Small print · UK GDPR
Privacy notice
What this website keeps about you, why, on what lawful basis, for how long, who else handles it, and how to see it, change it or have it deleted. It was written from the code that runs the site, and it changes when that code does.
In force from 13 November 2026.
Who is responsible
The controller of everything on this page is the company that runs the stand.
- Controller
- MZ SOLUTIONS LTD
- Company number
- 17430729, registered in England and Wales
- Registered office
- 107 Coventry Street KIDDERMINSTER, DY10 2BH United Kingdom
- For anything on this page
- office@mzsolutions.buzz, subject “Privacy”. The address is on the company's own domain, which is being set up; until it is live, mail to it is not delivered, and the self-service routes below are the way to act on a request.
The short version
- Reading this site keeps nothing about you. There are no cookies, no analytics and no advertising.
- Only the stand request keeps what you type, with any dietary note you add to one of its days.
- A request is deleted 90 days after the last day it asks for, by itself. Cancelling it deletes your details at once.
- You can see everything you sent, change the days, clear a note or cancel, with the reference and your email, any time.
- Cloudflare hosts the site and stores the requests, as the company's processor.
What is kept, why, and for how long
Everything the site stores lives in one key-value store at Cloudflare. The names given under each heading are the ones the code uses, so this page can be checked against it.
A stand request
stored as ask:MZS-…, one per request
- What is in it
- The firm's name, your name, your email address, a phone number if you gave one, the site's postcode, what the pitch is surfaced with, whether there is power, how a trailer reaches the pitch, where the queue stands, anything else you wrote, the days asked for, your break bells and the planner's figures worked from them, and the times the request was sent and changed. If you add a dietary note to a day, that note too: the allergens to plan around, about how many people, and the words you wrote.
- Why
- To arrange the stand's visit to your site and run the day: to look at the pitch with you, confirm in writing, buy stock for your bells and plan around the dietary note.
- Lawful basis
- Legitimate interests (UK GDPR Article 6(1)(f)): you ask on behalf of your firm, and arranging what your firm asked for is the reason the form exists. If you ask as a sole trader or for yourself, it is a step taken at your request before a contract (Article 6(1)(b)).
- How long
- Deleted automatically 90 days after the last day it asks for; the deletion date moves if you change the days. Cancelling deletes your details at once.
A cancelled request
the same ask:MZS-…, emptied
- What is in it
- Only the reference, the time it was cancelled, and a one-way scrambled form of the email address (a SHA-256 hash) that cannot be turned back into the address.
- Why
- So that looking the reference up says “cancelled” instead of “no such request”.
- Lawful basis
- Legitimate interests.
- How long
- 30 days, then deleted automatically.
The diary of held days
stored as diary, one for the whole site
- What is in it
- Which days are held, and by which reference; how many new requests arrived each day, as a bare count; and, for each email address in its scrambled form (the first 12 characters of the same hash), which references stand and until when.
- Why
- There is one stand, so a day held for one site shows as held to the next. The counts keep the form to ten new requests a day and three standing requests per email address.
- Lawful basis
- Legitimate interests.
- How long
- A held day is taken out the first time the diary is updated after that day has passed; a day's count after a week; an email's entry once its request's own deletion date has passed.
The form-signing key
stored as stand-key
- What is in it
- A random secret that stamps each form with the time it was served, so a form sent faster than a person could fill it, or hours later, is asked for again. Nothing about any visitor.
- How long
- Kept while the site runs.
A pace count on your connection
held by Cloudflare's rate limiting, not in the store
- What is in it
- A scrambled form of your connection's IP address (20 characters of a SHA-256 hash), and for a look-up the request's reference, counted against a limit: three new requests a minute, twelve look-ups, changes or cancellations a minute.
- Why
- To stop the forms being flooded, which would stop them working for everybody.
- Lawful basis
- Legitimate interests: keeping the service secure and usable.
- How long
- A sixty-second window, then forgotten. The site never stores the IP address itself.
Cloudflare's own request history
for the pages the site's code answers: the booking pages and their forms
- What is in it
- The time, the address asked for (which can include a request's reference), the outcome, error messages, and technical details of the connection, which can include its IP address and rough location. Never the contents of a form.
- Why
- To find and fix faults.
- Lawful basis
- Legitimate interests.
- How long
- Three days, then deleted by Cloudflare.
Email to and from the office
in the company's mailbox, once its domain is live
- What is in it
- Whatever you write, and your address. Once mail is live, each new, changed or cancelled stand request also sends the office a copy of what the store holds for it.
- Why
- To answer you, and to work on a request away from the website.
- Lawful basis
- Legitimate interests, or steps towards a contract you asked about.
- How long
- A copy of a request no longer than the request itself. Other mail twelve months after its last message; a complaint twelve months after its final answer.
What is never asked for
Some things the stand has no use for, so the site has no box for them.
- Health information about any person. A dietary note is about a group: which allergens to plan around and about how many people, with no names and no medical details. Please write it that way.
- Payment details of any kind. Nothing is paid through this site.
- Anything from the serving planner: it works in your browser and sends nothing.
- Anything from the allergen sorting on the menu page, which also stays in your browser.
- Your location, beyond the site postcode you type.
- Who you are while you read: no accounts, no tracking, nothing sold or shared for marketing.
Who else handles it
Cloudflare, Inc.
- Hosts the website and runs its code
- Stores the requests and the diary
- Counts the pace on each connection
- Will deliver the office's email, once the domain is live
- Acts as the company's processor under its data processing addendum, which carries the safeguards UK law requires when data is handled outside the UK
Nobody else
- No analytics service, no advertising network, no social media buttons
- Fonts and pictures are served from this site, not fetched from anyone else's
- The company's mailbox provider will hold the office's email once mail is live
- Your details are not sold, and are shared only where the law requires it
Cookies, and anything else in your browser
This site sets no cookies and stores nothing in your browser's storage, so there is nothing to consent to and no banner asking you to. The page menu, the serving planner and the allergen sorting all run on the page you are looking at and forget everything when you leave it.
Your rights, and the quickest way to use each
The law makes them free to use. Requests by email are answered within one month.
See what is held
Look the request up with its reference and email: “What you sent” shows all of it. Or ask by email for everything held about you.
Correct it
Change the days on the request's page. For other details, write to the office with the reference, or cancel and send a new request.
Delete it
Cancel the request on its page: your details go at once. A dietary note can be cleared on its own.
Object, or restrict
You can object to any use based on legitimate interests, or ask for use to be paused while something is checked. Write to the office.
Take it with you
Where the basis is a step towards a contract, you can ask for what you gave in a plain, machine-readable form.
Complain
To the company first if you like, and in any case to the Information Commissioner's Office: ico.org.uk/make-a-complaint.
No decision about you is made by a machine. The form checks only that the days are free and that its boxes are filled in properly; a person decides whether the stand can come. When this notice changes, the date at the top changes with it.
Registered details
The registered office is a private address for post and filings. No food is cooked, sold or collected there.
- Registered name
- MZ SOLUTIONS LTD
- Company number
- 17430729
- D-U-N-S
- 235118560
- Registered in
- England and Wales
- Incorporated
- 1 September 2026
- Registered office
- 107 Coventry Street KIDDERMINSTER, DY10 2BH United Kingdom
- Activities (SIC)
- 56103 Take-away food shops and mobile food stands · 82990 Other business support service activities not elsewhere classified