Privacy and Cookie Policy

Effective date: 21 September 2026

Version: 2.0. This policy replaces the version dated 16 June 2021.

1. About this policy

Marugame Udon is committed to protecting your privacy and handling your personal data properly, lawfully and transparently.

This policy explains what personal data we collect about you, why we collect it, what we do with it, who we share it with, how long we keep it and what rights you have over it.

It applies to personal data we collect through our restaurants, our website at marugame.co.uk, the Marugame Club app, our online ordering, our guest Wi-Fi, our CCTV systems, and any contact you have with us by telephone, email, post or social media.

This document also explains how we use cookies and similar technologies. There is no separate cookies policy. Cookies are covered in section 21.

Please read this policy alongside any other privacy notice we give you at the point we collect your personal data, which may add further detail.

2. Who we are

Marugame Udon is the trading name of Karali MU Limited.

• Registered company name: Karali MU Limited
• Company number: 12716679
• Registered office: Avon House, Arden Road, London, W13 8RP
• ICO registration number: ZB017621
• Email: konnichiwa@marugame.co.uk

Karali MU Limited changed its registered company name from Marugame Udon (Europe) Limited on 1 April 2025. It is the same legal entity, with the same company number. That change does not affect any of the rights you have over your personal data.

Karali MU Limited is part of the Karali group of companies. Our parent company is Karali Group Limited, company number 09319530, registered at the same address. Where this policy refers to “companies in our group”, it means Karali Group Limited and its subsidiaries.

We do not share your personal data with Toridoll Holdings Corporation or with any company in the Toridoll group in Japan.

3. The controller of your personal data

Karali MU Limited is the controller of the personal data described in this policy. That means we decide why and how your personal data is used, and we are legally responsible for it.

We process your personal data in accordance with the UK General Data Protection Regulation (UK GDPR), the Data Protection Act 2018 and the Privacy and Electronic Communications Regulations 2003.

If you have any question about this policy, or you want to exercise any of your rights, contact us at konnichiwa@marugame.co.uk or write to us at the address in section 24.

4. The personal data we collect and how we use it

We collect and use personal data about four groups of people. Each section below sets out what we collect, how we collect it, the lawful basis we rely on, how you can withdraw consent where consent applies, and what we use the data for.

• Customers, including Marugame Club members – sections 5 and 6
• Business contacts and suppliers – section 7
• Job applicants – section 8
• Visitors to our website and app – section 9

5. Customers

5.1 What personal data we collect from our customers

• Your name
• Your email address
• Your mobile telephone number
• Your postal address and postcode
• Your date of birth
• Your gender, where you choose to give it to us
• Your marketing and communication preferences
• Your order and transaction history, including the items you bought, basket value, date, time and restaurant
• Your visit frequency and spend
• Your guest Wi-Fi login details and device identifiers
• Gift card purchase and redemption records
• Feedback, survey responses and reviews you give us
• Dietary requirements and allergen information you choose to tell us about
• Records of your enquiries and complaints, and our correspondence with you
• CCTV images, as described in section 13

Allergen, dietary and health information is special category personal data, which the law protects more strictly. We only collect it where you choose to give it to us so that we can serve you safely. We rely on your explicit consent, and on the substantial public interest in health and safety.

We do not collect or store your full payment card number. Card payments are handled by our payment provider, as described in section 15.

5.2 How we collect our customers’ personal data

• When you order in one of our restaurants, at a kiosk or at the till
• When you order online or through the Marugame Club app
• When you join Marugame Club
• When you buy or redeem a gift card
• When you connect to our guest Wi-Fi
• When you sign up to receive our emails or text messages
• When you enter a competition or take part in a survey
• When you contact us by email, telephone, post or social media
• When you leave a review
• Automatically, through cookies and similar technologies when you use our website or app, as described in section 21

5.3 Legal basis for processing our customers’ personal data

We rely on the following lawful bases.

• Performance of a contract – to take and fulfil your order, take payment, operate your Marugame Club membership and administer gift cards.
• Our legitimate interests – to operate and improve our restaurants, understand what our customers want, keep our records accurate, protect our business and our people, and market to existing customers about similar products and services.
• Your consent – for email and text message marketing, for non-essential cookies, and for any dietary, allergen or health information you give us.
• Compliance with a legal obligation – to meet our tax, accounting, food safety, health and safety and other legal duties.
• Your vital interests or those of another person – in an emergency where someone’s life is at risk, for example a serious allergic reaction.

5.4 Basis on which we process your data and your right to withdraw consent

Where we rely on your consent, you can withdraw it at any time. You can:

• Click the unsubscribe link in any marketing email
• Reply STOP to any marketing text message
• Change your preferences in the Marugame Club app
• Email us at konnichiwa@marugame.co.uk

We will act on your request within one month, and usually much sooner. Withdrawing your consent does not affect the lawfulness of anything we did with your personal data before you withdrew it.

5.5 What we use our customers’ personal data for

• Taking and fulfilling your order, and taking payment
• Operating Marugame Club, calculating your rewards and issuing your offers
• Administering gift cards
• Answering your enquiries and handling any complaint
• Serving you safely where you have told us about an allergy or dietary requirement
• Sending you marketing where you have asked for it, or where you are an existing customer and have not opted out
• Personalising the offers and content we send you, as described in section 11
• Asking for your feedback and running customer surveys
• Analysing sales, footfall and customer behaviour so we can improve our menu, our restaurants and our service
• Keeping accounting and tax records
• Protecting our customers, our people and our property
• Establishing, exercising or defending legal claims

6. Marugame Club

Marugame Club is our loyalty programme. It runs on the Trifft platform.

When you join, we collect the personal data listed in section 5.1 and link it to your membership. We use it to record your visits and spend, calculate and issue your rewards, and send you offers relevant to how you use our restaurants.

You must be 16 or over to join Marugame Club.

We use your date of birth to confirm you are old enough to join and to send you a birthday reward. Giving us your gender is optional, and we use it only in aggregate reporting to understand our customer base as a whole. We do not use your gender to decide what marketing you receive.

You can leave Marugame Club at any time through the app or by emailing konnichiwa@marugame.co.uk. When you leave, we close your account and delete your membership data, other than the transaction records we are required to keep for tax and accounting purposes and the minimum record we need in order to honour a marketing opt-out.

If your Marugame Club account is inactive for 24 months, we will close and delete it.

6.1 Our move to new systems in September 2026

In September 2026 we moved our customer database to Klaviyo and our loyalty programme to Trifft. The marketing consent that customers had already given us was carried across to the new systems.

Anyone who had not given us valid consent was removed in a data cleanse completed on 17 September 2026. Those records were permanently deleted rather than retained, so we no longer hold any personal data about the people affected.

7. Business contacts and suppliers

7.1 What personal data we collect from our business contacts

• Name and job title
• Business email address and business telephone number
• Business address
• The name of the organisation you work for
• Records of our correspondence and dealings with you
• Payment and bank details, where you or your organisation supply goods or services to us
• Marketing and communication preferences

7.2 How we collect it

We collect this personal data directly from you by telephone, email, post, through our website or in person, and from the organisation you work for. We may also collect it from publicly available sources such as Companies House, a company website or LinkedIn.

7.3 Legal basis for processing

• Performance of a contract – where you are an individual supplier or contractor, to manage our agreement with you.
• Our legitimate interests – to manage our supplier and business relationships, keep accurate records, and communicate with the organisations we work with.
• Compliance with a legal obligation – for tax, accounting, food safety, anti-bribery and other legal duties.

7.4 Basis on which we process your data and your right to withdraw consent

We do not send consumer marketing to business contacts. Where we send you business communications and you no longer want to receive them, email konnichiwa@marugame.co.uk or use the unsubscribe instructions in the communication.

7.5 What we use it for

• Managing our relationship with you and your organisation
• Placing orders, receiving goods and services and paying invoices
• Meeting our legal, tax and food safety obligations
• Keeping accurate business records
• Establishing, exercising or defending legal claims

8. Job applicants

8.1 What personal data we collect from job applicants

• Name, title, address, telephone number and personal email address
• Date of birth
• Your CV and covering letter
• Employment history, qualifications and skills
• Notes and assessments from interviews and telephone screening
• References
• Right to work documentation, including passport or visa details
• Publicly available professional information, for example a LinkedIn profile

8.2 Special category data

During recruitment we may also process special category personal data, which the law protects more strictly:

• Information about a disability or health condition, so that we can make reasonable adjustments to our recruitment process and to the role
• Race or ethnicity, religious belief and sexual orientation, where you choose to give it, for equal opportunities monitoring only – this is anonymised and is never seen by the people making the hiring decision
• Information about criminal convictions, where the role requires it and only after we have made a conditional offer

8.3 How we collect it

We collect this personal data directly from you when you apply. We may also receive it from recruitment agencies, job boards, referees you have named, and publicly available sources.

8.4 Legal basis for processing

• Our legitimate interests – to assess your suitability for the role and make a recruitment decision.
• Taking steps at your request before entering into a contract – to progress your application.
• Compliance with a legal obligation – to check your right to work in the UK and meet our employment law duties.
• Your consent – for equal opportunities monitoring, and to keep your details on file for future roles.
• Substantial public interest – for equal opportunities monitoring and for making reasonable adjustments.

8.5 Basis on which we process your data and your right to withdraw consent

Where we rely on your consent, you can withdraw it at any time by emailing konnichiwa@marugame.co.uk. Withdrawing consent to be kept on file for future roles will not affect an application you have already made.

8.6 What we use it for

• Assessing your skills, experience and suitability for the role
• Verifying the information you have given us and taking up references
• Checking your right to work in the UK
• Communicating with you about your application
• Making reasonable adjustments to our recruitment process
• Equal opportunities monitoring, in anonymised form
• Keeping a record of our recruitment decisions so we can show our process was fair
• Establishing, exercising or defending legal claims

8.7 Automated decision-making

We do not make recruitment decisions by automated means alone. Every application is reviewed by a person.

8.8 How long we keep job applicant data

If your application is not successful, we keep your personal data for six months from the date of our decision, so that we can show our recruitment process was fair and non-discriminatory. With your consent we may keep it for 12 months so that we can contact you about future roles. If you join us, your data moves into your employee file and is kept in line with our employee privacy notice.

9. Visitors to our website and app

9.1 What personal data we collect from visitors

• Information you give us through online forms, including your name, email address, telephone number, postcode and date of birth
• Your order and basket information when you order online
• Your marketing and communication preferences
• Technical data, including your IP address, browser type and version, device type, operating system, time zone setting and approximate location
• Usage data, including the pages you visit, how long you spend on them, what you click on, how you scroll, how you arrived at our site and any download errors
• Session recordings of how you interact with our website, as described in section 21

9.2 How we collect it

We collect some of this personal data directly from you when you complete a form, order online, sign up to our emails, enter a competition, take part in a survey or apply for a job. We collect the rest automatically through cookies and similar technologies, as described in section 21.

9.3 Legal basis for processing

• Your consent – for all non-essential cookies and similar technologies, including analytics, session recording and advertising.
• Our legitimate interests – to keep our website secure and working properly, and to understand and improve how people use it.
• Performance of a contract – to process an order you place online.
• Compliance with a legal obligation – where the law requires it.

9.4 Basis on which we process your data and your right to withdraw consent

You can change or withdraw your cookie consent at any time using the cookie preferences link on our website. See section 21.

9.5 What we use it for

• Operating our website and app and keeping them secure
• Processing orders placed online
• Measuring how our website is used so we can improve it
• Measuring the performance of our marketing and advertising
• Showing you relevant advertising on other websites and social media platforms, where you have consented
• Responding to messages you send us

9.6 Links to other websites

Our website contains links to other websites, including our social media pages and our delivery partners. We are not responsible for how those websites handle your personal data. We encourage you to read their privacy policies.

10. Marketing to you

We send marketing by email and by text message. Both are run through Klaviyo.

We will only send you marketing where:

• You have given us your consent, for example by signing up to our emails, joining Marugame Club or entering a competition; or
• You have bought from us before, we are marketing similar products and services, and you were given a clear opportunity to opt out when we collected your details and in every message since.

Every marketing email contains an unsubscribe link. You can stop text messages by replying STOP. You can also change your preferences in the Marugame Club app or email konnichiwa@marugame.co.uk at any time.

We use tracking technology in our marketing emails to see whether a message has been opened and which links have been clicked. We use that information to make our communications more relevant and to remove people who are no longer interested.

If you unsubscribe, we add your email address or mobile number to a suppression list. We keep that record for as long as necessary so that we do not contact you again by mistake. Honouring your opt-out is the only reason we keep it, we hold nothing else alongside it, and we do not use it for any other purpose.

We do not sell your personal data, and we do not share it with other companies for their own marketing.

11. Personalisation and segmentation

We group our customers into segments based on how often they visit, how much they spend, what they order and the answers they give us in surveys. We use those segments to decide which offers and content to send. Under data protection law this is a form of profiling, so we want to be clear about what we do and do not do.

What we do:

• We use your visit frequency, spend, order history and survey responses to decide which marketing you receive and which offers we show you.

What we do not do:

• We do not use your gender or your age to decide what marketing you receive.
• We do not infer sensitive characteristics about you, such as your health, religion, ethnicity or political opinions.
• We do not make any decision about you by automated means alone that produces a legal effect or similarly significantly affects you.
• We do not sell your personal data or share it with other companies for their own marketing.

We rely on our legitimate interests for this personalisation. You have the right to object at any time, and we will stop. Email konnichiwa@marugame.co.uk. You can also opt out of marketing altogether at any time, as described in section 10.

12. Guest Wi-Fi

We offer free guest Wi-Fi in our restaurants. It is provided for us by Spotipo, through Speedster.

[TO CONFIRM BEFORE PUBLISHING: Spelling and legal name of the Wi-Fi platform and supplier, to be confirmed by the operations team.]

When you connect, we collect your email address, your device identifier and a log of your connection, including the time, duration and volume of data used. We use this to give you access, to keep the network secure and available, and to prevent misuse.

If you choose to opt in when you connect, we will also add you to our marketing list. You can opt out at any time, as described in section 10. You do not have to opt in to marketing in order to use the Wi-Fi.

We rely on our legitimate interests to provide and secure the network, and on your consent for marketing. Connection logs are kept for three months.

13. CCTV

We operate CCTV inside and outside our restaurants, including entrances, seating areas, tills, back-of-house areas and delivery bays. Cameras are clearly signposted wherever they operate.

We use CCTV to protect our customers and our people, to prevent and detect crime, to support insurance and legal claims, and to help us meet our health and safety duties. We rely on our legitimate interests, and on our legal obligations where footage is required by law.

Access to CCTV footage is restricted to senior management and, where necessary, disclosed to the police, our insurers or our legal advisers. Footage is normally kept for around 30 days and then automatically overwritten, unless it relates to a live incident, an insurance claim, a legal claim or a police request, in which case we keep it for as long as it is needed.

We operate CCTV in line with the Information Commissioner’s Office guidance on video surveillance. We do not use facial recognition, and we do not use CCTV to monitor individual customers.

14. If you do not provide the personal data we request

Where we need your personal data in order to perform a contract with you, or because the law requires it, and you do not provide it, we may not be able to fulfil your order, operate your Marugame Club membership, honour a gift card or progress your job application. We will tell you if that is the case at the time.

15. Sharing your personal data with others

We share your personal data with the following organisations, which act as our service providers. Each one is bound by a written contract that requires it to keep your data secure and to use it only for the services it provides to us.

We may also share your personal data with:

• Other companies in our group, where they need it to support the services we provide to you
• Our professional advisers, including our lawyers, accountants, auditors, insurers and bankers
• HM Revenue and Customs, regulators, local authorities, environmental health officers and other authorities, where we are required to report to them
• The police and other law enforcement agencies, where we are required to disclose information or where it is necessary to prevent or detect crime

If we sell or transfer any part of our business, or if we receive investment, we may disclose your personal data to the prospective buyer or investor and their advisers. If that sale or transfer completes, the new owner may use your personal data in the same way as set out in this policy. If our business becomes insolvent, your personal data may be transferred to a successor in interest.

We do not sell your personal data. We do not disclose it to any other third party unless the law requires it or you have asked us to.

16. Transferring your personal data outside the United Kingdom

We store your personal data in the United Kingdom and the European Economic Area wherever we can. Transfers from the UK to the EEA are covered by the UK’s adequacy regulations, which means your data continues to receive an equivalent standard of protection.

Some of the service providers listed in section 15 are based outside the UK and the EEA, principally in the United States. Where your personal data is transferred outside the UK, we make sure that at least one of the following safeguards applies:

• The country the data is transferred to is covered by UK adequacy regulations, meaning the UK Government has decided it provides an equivalent standard of protection; or
• The recipient is certified under the UK Extension to the EU-US Data Privacy Framework; or
• We have a contract in place with the recipient using the International Data Transfer Agreement, or the UK Addendum to the European Commission’s Standard Contractual Clauses, together with any additional safeguards required.

You can ask us for more detail about the safeguards that apply to a particular transfer, and for a copy of the relevant contract, by emailing konnichiwa@marugame.co.uk.

[TO CONFIRM BEFORE PUBLISHING: Confirm which transfer mechanism is recorded in the signed data processing agreements with Klaviyo and with Toast, and whether each holds a current UK Extension to the EU-US Data Privacy Framework certification.]

We do not transfer personal data to Toridoll Holdings Corporation or to any company in the Toridoll group in Japan.

17. Data security

We have put appropriate technical and organisational measures in place to protect your personal data against accidental loss and against unauthorised access, use, alteration or disclosure. These include access controls, encryption, secure hosting, network security and regular review of our systems and suppliers.

Access to your personal data is limited to those of our employees, agents, contractors and service providers who have a business need to know. They only process it on our instructions and are under a duty of confidentiality.

We do not store full payment card numbers. Card payments are handled directly by Worldpay under the Payment Card Industry Data Security Standard.

We have procedures in place to deal with any suspected personal data breach. We will notify the Information Commissioner’s Office, and you, where we are legally required to do so.

18. How long we keep your personal data

We keep your personal data only for as long as we need it for the purposes we collected it for, including to meet any legal, accounting or reporting requirement. Our standard retention periods are set out below.

In some circumstances we will anonymise your personal data so that it can no longer be linked to you. Once anonymised, it is no longer personal data and we may keep and use it indefinitely for research and statistical purposes.

19. Your rights

Under data protection law you have the following rights.

• The right to be informed about how we use your personal data, which is what this policy is for.
• The right of access, meaning you can ask for a copy of the personal data we hold about you.
• The right to rectification, meaning you can ask us to correct personal data that is inaccurate or incomplete.
• The right to erasure, meaning you can ask us to delete your personal data where there is no good reason for us to keep using it.
• The right to object to processing where we rely on our legitimate interests, including the right to object to direct marketing at any time.
• The right to restrict processing, meaning you can ask us to suspend the use of your personal data in certain circumstances.
• The right to data portability, meaning you can ask us to transfer your personal data to you or to another organisation in a structured, commonly used, machine-readable format.
• The right to withdraw consent at any time where we rely on your consent. This does not affect the lawfulness of anything we did before you withdrew it.
• The right not to be subject to a decision based solely on automated processing that produces a legal effect or similarly significantly affects you. We do not make decisions of this kind.

To exercise any of these rights, email konnichiwa@marugame.co.uk or write to us at the address in section 24.

You will not have to pay a fee. If your request is clearly unfounded, repetitive or excessive, we may charge a reasonable fee or refuse to act on it, and we will explain why.

We may need to ask you for information to confirm your identity before we act. This is a security measure to make sure your personal data is not disclosed to anyone who has no right to it.

We will respond within one month. If your request is complex, or you have made a number of requests, it may take us longer. We will tell you within one month if that is the case and keep you updated.

20. Complaints

If you are unhappy with how we have handled your personal data or responded to a request, please tell us first at konnichiwa@marugame.co.uk. We would like the opportunity to put it right.

You also have the right to complain to the Information Commissioner’s Office, the UK supervisory authority for data protection.

• Website: ico.org.uk
• Helpline: 0303 123 1113
• Address: Information Commissioner’s Office, Wycliffe House, Water Lane, Wilmslow, Cheshire, SK9 5AF

21. Cookies and similar technologies

A cookie is a small text file that a website places on your device when you visit it. Cookies let a website work properly, remember your preferences, and give the website owner information about how the site is used. We also use similar technologies, including pixels, tags, local storage and software development kits in our app.

21.1 Your cookie choices

We use CookieYes to manage cookie consent on our website. When you first visit, you will see a banner asking which categories of cookies you are willing to accept.

Only strictly necessary cookies are set automatically. We will not set any analytics, functional or advertising cookie until you have given your consent. Continuing to browse our website is not treated as consent.

You can change or withdraw your choices at any time using the cookie preferences link on our website. You can also block or delete cookies through your browser settings, although parts of our website may stop working properly if you do.

21.2 The cookies we use

[TO CONFIRM BEFORE PUBLISHING: Screen Pilot to populate the individual cookie names, their providers and their durations from the current CookieYes scan, and to confirm whether any further advertising or analytics tags are live on the site.]

21.3 Session recording

We use Microsoft Clarity to understand how people use our website. Clarity records mouse movement, scrolling and clicks, and creates a replay of your visit. This helps us find parts of the site that are confusing or broken.

Clarity is configured to mask the text you type into forms, so we do not see the content of anything you enter. Microsoft also uses this data for its own purposes as set out in the Microsoft Privacy Statement.

Clarity only runs if you accept analytics cookies, and you can withdraw that consent at any time.

21.4 Advertising on social media

We use advertising tools provided by Google and Meta to measure our advertising and to show ads to people who have visited our website or who resemble our existing customers. These tools may share a version of your email address or device identifier with the platform in a hashed, unreadable form so that it can be matched to an account.

We only do this where you have accepted advertising cookies. You can also control the advertising you see through the settings in your Google and Meta accounts.

22. Children

Our website, our app and Marugame Club are not directed at children. You must be 16 or over to join Marugame Club, to sign up to our marketing or to connect to our guest Wi-Fi with your own details.

We do not knowingly collect personal data from anyone under 16 for marketing purposes. If you believe we hold personal data about a child, contact us at konnichiwa@marugame.co.uk and we will delete it.

We do of course serve families in our restaurants, and children may appear on CCTV in the same way as any other visitor.

23. Changes to this policy

We may update this policy from time to time to reflect changes in the law, in our business or in the systems we use. The date at the top of this policy tells you when it was last updated. We encourage you to check back from time to time.

If we make a significant change, we will tell you directly by email or through a notice on our website.

23.1 What changed in this version

This version replaces the policy dated 16 June 2021. The main changes are:

• Our registered company name changed from Marugame Udon (Europe) Limited to Karali MU Limited on 1 April 2025, and our registered office and group structure have been updated. Karali Group Limited is our parent company.
• We have moved our customer database and our email and text message marketing to Klaviyo.
• We have moved Marugame Club to the Trifft platform.
• We have added a section explaining how we personalise and segment our marketing.
• We have published clear retention periods for every category of personal data.
• We have added sections covering business contacts and suppliers, job applicants, and guest Wi-Fi.
• We have updated our cookies information, and cookies are now covered in this policy rather than in a separate document.
• We have updated our international transfer safeguards to reflect current UK law.
• We have removed the section on NHS Test and Trace contact tracing, which no longer applies.

24. How to contact us

If you have any question about this policy, or you want to exercise any of your rights, please contact us.

• Email: konnichiwa@marugame.co.uk
• Post: Data Protection, Karali MU Limited, Avon House, Arden Road, London, W13 8RP

Karali MU Limited is registered with the Information Commissioner’s Office under registration number ZB017621.