How would you like to order today?

Delivery & Pick up now available

ORDER NOW

EUROPEAN PRIVACY NOTICE

Last modified: June 10, 2025


This European Privacy Notice supplements the information contained in our Privacy Policy and applies to:

1)         any processing of personal data by Kentucky Fried Chicken (Great Britain) Limited, KFC France SAS, KFC Europe Sàrl, KFC Restaurants Spain S.L., Yum! Restaurants International Ltd & Co. KG (trading as KFC Germany), Clokken Limited, Clokken Ireland Limited, Yum III (UK) Limited (trading as Pizza Hut Delivery), PH Yum! France SAS (trading as Pizza Hut France), Pizza Hut Europe Limited (trading as Pizza Hut Europe), PH Yum! Germany GmbH (trading as Pizza Hut Germany), Taco Bell UK and Europe Limited, Live Mas UK Ltd, and/or any of Yum! Brands’ other affiliates with an establishment in the European Economic Area (“EEA”), the United Kingdom (“UK”) or Switzerland (all of which are controllers of personal data covered by this European Privacy Notice);

 

2)         any processing of personal data relating to individuals that are located in the EEA, the UK, or Switzerland ("you"); and

 

3)         the Sites and the Service available in the EEA, the UK or Switzerland that link to this European Privacy Notice.

Unless otherwise expressly stated, all terms have the same meaning as defined in our Privacy Policy.  The entities listed above are independent controllers of your personal data under our Privacy Policy and this European Privacy Notice. For more information on the controllers’ place of business and contact details, please see the “Controller Details” section below. 

Franchisees. Please note that a large number of KFC, Pizza Hut and Taco Bell brand restaurants, websites, mobile apps and/or services are owned and operated by independent franchisees in many EEA, UK and Swiss locations. Each franchisee is an independent business owner and a separate controller of your personal data. As a result, each franchisee is responsible for providing its customers with its own form of privacy notice. Please consult your local franchisee for their relevant privacy notice.

Legal basis for processing. In the EEA, the UK and Switzerland, the relevant legal bases for which we process your personal data are as follows:

1)         Where the provision of personal data by you is necessary for the performance of any contractual relationship we have with you, or to allow us to take steps at your request prior to entering into a contractual relationship with you;

 

2)         Where the processing of your personal data is necessary for compliance with our legal obligations in accordance with applicable laws in the EEA, the UK and/or Switzerland;

 

3)         Where the processing of your personal data is in our legitimate interests or the legitimate interests of other entities in our group of companies (provided these are not overridden by your interests and fundamental rights and freedoms). In particular, our legitimate interests include:

 

a.         contacting you and responding to your requests and enquiries;

 

b.        carrying out business administration, including statistical analysis;

 

c.         providing the Service and the Sites to you;

 

d.        carrying out reviews, surveys, analysis, and analytics in order to improve our Service and our Sites and restaurants;

 

e.         carrying out fraud prevention and detection activities; and

 

f.           compliance with applicable laws, regulations, or codes of practices.

 

4)         Where we process your personal data on the basis of your freely given, specific, informed and unambiguous consent, including where you provide consent to the receipt of marketing communications.

Please see the table at the Annex below for a detailed list of the categories of personal data we collect about you when you use our Sites and our Service, the purposes for which we use that personal data, and also the lawful bases which we rely on to process each category of personal data.

Data Collection. We typically collect personal data from you directly. However, in some instances data will be collected indirectly, such as when you submit orders to our franchisees, share or submit posts about our Brands on social media, make orders with food delivery service apps / providers, or engage with our partners in joint marketing endeavours or campaigns.

Data storage and transfer outside the EEA, the UK and Switzerland. If you are located in the EEA, the UK or Switzerland, the personal data about you that we collect through our Sites and Service will be stored and processed primarily in the EEA, the UK or Switzerland. If we transfer any personal data outside of the EEA, the UK or Switzerland, we will ensure that:

1)         the personal data is transferred to countries that are formally recognised as offering an adequate level of protection; or

 

2)         the personal data is transferred to participants of frameworks that are formally recognised as offering an adequate level of protection (e.g., the EU-US Data Privacy Framework); or

 

3)         the transfer is made pursuant to appropriate safeguards, such as: (i) the EU Standard Contractual Clauses adopted by the European Commission; or (ii) the UK International Data Transfer Addendum to the EU Standard Contractual Clauses adopted by the UK Information Commissioner’s Office.

Should you wish to request information about or a copy of these safeguards, please let us know using the contact details below.

Notwithstanding these measures, the country and jurisdiction to which data is transferred may provide for a lower standard of data protection than under the laws of the EEA, the UK or Switzerland. 

Data subject rights of individuals in the EEA, the UK and Switzerland. If you are located in the EEA, the UK, or Switzerland, you have the following data subject rights in relation to the personal data we hold about you: 

 

1)         Right to object. You have the right to object to any processing of your personal data based on our legitimate interests where there are grounds relating to your particular situation. You have the right to object to marketing activities for any reason.

 

2)         Right of access. You have the right to obtain access to your personal data.

 

3)         Right to rectification. You have the right to obtain the rectification of your personal data without undue delay where such personal data is inaccurate or incomplete and it requires to be updated.

 

4)         Right to erasure. You have the right to obtain the erasure of your personal data without undue delay in certain circumstances, for example where the personal data is no longer necessary for the purposes for which it was collected or processed.

 

5)         Right to restriction. You have the right to obtain the restriction of the processing we carry out on your personal data in certain circumstances (for example, where you contest the accuracy of the personal data) for a period of time allowing us to verify the accuracy of that personal data.

 

6)         Right to data portability. You have the right to data portability – this right allows you to easily move, copy, or transfer personal data from one organization to another.

 

7)         Right to withdraw consent. You have the right to withdraw your consent to the processing of your personal data at any time in those cases where we rely on your consent as the lawful basis for processing your personal data. Please note that the withdrawal of your consent will not affect the validity or lawfulness of any processing of your personal data that took place before the withdrawal of your consent. 

 

If you wish to exercise any of these rights, please click on the following links: (i) for KFC, please click here globalprivacy@yum.com; (ii) for Pizza Hut, please click here globalprivacy@yum.com; or (iii) for Taco Bell, please click here.

 

Alternatively, you can also exercise any of these rights by contacting us directly at the following email address: globalprivacy@yum.com.

 

You also have the right to lodge a complaint with your local data protection authority. For individuals located in the EEA, further information on how to contact your local data protection authority can be found at: https://www.edpb.europa.eu/about-edpb/about-edpb/members_en. 

 

For individuals located in the UK, the relevant local data protection authority is the UK Information Commissioner’s Office (“ICO”). Further information on how to contact the ICO can be found at: https://ico.org.uk/for-the-public/. 

 

For individuals located in Switzerland, the relevant local data protection authority is the Swiss Federal Data Protection and Information Commissioner (“FDPIC”). Further information on how to contact the FDPIC can be found at: https://www.edoeb.admin.ch/edoeb/en/home/deredoeb/kontakt.html.

Retention. To determine the appropriate retention period for personal data, we consider the amount, nature and sensitivity of the personal data, the potential risk of harm from unauthorised use or disclosure of your personal data, the purposes for which we process your personal data and whether we can achieve those purposes through other means, and the applicable legal, regulatory, tax, accounting or other requirements.

Cookies. For detailed information on the cookies and tracking technologies we use on our Sites and how you can exercise your choices regarding the use of cookies and tracking technologies, please see our Cookie Policy at https://pizzahut.de/en/Cookie&Ad-Policy

DPO. If you wish to contact our Data Protection Officer, please contact them at: globalprivacy@yum.com.

Contact email address. If you have any questions for us about our Privacy Policy or this European Privacy Notice, or if you have any comments, complaints or questions about how we use or process personal data, please contact us at: globalprivacy@yum.com.

CONTROLLER DETAILS

Controllers. Please see below the names and addresses of relevant KFC, Pizza Hut, and Taco Bell entities that each act as independent controllers under this European Privacy Notice:

·       Pizza Hut UK

Yum III (UK) Limited (trading as Pizza Hut Delivery), having its address at Part Ground Floor Great Suffolk Yard, 129-131 Great Suffolk Street, London, United Kingdom, SE1 1PP.

 

·       Pizza Hut France

PH Yum! France SAS (trading as Pizza Hut France), having its address at 102 Terrasse Boieldieu 92800 Puteaux, France.

 

·       Pizza Hut Germany

PH Yum! Germany GmbH (trading as Pizza Hut Germany), having its address at c/o Blitzstart Services GmbH, Maximiliansplatz 17, 80333 Munich, Germany.

 

·       Pizza Hut Europe

Pizza Hut Europe Limited (trading as Pizza Hut Europe), having its address at Part Ground Floor Great Suffolk Yard, 129-131 Great Suffolk Street, London, United Kingdom, SE1 1PP.

 

·       Taco Bell UK and Europe

Taco Bell UK and Europe Limited, having its address at Orion Gate, Guildford Road, Woking, Surrey, United Kingdom, GU22 7NJ.

 

Operator of some individual Taco Bell stores in the UK: Live Mas UK Ltd, having its address at Orion Gate, Guildford Road, Woking, Surrey, United Kingdom, GU22 7NJ.

 

·       KFC UK and Ireland

Kentucky Fried Chicken (Great Britain) Limited, having its address at Orion Gate, Guildford Road, Woking, Surrey, United Kingdom, GU22 7NJ.

 

Operator of some individual KFC stores in the UK: Clokken Limited, having its address at Orion Gate, Guildford Road, Woking, Surrey, United Kingdom, GU22 7NJ.

 

Operator of some individual KFC stores in Ireland: Clokken Ireland Limited, having its address at 70 Sir John Rogerson's Quay, Dublin 2, Dublin, Ireland, D02 R296.

 

·       KFC France

KFC France SAS, having its address at Tour W 102 Terrasse Boieldieu 92800 Puteaux, France.

 

·       KFC Germany

Yum! Restaurants International Ltd & Co. KG (trading as KFC Germany), having its address at Homberger Str. 25, 40882 Ratingen, Germany.

 

·       KFC Western Europe and KFC Central & Eastern Europe

KFC Europe Sàrl, having its address at Avenue de Rhodanie 40 C, 1007 Lausanne, Switzerland.

 

·       KFC Spain

KFC Restaurants Spain S.L., having its address at C. de Serrano Galvache, 56, Cdad. Lineal, 28033 Madrid, Spain.


ANNEX

Category of personal data

How we use it – Purpose for processing

Legal basis for processing

Profile information including your name, phone number, postal address, email address, gender, age, date of birth, and profile picture.

We use this information to set up, authenticate, and administer your account on the Service, including your account for any loyalty program.

The processing is necessary for the performance of a contract with you, and to take steps prior to entering into a contract with you.

We use this information to communicate with you, including sending you service-related communications or transactional communications.

The processing is necessary for the performance of a contract with you.

We use this information to send you marketing communications in accordance with your preferences.

 

We will only use your personal data in this way: (i) where you have given us your consent to do so; or (ii) where the processing is necessary to serve our legitimate interests, namely engaging in direct marketing to customers who have not opted-out of the receipt of marketing communications about our similar products and services.

We use this information to deal with queries, questions, requests, or complaints submitted by or about you relating to the Service.

 

The processing is necessary to serve our legitimate interests, namely administering the Service, and for communicating with you effectively to respond to your queries, questions, requests, or complaints.

When you participate in a contest or sweepstakes, we use this information in order to authenticate your participation in accordance with the terms and conditions of the contest or sweepstakes, and to arrange or facilitate the delivery of any awards or prizes that you may win as a result of your participation.

The processing is necessary for the performance of a contract with you, and to take steps prior to entering into a contract with you.

Payment and transaction information, including the time, date, and value of transactions.

We use this information to facilitate transactions and provide you with the Service.

 

The processing is necessary for the performance of a contract with you.

We use this information to provide customer service and support.

 

The processing is necessary for the performance of a contract with you.

We use this information to detect and prevent fraud.

 

The processing is necessary to serve our legitimate interests, namely the detection and prevention of fraud.

Location data

We use limited GPS technology to determine your current location in order to provide you with relevant content for your location, including details of your closest stores.

 

The processing is necessary to serve our legitimate interests, namely administering the Service.

 

We will only use your personal data in this way to the extent that you have given us your consent to do so.

CCTV image data

When you visit any store that we operate, your image may be recorded by CCTV cameras that we maintain on site. We deploy CCTV cameras at our stores as a tool to help ensure the safety of our customers and employees and to protect our property.

The processing is necessary for our legitimate interests, namely ensuring the safety of our customers and employees and protecting our property.

 

Your comments, chats, and opinions, including details of any feedback, reviews, complaints, requests, questions, survey responses, and/or any other communications that you send to us or vendors acting on our behalf.

When you contact us directly (e.g., by email, phone, post, by completing an online form or by participating in an online chat or an online survey managed by us or our vendors), we record your comments, chats, opinions, questions, requests, complaints, and/or any other communications that you send to us or vendors acting on our behalf.

The processing is necessary to serve our legitimate interests, namely to respond to your questions, requests, comments and complaints, to evaluate and improve our products and services, and to inform our marketing and advertising activities.

 

Information received from social networks. If you interact with the Service through a social network, we receive information from the social network such as your name, profile information, and any other information that you permit the social network to share with third parties. The data we receive is dependent on your privacy settings with the social network.

We use this information to authenticate you and allow you to access the Service.

 

The processing is necessary for the performance of a contract with you.

We use this information to tailor the way that the Service is presented to you (such as the language in which it is presented to you).

The processing is necessary to serve our legitimate interests, namely tailoring the Service so that it is more relevant to our users.

Information about customers received from our franchisees.

 

We use customer data obtained from our franchisees to allow us to carry out customer experience surveys and to conduct research, analysis and data analytics in order to better understand our customers and to develop and improve our Service, Sites, products, restaurants, and the overall customer experience.

 

The processing is necessary to serve our legitimate interests, namely to better understand our customers, and to develop and improve our Service, Sites, products, restaurants, and the overall customer experience.

We use this information to send you marketing communications, advertisements and personalised content in accordance with your preferences.

We will only use your personal data in this way to the extent that you have given us your consent to do so.

Marketing information received from third-party partners with whom we work on joint promotional activities.

We use this information to send you marketing communications in accordance with your preferences.

We will only use your personal data in this way to the extent that you have given us your consent to do so.

Usage information, such as how long you use our products, your results when you use our products, any problems or issues you encounter while using our products, and any other information generated by the products about how you use them.

We use this information to analyse the performance of the Service, to fix or troubleshoot any problems with the Service, to improve the Service, and to develop new products and services.

The processing is necessary to serve our legitimate interests, namely improving our products and services, dealing with any problems related to our products and services, and developing new products and services.

 

We use this information to develop new products and features available through the Service, or to otherwise improve the Service.

 

The processing is necessary to serve our legitimate interests, namely ensuring our business and Service is constantly evolving to meet the evolving needs of our customers.

All personal data set out above.

We use any personal data we collect to operate, maintain, manage, and provide you with the features and functionality of the Service, to communicate with you, to monitor and improve the Service and business, and to develop new products and services.

The processing is necessary to serve our legitimate interests, namely to administer and improve the Service to help our business grow and remain competitive.

We share any personal data we collect with our affiliates within the Yum! Brands corporate group (including but not limited to affiliates that operate any of our Brands, namely KFC, Pizza Hut, Taco Bell, and Habit Burger & Grill) to enable us and our affiliates to perform analysis and carry out data analytics in relation to aggregated cross-brand data about our customers and their use of, and engagement with, our products and services. Such analysis will enable us and our affiliates to monitor and improve the Service and business across the Yum! Brands corporate group, to evaluate and improve our products and services, to develop new products and services, and to inform and improve our marketing and advertising activities. 

The processing is necessary to serve our legitimate interests, namely to carry out analysis and data analytics in respect of customer data in order to monitor and improve the Service and business across the Yum! Brands corporate group, to evaluate and improve our products and services, to develop new products and services, and to inform our marketing and advertising activities.

We use this information to comply with lawful requests by public authorities (including, without limitation, to meet national security or law enforcement requirements), discovery requests, or where otherwise required or permitted by applicable laws, court orders, government regulations, or regulatory authorities (including, without limitation, regulatory authorities with responsibility for data protection, tax and/or employment), whether within or outside your country.

This processing is necessary for compliance with legal obligations to which we are subject where there is a legal obligation in place to disclose information or where there is a court or other legal order to provide information.

Where not legally required, processing is necessary for the purpose of our legitimate interests, namely maintaining our reputation as a good corporate citizen and making sure that we act ethically and responsibly in co-operating with relevant authorities, government bodies or regulators for the provision of information where appropriate.

We use this information for the purposes of planning, due diligence and implementation in relation to any commercial transactions (including but not limited to any sales, acquisitions or franchising) or service transfers (including but not limited to any outsourcing) involving Yum! Brands and/or its affiliates.

This processing is necessary for the purpose of the legitimate interests pursued by us. We have a legitimate interest in managing our business operations in the most effective way in order to preserve our business operations, grow our business, and maximise efficiency and effectiveness.

Information about how you access and use the Service. For example, how often you access the Service, the time you access the Service and the duration of your use of the Service, the approximate location from which you access the Service, whether you access the Service from multiple devices, and any other actions you take on the Service.

We use information about how you use and connect to the Service in order to tailor how we present the Service to you on your device.

 

Where the relevant information is collected through the use of non-essential cookies or any other non-essential tracking technologies, we rely on consent as the lawful basis for the collection and processing of your personal data.

Where the relevant information is collected through the use of essential cookies or through any other means (excluding non-essential cookies or any or any other non-essential tracking technologies), the processing is carried out on the basis that it is necessary to serve our legitimate interests, namely the tailoring of the Service to the user.

We use this information to inform and determine which products and services may be of interest to you and other customers for direct marketing and advertising purposes.

We will only use your personal data in this way to the extent that you have given us your consent to do so.

We use this information to monitor and improve the Service and business, to troubleshoot and resolve any problems or issues that arise in relation to the Service, and to inform the development of new products and services.

Where the relevant information is collected through the use of non-essential cookies or any other non-essential tracking technologies, we rely on consent as the lawful basis for the collection and processing of your personal data.

Where the relevant information is collected through the use of essential cookies or through any other means (excluding non-essential cookies or any or any other non-essential tracking technologies), the processing is carried out on the basis that it is necessary to serve our legitimate interests, namely to monitor and resolve issues with the Service, and to improve the Service generally.

Log files and information about your device. We collect information about the computer, tablet, smartphone, or other electronic device that you use to connect to the Service. This information may include, but is not limited to, device type, unique device identification numbers, operating systems, browsers, and applications connected to any of the Sites and/or the Service through the device, your mobile network, your IP address, and your device's phone number (if it has one).

We use information about how you use and connect to the Service in order to tailor how we present the Service to you on your device.

 

Where the relevant information is collected through the use of non-essential cookies or any other non-essential tracking technologies, we rely on consent as the lawful basis for the collection and processing of your personal data.

Where the relevant information is collected through the use of essential cookies or through any other means (excluding non-essential cookies or any or any other non-essential tracking technologies), the processing is carried out on the basis that it is necessary to serve our legitimate interests, namely the tailoring of the Service to the user.

We use this information to inform and determine which products and services may be of interest to you for direct marketing and advertising purposes.

We will only use your personal data in this way to the extent that you have given us your consent to do so.

We use this information to monitor and improve the Service and business, to prevent and detect fraud, to troubleshoot and resolve any problems or issues that arise in relation to the Service, and to inform improvements to the Service generally.

 

Where the relevant information is collected through the use of non-essential cookies or any other non-essential tracking technologies, we rely on consent as the lawful basis for the collection and processing of your personal data.

Where the relevant information is collected through the use of essential cookies or through any other means (excluding non-essential cookies or any or any other non-essential tracking technologies), the processing is carried out on the basis that it is necessary to serve our legitimate interests, namely to monitor and resolve issues with the Service, to prevent and detect fraud, and to improve the Service generally.