Who owns
your customers?
Nobody does. UK law doesn't recognise ownership of personal data at all — it recognises control. On Manto, that's yours: you're the data controller, we're the processor, and your list leaves with you whenever you want it.
"Ownership" isn't
the right word.
Every platform says “you own your data”. It sounds good and it means nothing, because there is no such thing as owning personal data in this country. Here's what's actually true — and it's better.
Nobody owns personal data.
English law recognises no property right in data. In 2014 the Court of Appeal held that a database can't even be possessed— so a supplier who tried to hold a customer's subscriber list hostage over unpaid invoices had no legal right to do it.
Your Response Ltd v Datateam Business Media Ltd [2014] EWCA Civ 281You're the data controller.
You decide why the data is collected, what it's used for, who sees it and how long it's kept. That's the ICO's test, and every one of those answers is yours. The person ordering is your customer, on your storefront, under your name.
ICO — controller and processor guidanceWe're the processor.
We hold it and do what you instruct — nothing else. No selling it on, no marketing to your customers, no cross-shop data product. The moment we used them for our own purposes we'd become a controller in our own right, and we don't.
UK GDPR, Article 28Who decides
what happens to them?
| Question | Manto Order | Other white-label platforms | Marketplaces |
|---|---|---|---|
| Who is the data controller? | You. Always. | Usually you — but read the contract; some reserve the right to use it for their own marketplace | Them. Not you. |
| Whose privacy policy does the customer agree to? | Yours, on your domain — we supply the template | Varies — often theirs | Theirs |
| Can you export the whole list? | One click, free, any time | Usually on request; often a support ticket | No. You get what's needed to fulfil the order |
| What happens when you leave? | Full export, then we delete our copy | Check the notice period and whether export survives a billing dispute | Nothing leaves. They keep the customer |
| Can they market to your customers? | Never. We're a processor | Sometimes, if their terms allow it | Yes — including your competitor down the road |
It's published.
Most owners never read it.
"JET may share your personal information (order, name, address, or contact data) with the Partner you selected so that the Partner can deliver your order and where necessary services."Just Eat privacy policy, which names Takeaway.com Group B.V. as the data controller — just-eat.co.uk/privacy-policy
Read it again. You are "the Partner". The customer belongs to the platform; you receive what's needed to cook the food and get it to the door. That isn't a scandal — it's their model, published honestly, and it's a fair trade for the customers they bring you. But it is the whole reason the list can't leave with you, and the reason a shop that has been on a marketplace for six years still has no idea who its regulars are.
Not a promise.
A mechanism.
Export, whenever you like
Customers, numbers, addresses, order history — CSV, one click, free, no notice required and no support ticket. It's in the agreement, not in a help article we can quietly change.
Delete or return, at the end
When a contract ends, a processor must delete or return all personal data — and it's the controller who chooses which. That's you choosing, not us. It's the law, and it's written into our agreement too.
Your customer's own right
A customer can ask you for their data, or ask you to send it to another service. Because you're the controller, that request comes to you — so we built the tools to answer it without phoning us.
And we can't hold it hostage. Some suppliers try it when there's a billing dispute — there's no lien over a database, so they've no right to, and our contract says so in plain words anyway. Your list is never leverage.
Having the list isn't
permission to text it.
Marketing is governed by different rules — and they bite.
Data protection law says whose data it is. A separate set of rules, PECR, says whether you're allowed to send marketing to it. Plenty of shops find that out the expensive way, and since February 2026 the maximum penalty went from £500,000 to £17.5m or 4% of turnover. It also catches whoever instigates the campaign, not just whoever presses send — so it would catch us too.
- Consent doesn't transfer. A customer who agreed to hear from you hasn't agreed to hear from the shop that buys your business, or from any other list they land on.
- Bought-in lists never qualify. There is no such thing as a third-party marketing list that passes the test.
- Your own customers usually do qualify— if you got the details when they ordered, you're marketing your own similar food, and you offered a way out both then and in every message since.
So we built the permission trail into the customer record. Every contact carries how and when you got the details, whether an opt-out was offered at the time, and where they stand today. It exports with the list. And when you run a win-back through Manto Marketing, the campaign simply won't send to anyone who fails the test — you don't have to be a lawyer on a Tuesday afternoon.
Every shop gets this,
in writing, before signing.
A data processing agreement isn't a nicety — it's legally required of anyone who holds your customers for you. Ask your current provider for theirs. The answer is informative.
Straight answers.
Realistically, no, and it's worth understanding why rather than fighting it. The marketplace is the data controller for those customers; you're a recipient of what's needed to fulfil the order. There's no legal lever that turns that into a customer list. What you can do is start building your own from today — every order through your own site, app, phone line or counter lands on a list that is genuinely yours. Shops that run both usually see the direct half overtake within a year.
The customer list transfers with the business as an asset — that's normal and lawful, usually on the basis of the seller's legitimate interest in selling. Two things to get right: customers should be told the business has changed hands, and the buyer shouldn't assume marketing permissions came with it. Consent was given to you, not to whoever buys your sign. We'll export the list with its permission trail intact so the new owner can see exactly where they stand, and we'll talk them through it.
No. We hold it, we run your shop with it, and that's the end of it. We don't market to your customers, we don't sell data, and we don't build a cross-shop data product out of it. Anything we publish about how takeaways trade comes from aggregated, anonymous figures that can't be traced to a shop or a person. If we ever used your customers for our own purposes we'd stop being your processor and become a controller in our own right — different law, different liability, and a broken promise. It isn't worth it to us.
Yes — if you're taking names, numbers and addresses, you need to tell people what you do with them, and that's your duty as the controller, not ours. We write one for your storefront during onboarding, naming us as your processor, and you can change it whenever you like. It's included; it isn't an add-on.
You export everything — customers, order history, menu — in one click. Then you tell us to delete or return our copy, and we do it, and we confirm in writing when it's gone. Backups roll off on their normal cycle and are put beyond use in the meantime. No exit fee, no "remaining months", and no version of this where an unpaid invoice means you can't have your list.
Yes, if they'll release it — and they should, because it's yours. Send us the export and we'll bring across customers, numbers, addresses and order history. Bring the opt-out flags too, not just the names: the marketing permissions matter more than the phone numbers. If your provider won't hand it over, that tells you something about them, and it's a good reason to leave sooner rather than later.
This page is a plain-English summary of how we handle your data and what UK law says about it — it isn't legal advice, and your data processing agreement with us is what governs. Sources: the ICO's guidance on controllers and processors and direct marketing; PECR Regulation 22; UK GDPR Articles 20 and 28.
Ask us for the agreement
before you ask us for a demo.
We'll send the data processing agreement and the storefront privacy notice, in plain English, before you commit to anything. Then have a look at the till.