests promptly.Where we conduct outreach by telephone, we call publicly listed numbers at organisations — such as enquiry lines or departmental contact numbers published on institutional websites — rather than private direct lines. We do not make automated or unsolicited calls to individuals.
If you have received a message from us and would prefer not to be contacted again, please reply to let us know or contact us at
hello@thestudentfoodproject.com. We will remove you from our outreach records immediately.
UK Student Food Survey
We are conducting the UK Student Food Survey , a UK-wide research study into student food habits, health, and wellbeing. If you participate in this survey, we collect:
Demographic information (such as year of study, subject area, accommodation type, financial situation, dietary requirements, whether you have dependants, and home or international student status)
Responses to questions about cooking skills and confidence
Responses to questions about eating habits and diet
Responses to questions about finances and food poverty
Responses to questions about health, wellbeing, and academic performance
Responses to questions about university support and what would help
Open-ended responses to qualitative questions
Survey responses are collected anonymously. We do not ask for your name or any directly identifying information as part of the survey itself, and responses cannot be linked back to individual participants.
At the end of the survey, you may optionally provide your email address if you would like to be notified when the findings are published. This is entirely voluntary. If you do so, your email address is stored separately from your survey responses and cannot be linked to them. This optional email capture is processed on the basis of your consent and will be used only to send you the published report.
Aggregated and anonymised findings from the survey will be published in a public report, made available freely at www.thestudentfoodproject.com, and may be shared with universities, Students’ Unions, the press, and other stakeholders. No individual’s responses will ever be identifiable in published findings.
3. Our Lawful Basis for Processing
UK GDPR requires us to have a lawful basis for processing your personal data. We rely on the following bases depending on the context:
Consent
Where you have given us clear, specific, and freely given consent — for example, by opting in to receive our email newsletter, signing up at a workshop event, entering a competition, or providing your email address at the end of the National Student Food Survey. You may withdraw consent at any time without affecting the lawfulness of prior processing.
Legitimate interests
Where processing is necessary for our legitimate business interests and does not override your rights. This includes website analytics to improve our content and services, maintaining records of institutional partnerships, and conducting and publishing research for the public benefit.
Contract performance
Where processing is necessary to fulfil a contract or take steps at your request before entering into one — for example, processing a workshop booking with a university.
Legal obligation
Where we are required to process data to comply with a legal obligation, such as employer obligations or tax purposes.
4. How and Why We Use Your Data
We use your personal data for the following purposes:
To send you the email newsletter and recipe content you have subscribed to — on the basis of consent
To send you occasional marketing communications about our workshops, events, and services — on the basis of consent
To monitor and improve our website, recipes, and services using analytics data — on the basis of legitimate interests
To respond to workshop enquiries and administer bookings — on the basis of contract performance or legitimate interests
To administer competitions and prize draws at workshop events — on the basis of consent
To conduct the UK Student Food Survey and publish anonymised research findings — on the basis of legitimate interests (for anonymous responses) and consent (for optional email sign-up at the end of the survey)
To notify survey participants of published findings where they have opted in — on the basis of consent
To contact universities, Students’ Unions, and other potential partner organisations about our workshops and services, using publicly available professional contact details — on the basis of legitimate interests, and in accordance with PECR
To maintain records of institutional partnerships — on the basis of legitimate interests
To comply with our legal and regulatory obligations
5. Sharing Your Data
Internal sharing
Your data is shared only within The Student Food Project team on a need-to-know basis.
Third-party processors
We use the following third-party services to operate our business. These act as data processors on our behalf and are contractually obligated to handle your data securely and in accordance with UK GDPR:
Attio (customer relationship management — used to store and manage contact records for prospective and current institutional partners) —
Privacy Policy
Webflow (website hosting and content management) —
Privacy Policy
Fillout (online forms, including workshop sign-up and the UK Student Food Survey) —
Privacy Policy
Google Workspace (email, documents, and internal communication) —
Privacy Policy
Google Analytics (website analytics) —
Privacy Policy
Font Awesome (icon fonts and web assets) —
Privacy Policy
We do not sell your personal data to any third party, and we do not share it for third-party marketing purposes.
Publication of research findings
Aggregated and anonymised findings from the UK Student Food Survey will be published publicly and may be shared with universities, Students’ Unions, the media, and other stakeholders. These findings cannot be used to identify any individual respondent.
International transfers
Some of our third-party processors are based in, or transfer data to, the United States or other countries outside the UK. Where this occurs, we ensure that appropriate safeguards are in place — typically the UK International Data Transfer Agreement (IDTA) or equivalent Standard Contractual Clauses — to protect your data to the same standard required under UK GDPR.
6. How Long We Keep Your Data
We retain personal data only for as long as necessary for the purposes described in this policy. Our specific retention periods are:
Email newsletter subscribers: retained until you unsubscribe. We retain active subscriber records for up to five years of inactivity — reflecting that students on longer courses and recent graduates may continue to find our content relevant — after which we will make contact to re-confirm subscription before removing the record. Unsubscribe records are retained indefinitely to prevent accidental re-addition.
Workshop event sign-ups and competition entries: retained for up to two years after the event, unless you have subscribed to our newsletter (in which case the newsletter retention period applies)
Website analytics data: retained indefinitely in anonymised and aggregated form. This data cannot be linked to any individual and therefore falls outside the scope of UK GDPR.
UK Student Food Survey responses: retained in anonymised, aggregated form indefinitely for research and benchmarking purposes. The optional email addresses collected at the end of the survey are retained for up to 12 months after the report is published, then deleted.
Prospective partner outreach records: retained for up to six years from the date of last contact, in line with our standard commercial retention period. Opt-out records (name, organisation, and the fact of the opt-out) are retained indefinitely to ensure we do not contact the same individual again.
Institutional contact records (universities and Students’ Unions that have become active partners): retained for up to six years after the end of the relevant business relationship, in line with standard commercial limitation periods
General email correspondence: retained for up to six years, in line with the standard commercial limitation period under the Limitation Act 1980
Where we no longer have a lawful basis to retain your data, we will securely delete or anonymise it.
7. Your Rights
Under UK GDPR, you have the following rights regarding your personal data:
Right of access — to request a copy of the personal data we hold about you
Right to rectification — to request correction of inaccurate or incomplete data
Right to erasure — to request deletion of your personal data in certain circumstances
Right to restriction — to request that we limit how we use your data in certain circumstances
Right to data portability — to receive your data in a structured, machine-readable format
Right to object — to object to processing based on legitimate interests, and to all direct marketing at any time
Rights related to automated decision-making — we do not carry out any solely automated decision-making or profiling that produces legal or similarly significant effects
Note: some of these rights apply differently depending on the lawful basis we rely on for a given processing activity. We will always explain this when you make a request.
To exercise any of these rights, please contact us at
hello@thestudentfoodproject.com. We will respond within one month. There is no charge for making a request.
8. Withdrawing Consent and Unsubscribing
Where we process your data on the basis of consent, you may withdraw that consent at any time. This will not affect the lawfulness of processing carried out before the withdrawal.
You can unsubscribe from our email newsletter at any time by clicking the unsubscribe link in any of our emails, or by contacting us directly. If you signed up at a workshop event and wish to be removed from any communications, please contact us and we will action this promptly.
9. Cookies
We use cookies and similar tracking technologies on our website. For full details of the cookies we use, your options, and how to manage your preferences, please see our
Cookies Policy.
Non-essential cookies — including analytics cookies — are only placed with your prior consent via our cookie banner.
10. Users Outside the UK
Our website, workshops, and research activities are based in the United Kingdom and are primarily directed at students and institutions within the UK. Our legal framework is UK GDPR, administered by the Information Commissioner’s Office (ICO), and this is the primary data protection regime that applies to our operations.
Whilst our website is accessible internationally, we do not specifically target users outside the UK. If you are based in the European Union or European Economic Area and access our services, please be aware that EU GDPR may also apply to you. The standards we apply are consistent with both UK and EU GDPR, and you may have the right to raise concerns with your local supervisory authority in addition to the ICO.
Users in other jurisdictions may have additional rights under local law. If you believe local data protection law applies to your use of our services and you wish to exercise any rights under it, please contact us and we will do our best to assist.
We do not meet the thresholds that would make US state privacy laws (such as the California Consumer Privacy Act) applicable to our operations.
11. Security
We take appropriate technical and organisational measures to protect your personal data against unauthorised access, loss, or destruction. These include encrypted data transmission (HTTPS), access controls, and use of reputable third-party infrastructure.Whilst we take reasonable steps to protect your data, no method of transmission over the internet is completely secure. If you believe your data has been compromised, please contact us immediately.
12. Right to Complain
If you have concerns about how we handle your personal data and are not satisfied with our response, you have the right to lodge a complaint with the UK’s supervisory authority:
Information Commissioner’s Office (ICO)
Website: www.ico.org.uk
Helpline: 0303 123 1113
We would appreciate the opportunity to address any concerns directly before you contact the ICO, so please reach out to us first.
13. Changes to This Policy
We may update this privacy policy from time to time — for example, if we change how we process data, introduce new services, or if new legal requirements apply. When we make significant changes, we will notify you by email (where we hold your contact details) and update the ‘Last updated’ date at the top of this page.We encourage you to review this policy periodically.
