This Privacy Policy explains how [Fruité / responsible operator's name] ("we", "us", "Fruité") processes personal data in connection with the Fruité website and its associated Discord community and Roblox experience (together, the "Service"). It is provided in accordance with the UK General Data Protection Regulation ("UK GDPR") and the Data Protection Act 2018.
1. Who we are
Fruité is a community-run Roblox group and is not a registered company. We do not maintain a registered office or postal address. You can reach us at:
- Email: [privacy@yourdomain.example]
- Discord: [link to your Discord server]
If a Data Protection Officer is appointed, their contact details should be added here; if not, this sentence can be removed and enquiries handled through the contact above.
2. What personal data we process
We process the following categories of personal data, depending on how you use the Service:
- Discord account data: your Discord user ID, username, avatar, and server roles, obtained when you sign in with Discord.
- Roblox account data: your Roblox user ID and username, resolved from your linked Discord account via a third-party verification service, used to associate reservations and other activity with your Roblox identity.
- Reservation details: the date, time, party size, seating preference and occasion you provide when booking a table.
- Moderation records: warnings, bans, notes and related case information where applicable to your account, and any appeal you submit in relation to such a record.
- Feedback and support messages: the content of any feedback you voluntarily submit.
- Privacy request records: details of any data access, deletion or rectification request you submit to us.
- Technical data: IP address, device and browser information, and session/authentication cookies, collected automatically by our hosting infrastructure for security and reliability purposes.
3. Purposes and legal basis for processing
We process personal data for the following purposes, relying on the legal bases indicated:
- Providing the Service (account authentication, reservations, quiz recommendations, appeals) — Art. 6(1)(b) UK GDPR, performance of a contract or steps taken at your request prior to entering into one.
- Community safety and moderation (issuing and enforcing warnings/bans, reviewing appeals) — Art. 6(1)(f) UK GDPR, our legitimate interest in maintaining a safe community, balanced against your rights and freedoms.
- Responding to feedback and privacy requests — Art. 6(1)(b) and, where applicable, Art. 6(1)(c) UK GDPR (compliance with our legal obligations under Art. 12–22 UK GDPR).
- Security and abuse prevention (technical/log data) — Art. 6(1)(f) UK GDPR, our legitimate interest in operating a secure and reliable Service.
We do not use your personal data for advertising, and we do not sell personal data to third parties.
4. Recipients of personal data
Personal data is disclosed only to the following categories of recipients, each acting as our processor or as an independent controller of their own platform:
- Discord Inc. — as the identity provider for sign-in and for delivering notifications to you via direct message.
- Roblox Corporation / our in-game identity verification provider — to resolve and display your linked Roblox identity.
- Our cloud hosting, application and database providers — who store and process data on our behalf under data processing agreements, and may process data outside the United Kingdom (see Section 5).
We do not otherwise share personal data with third parties except where required by law.
5. International data transfers
Some of our processors may process personal data outside the United Kingdom, including in the United States. Where this occurs, we rely on appropriate safeguards recognised under UK data protection law, in particular the UK International Data Transfer Agreement (IDTA), the UK Addendum to the European Commission's Standard Contractual Clauses, or a finding that the destination country benefits from UK adequacy regulations. You may request further information about these safeguards by contacting us using the details in Section 1.
6. Retention
We retain personal data only for as long as necessary for the purposes described in this policy. Resolved moderation records and reservations are retained for a limited period to support appeals and service continuity, after which they are deleted or anonymised. Active moderation actions (a current warning or ban) are retained for as long as they remain in effect. You may request earlier deletion at any time — see Section 8.
7. Cookies and similar technologies
We use only strictly necessary cookies required to keep you signed in and to remember your display theme preference. We do not use advertising, analytics or third-party tracking cookies. Strictly necessary cookies are exempt from the consent requirement under the Privacy and Electronic Communications Regulations 2003 (PECR), so no cookie banner is shown; you can nonetheless block cookies through your browser settings, though doing so will prevent you from signing in.
8. Your rights
Under the UK GDPR, you have the right to:
- Access the personal data we hold about you (Art. 15 UK GDPR);
- Rectify inaccurate or incomplete personal data (Art. 16 UK GDPR);
- Erase your personal data in certain circumstances (Art. 17 UK GDPR);
- Restrict processing in certain circumstances (Art. 18 UK GDPR);
- Data portability, i.e. to receive your data in a structured, machine-readable format (Art. 20 UK GDPR);
- Object to processing carried out on the basis of legitimate interest (Art. 21 UK GDPR); and
- Withdraw consent at any time, where processing is based on consent, without affecting the lawfulness of processing before withdrawal.
You can exercise the rights to access, erasure and rectification directly through our self-service privacy request tool. For any other request, contact us using the details in Section 1. We will respond within one month, as required by Art. 12(3) UK GDPR.
Erasure requests are subject to the limited exceptions in Art. 17(3) UK GDPR — in particular, we may retain the minimum data necessary where required to establish, exercise or defend legal claims, or where an active moderation action is still in effect, in which case identifying details are removed rather than the record as a whole.
9. Right to lodge a complaint
You have the right to lodge a complaint with the UK's independent supervisory authority, the Information Commissioner's Office (ICO), at ico.org.uk, or by calling their helpline. We would, however, appreciate the chance to address your concerns directly first — please contact us using the details in Section 1.
10. Automated decision-making
Our "Find My Juice" quiz recommends a menu item based on the answers you choose. This is a simple content suggestion and does not produce legal effects concerning you or similarly significantly affect you, and therefore does not constitute automated decision-making within the meaning of Art. 22 UK GDPR.
11. Children's privacy
The Service is not directed at individuals below the minimum age permitted by Discord's own Terms of Service to hold a Discord account. We do not knowingly collect personal data from children below that age. If you believe a child has provided us with personal data, please contact us so we can take appropriate action.
12. Security
We apply appropriate technical and organisational measures to protect personal data against unauthorised access, loss, or misuse, including encrypted connections, access controls limiting personal data to authorised staff, and regular review of third-party processors.
13. Changes to this policy
We may update this Privacy Policy from time to time to reflect changes to the Service or applicable law. The "Last updated" date above indicates when this policy was last revised. Material changes will be announced on our Updates page.
14. Contact
For any question about this policy or your personal data, contact us at [privacy@yourdomain.example], or submit a request directly through our privacy request tool.