Yum Cayman — Privacy Policy

Last updated: 2 June 2026

1. Who we are

This Privacy Policy applies to Yum Cayman, a school-meal ordering service provided by Mise en Place Ltd, trading as School Catering (“MEP”, “we”, “us”, “our”), a company registered in the Cayman Islands with registered office at c/o Panthera Corporate Services Limited, Suite 70702, 60 Nexus Way, Camana Bay, George Town, Grand Cayman KY1-9006, Cayman Islands.

We operate:

· the Yum Cayman mobile app for parents and guardians (iOS and Android),

· the Yum Cayman POS cashier app used at participating schools (iOS and Android),

· the website at yumcayman.ky.

We are the data controller for the personal information described in this policy.

If you have questions about this policy or how your information is handled, contact us at [email protected].

2. What this policy covers

This policy explains what personal information we collect when you use the Yum Cayman apps or website, why we collect it, who we share it with, and your rights over it.

It applies whether you are:

· a parent or guardian using the parent app to order meals for a child,

· a child whose information has been added by a parent or guardian,

· a cashier or member of school staff using the POS app, or

· a visitor to the yumcayman.ky website.

3. What information we collect

The information we collect depends on which part of the service you use.

3.1 About parents and guardians (account holders)

When you register and use the parent app, we collect:

· Your name and a display name (if different)

· Email address and phone number

· Home address (used for delivery instructions / account verification)

· Profile photo (optional)

· Login credentials — your password is stored only as a secure hash, never in plain text

· Notification preferences (whether you want low-balance alerts, order updates, and marketing messages)

· A push-notification identifier (a unique device token issued by Apple or

Google so we can send you notifications)

3.2 About your children

The parent app is designed for parents to order meals on behalf of their children. When you add a child to your account, we collect:

· Child’s name, date of birth, and gender

· A profile photo of the child (optional)

· School name, class, homeroom, and teacher

· Any health conditions, allergies, or dietary requirements you tell us

about, so that meals can be prepared and served safely

· A daily spending limit (optional, set by you)

· Additional parent/guardian contact details (mother’s and father’s

phone numbers and email addresses) — used so school staff can reach a parent quickly if needed

We collect information about children only because parents and guardians use our service to order meals for them. We do not market to children, we do not create accounts for children directly, and children do not interact with the app on their own.

3.3 Payment information

When you add money to your child’s meal wallet:

· Card payments are processed by Cayman Gateway, our payment processor.

· We do not store your full card number. The apps keep only a

masked version (the last four digits, used to help you recognise the card) and a secure token issued by Cayman Gateway that allows future payments without re-entering card details.

· We keep a record of wallet top-ups, orders, and refunds for accounting

purposes and so you can see your transaction history.

3.4 Technical and usage information

When you use the apps or website, we and our service providers collect standard technical information automatically:

· Device type, operating system version, and app version

· General app usage (which screens are opened, when the app launches, errors

the app encounters)

· IP address and approximate location (city/region only — not precise GPS)

3.5 Information collected through the POS app

The cashier app is used at participating schools by authorised staff to process orders and payments at the meal counter. It accesses the same information described above (about the parent account, the child, and the order) to complete the in-store transaction. Cashiers sign in with their own credentials and have access only to the schools they work at.

4. Children’s information

Because the service is centred on children, we treat children’s information with particular care.

· Parental consent is the legal basis for collecting information about a

child. By adding a child to your account, you confirm that you are the child’s parent or legal guardian and that you consent to us holding the information described in section 3.2 above.

· We collect only what is needed to order meals, serve them safely, and

keep an accurate record.

· **We do not advertise to children, do not profile children, and do not

share children’s information with third parties** beyond the schools that will be preparing their meals and the technology providers that run the service.

· You can update or remove a child’s information at any time from the

parent app.

5. Health information (allergies and conditions)

To allow schools to prepare meals safely, the parent app collects any health conditions, allergies, or dietary requirements parents enter for their children.

We recognise that health information is sensitive personal data under the Cayman Islands Data Protection Act 2017 and similar laws elsewhere. Accordingly:

· We collect it only with your consent, given when you fill in the

health information field for a child.

· We use it only for meal safety — making sure children are not served

food that would harm them.

· We share it only with the school that will be preparing meals for

your child, and with our payment processor and technology providers as needed to run the service. We do not share it for marketing or analytics.

· You can update or remove the health information field at any time

from the parent app.

6. How we use your information

We use the information we collect to:

Purpose	Information used
Operate your account and let you order meals for your children	All account, child, and order data
Process payments and keep accurate financial records	Payment and transaction data, account identifiers
Prepare and serve meals safely	Child’s school, class, allergies and dietary needs
Send order confirmations, low-balance alerts, and other essential service messages	Email, phone, push-notification token
Reach a parent quickly if needed during the school day	Parent contact details
Send marketing messages only with your consent	Email, marketing preferences
Improve the service and fix problems	Technical and usage information
Comply with our legal obligations	Whatever is necessary for the specific obligation

7. Legal basis for using your information

Under the Cayman Islands Data Protection Act 2017, we rely on the following legal bases:

· Consent — for children’s information (including health information)

and for marketing communications.

· Performance of a contract — for everything needed to run your

account, take orders, and process payments.

· Legitimate interests — for improving the service, preventing fraud,

and keeping the apps secure. We have considered your rights and freedoms before relying on this basis.

· Legal obligation — where we are required by law to keep certain

records (for example, financial records).

8. Payments

Card payments are handled by Cayman Gateway. When you add a card or top up a wallet:

· Your card details are sent directly to Cayman Gateway’s secure systems.

· We receive back only a masked version of the card number (the last few

digits) and a token that allows us to charge the card again in future with your authorisation.

· The full card number is never stored by our apps or by our servers.

Cayman Gateway has its own privacy practices for the data it processes.

9. Notifications

The apps can send you push notifications for things like:

· Order confirmations and updates

· Low wallet balance alerts (when you have enabled this)

· Account changes

· Occasional service updates

To send these we store a device push token issued by Apple’s Push Notification service (for iPhones) or Google’s Firebase Cloud Messaging (for Android phones).

You can turn off notifications at any time:

· In the parent app: Profile → Notification Preferences

· In your phone’s system settings: Settings → Notifications → Yum Cayman

We send marketing messages by email only if you have opted in, and you can opt out at any time using the unsubscribe link in the email or from within the app’s profile settings.

10. Who we share your information with

We share information only with the following categories of recipient, and only to the extent needed for them to provide their part of the service:

· The school your child attends — receives orders, special-meal

instructions, allergy and dietary information so the meal can be safely prepared and given to the right child.

· Cayman Gateway — our payment processor; receives card payment details

and transaction information.

· Google Cloud and Firebase (operated by Google LLC) — host the

backend servers and deliver push notifications. They process information on our behalf under contract.

· Brevo (formerly Sendinblue) — sends transactional and marketing emails

on our behalf.

· Our staff and contractors — to operate, maintain and support the

service, under confidentiality obligations.

We do not sell your personal information to anyone.

We will only share information with law enforcement, regulators, or other public bodies if we are legally required to or have a clear public-interest reason consistent with applicable law.

We do not name individual partner schools in this policy because the schools we cater for can change over time. The school referenced in your account is always the school your child currently attends.

11. Where your information is processed

Our service uses cloud infrastructure operated by Google, which means information may be processed in countries outside the Cayman Islands, including in the United States and the European Union.

Where information leaves the Cayman Islands, we rely on safeguards permitted under the Cayman Islands Data Protection Act 2017, such as contractual protections with our service providers, to ensure your information continues to be protected.

12. How long we keep your information

We keep your information for as long as your account is active, and for a reasonable period after you close your account so we can:

· meet our financial and accounting record-keeping obligations,

· handle any disputes or queries that arise after closing the account,

· comply with applicable law.

Specifically:

Information	Retention period
Active account and child information	While the account is active
Closed-account information	Up to 5 years after the account is closed
Transaction and payment records	At least 5 years to meet financial recordkeeping requirements
Marketing preferences and consent records	Until you withdraw consent, plus a record of when the consent was withdrawn
Technical logs and error records	Up to 90 days

When we no longer need information, we securely delete or anonymise it.

13. How we keep your information secure

We use a combination of organisational and technical measures to protect your information, including:

· All data is transmitted over encrypted (HTTPS / TLS) connections.

· Passwords are stored only as secure one-way hashes, never as plain text.

· Card numbers are never stored in our apps or servers; only masked

values and tokens issued by Cayman Gateway are kept.

· Access to live data is restricted to authorised staff and contractors

on a need-to-know basis.

· The infrastructure is hosted on Google Cloud, which provides

enterprise-grade physical and network security.

No system can be guaranteed completely secure. If we ever become aware of a breach that materially affects your information, we will notify you and the Cayman Islands Ombudsman as required by law.

14. Your rights

Under the Cayman Islands Data Protection Act 2017, you have the right to:

· Be informed about how we use your information (this policy is part of

meeting that right);

· Access the personal information we hold about you;

· Correct information that is inaccurate or out of date;

· Have your information erased in certain circumstances (for example,

when it is no longer necessary for the purposes it was collected);

· Restrict how we use your information in certain circumstances;

· Object to certain uses, including direct marketing;

· Receive a copy of the information you have given us in a portable

electronic format;

· Not be subject to automated decisions that have a legal or similarly

significant effect on you (we do not currently make any such decisions about you).

To exercise any of these rights, contact us at [email protected]. We will respond within the time limits required by law (typically 30 days).

We may need to verify your identity before acting on certain requests, to protect your information from being released to someone who is not you.

15. Deleting your account

You can request that your account be closed at any time by contacting us at [email protected]. After we close the account, we will retain only the information described in the Retention section above and only for the purposes described there.

Closing an account also removes the children’s profiles you added.

16. Cookies and the website

The website at yumcayman.ky uses a small number of cookies that are strictly necessary for the site to function (for example, to remember your language preference). We do not currently use advertising cookies or third-party tracking cookies on the website.

If we use website analytics in the future (for example, to understand how visitors find and use the site) we will update this section to describe what is collected and how to opt out.

17. Complaints

If you believe we have not handled your information properly, please contact us first at [email protected] so we have the chance to resolve the issue.

You also have the right to lodge a complaint with the Office of the Ombudsman of the Cayman Islands:

· Website: https://ombudsman.ky/

· Email: [email protected]

· Phone: +1 (345) 946-6283

18. Changes to this policy

We may update this policy from time to time, for example to reflect changes to the apps, our services, or applicable law. When we do, we will:

· Update the “Last updated” date at the top of the policy;

· Notify you within the app or by email if the changes are significant

enough to affect how your information is used.

Your continued use of the apps after a change takes effect means you accept the updated policy.

19. Contact us

If you have questions, requests, or complaints about this policy or about how we use your information:

· Email: [email protected]

· Post: Mise en Place Ltd T/A School Catering, c/o Panthera Corporate Services Limited, Suite 70702, 60 Nexus Way, Camana Bay, George Town, Grand Cayman KY1-9006, Cayman Islands

Privacy Policy