Privacy Policy for Greggs Digital and Customer Services

United Kingdom

Last updated October 2026

1. INTRODUCTION

This Privacy Policy explains how we collect, use, share, retain and protect your personal information when you visit our shops, use the Greggs App, visit our website, contact us by telephone, post, email, engage with our digital marketing and advertising, social media channels, interact with our third-party providers or in any other way you might engage with us. This Privacy Policy also explains your legal rights in relation to your personal information and how you can exercise them.

We may update this Privacy Policy from time to time. Where appropriate, we will endeavour to notify you of any significant changes if we hold a valid email address for you provided via the Greggs App. We recommend you review this page periodically to stay informed of any changes. Any updates will be posted on this page and the “last updated date” (the date it applies from) at the top of this Privacy Policy will be amended accordingly.

Please read this Privacy Policy carefully so you understand how we collect, use, share, retain and protect your personal information. If you have any questions, concerns or requests relating to this Privacy Policy, please get in touch with us via our Contact page.

2. WHO WE ARE

We are Greggs plc, one of the UK’s leading food-on-the-go retailers ("we" or "us"). Greggs plc is registered in England and Wales under company number 00502851 and our registered office is at Greggs House, Quorum Business Park, Newcastle upon Tyne, NE12 8BU. We are the data controller of your personal information.

We are registered with the Information Commissioner’s Office under registration number Z7225689.

If you have a question regarding how we use your personal information, please address your communication to the "Data Protection Analyst" using one of the methods set out in the “How can you find out about and update your information?” section of this Privacy Policy.

We take data protection very seriously and are committed to protecting and respecting the privacy of our customers in accordance with the UK General Data Protection Regulation ("UK GDPR") and the Data Protection Act 2018.

3. THE PERSONAL DATA WE COLLECT ABOUT YOU

We may collect the following personal information from you:

Identity Data: name, date of birth, gender (if you choose to provide this), social media handle.
Contact Data: home address, billing address, email address and telephone number.
Transaction Data: items purchased, the date and time of your transaction, amount purchased, whether you used a particular coupon or deal, and payment information, such as your credit/debit card or gift card, when you make an in-store or online purchase.
Financial Data: payment card and, in relation to certain goodwill payments, your bank account number and sort code.
Image Data: your image on CCTV in our shops, and your image and audio when body cameras are in use by employees at selected shops.
Customer Service Data: any information you share in correspondence or feedback you send to us, including but not limited to in forms, competitions, promotions or surveys you submit to us, when using our website, Greggs App (including in-app chat), email or via our social media pages.
Technical Data: your mobile telephone ID (i.e. your unique address that identifies your mobile device), your Internet Protocol (IP) address (i.e. your unique address that identifies your device on the internet), your internet service provider, device type, model and manufacturer, device operating system and platform, date and time stamps, IDs that allow us to uniquely identify your browser, mobile device and information in relation to your account and advertising you might have interacted with.
Profile Data: your username and password, loyalty program details, your marketing preferences and consent status, how you use any of our digital services including which products you purchase from us, how frequently you purchase them, when you visit our shops, how much you spend with us, which of our shops you use/visit, how you engage with our digital channels, how you’ve arrived at registering or using our digital services.

Usage and Browsing Data: your browsing history on our Greggs App, Website or information from when you visit and engage with content or targeted advertising on third party platforms or social media networks.
Behavioural and Incident Data: information relating to security incidents, suspected criminal activity, anti-social behaviour, investigations and interactions with law enforcement authorities and incident records.

Location Data: where you have enabled location tracking services on your mobile device, we may collect location information from you so that you can use your Greggs App to find your nearest Greggs shop and we can understand more about your shopping habits with us in order for us to send you more personalised offers on our products and services.

Sensitive Personal Data

We do not process sensitive personal data routinely. Where facial recognition technology is used in a limited number of shops for security and crime prevention measures, biometric data is derived from facial images captured via CCTV, including biometric templates to identify individuals.

Aggregated Data

We collect, use and share aggregated data such as statistical or demographic data. We could derive this aggregated data from your personal information where you’ve given us permission to do so. For example, to understand differences in usage of users accessing a specific Greggs product or service in different parts of the UK.

Nevertheless, if we combine or connect aggregated data with your personal information so that it can directly or indirectly identify you, we treat the combined data as personal information which we will use in accordance with this Privacy Policy.

How is your information held?

Once collected, your personal information will either be held on the secure systems of our third-party suppliers involved in the operation of a Greggs account or held on our customer database on our own secure systems within the United Kingdom (for further details, please see the “Who has access to your information” section below).

When you speak to us by phone you will be notified that your call will be recorded. This recording is held within the United Kingdom.

4. HOW WE USE YOUR PERSONAL DATA

We will only use your personal information when the law allows us to do so, which may be:

To fulfil a contract we have with you; or
When it is our legal duty; or
When it is in our legitimate interests (or those of a third party); or
When you consent to it.

A legitimate interest is when we have a business or commercial reason to use your information. But even then, it must not unfairly go against what is right and best for you. If we rely on our legitimate interests, we will tell you what that is.

We may use your personal information for the reasons and in accordance with the legal basis below:

Purpose of Processing Your Personal Information	Legal Basis
Account administration Account administration purposes for any registered account(s) you hold with us.	This is both: Necessary for the performance of a contract with you for the operation of any account; and Necessary for our legitimate interests to ensure that our customers receive an appropriate level of service.
Rewards To provide you with rewards based on: Your birthday. Your purchasing habits. Your location and / or the shops that you visit. Products that we think you might be interested in. The rewards set out in our Terms and Conditions, in which case we shall notify you by email when these are applied to your Greggs account and may provide further notice if a reward is expiring.	This is both: Necessary for the performance of the contract with you for the operation of your Greggs account; and Necessary for our legitimate interests to ensure that our customers receive rewards that are tailored to them and are in line with their expectations.
Notifications and account information To send notifications or account information to you by email, SMS or push notifications or in-app comms relating to your account, rewards, orders and use of the Greggs App.	This is both: Necessary for the performance of the contract between you and us for the operation of your Greggs account; and Necessary for our legitimate interests to ensure that our customers receive an appropriate level of service.
Personalised Marketing To better tailor offers and services to your needs, including: To send you marketing about Greggs’ products, services, offers and promotions including by email, SMS and push notifications through the Greggs App. If you opt in to receive marketing communications through the Greggs App, you may also receive push notifications. Push notifications can be turned off at any time through your personal device settings, changes to your marketing preferences within the Greggs App will not automatically disable push notifications on your device. To provide personalised content and information that may be of interest to you. This will include targeted content and advertising where we identify you across our platforms and third parties, identifying when, if, and where you use multiple devices to access our services.	On the basis of consent, specifically where you have opted to receive direct marketing via the preference settings in any Greggs account, where you have opted to receive our email communications or indicated you consent to being tracked using the first and third-party cookies as detailed in our Cookie Policy.
Profiling To help us build up a picture of the things you are interested in or you’ll find most useful from us to make advertising tailored to you whenever possible, including in-app communications. We will build and develop a customer profile for you based on the products and services you use and/or buy to target and develop content, advertisements or marketing materials which are most likely to be of interest to you. We may also use these profiles to "match" your data and these could also appear as advertising on third party websites or social media platforms that you visit after you have used our services such as this site or the Greggs App.	This is either (depending on the circumstances): on the basis of consent, specifically where you have opted to receive direct marketing via the preference settings in any Greggs account, where you have opted to receive our email communications or indicated you consent to being tracked using the first and third-party cookies as detailed in our Cookie Policy. necessary for our legitimate interests in a way which might be reasonably expected as part of us running our business, allowing us to engage with you more effectively and enhance your experience with us.
Data analytics To conduct data analytics and analysis studies to review and better understand trends and improve our business, use of our website, Greggs App and social media which relates to us as well as to help us measure traffic and usage trends for the services we provide and to understand more about the demographics and behaviours of our users.	This is necessary for our legitimate interests to improve our service to our customers. We may also have legal obligations or be exercising a legal right to do this.
Location data Location services so that you can use your Greggs App and account to find your nearest Greggs’ shop.	On the basis of consent, specifically where you have enabled location tracking services on your mobile device.
Customer record To create and maintain a record to identify where you have been in touch with us in the past, including the reason for that previous contact and how it was resolved.	This is necessary for our legitimate interests in order to ensure that we have a good record of customer contacts so that we can: Monitor complaints regarding our business and any on-going or recurring issues that you may have. This will help us to make sure you receive proper assistance when you contact us and where relevant, that we understand the background to any issues you may have. Identify any potentially fraudulent complaints or series of complaints. Review and assess the quality of our responses to complaints for training and development purposes.
Responding to you To respond to your question or comment and to evaluate and improve our products and services. Where you have previously been in touch, we will use this data to help you more quickly.	This is necessary for our legitimate interests to improve our service to our customers.
Monitoring use To monitor any use you make of our website, Greggs App and information and communication systems and social media accounts, to remember information so that you will not have to re-enter it during your visit or the next time you visit our website.	This is necessary for our legitimate interests so we can: Ensure network and information security, including preventing unauthorised access to our computer and electronic communications systems and preventing malicious software distribution. Protect your personal information. Improve our service to our customers.
Vouchers and gift cards To send gift cards or voucher codes to you. To send the balance of your gift cards or vouchers to you.	This is either (depending on the circumstances): Necessary for the performance of a contract to which you are a party, for example if your contact relates to the operation of your Greggs account or to request the balance of your gift card/voucher. Processing is necessary so that we resolve the issue and ensure that we have properly provided our services to you; or Necessary for our legitimate interests to ensure that our customers receive an appropriate level of service and to investigate and resolve the reasons why that may not be the case; or On the basis of consent, specifically where we ask your consent to be able to use your data to send gift vouchers or voucher codes to you.
Complaints To contact you to discuss any complaint that you have made and to update you on how it is being resolved.	This is either (depending on the circumstances): Necessary for the performance of a contract to which you are a party, for example if your contact relates to the operation of your Greggs account. Processing is necessary so that we can investigate the issue and ensure that we have properly provided our services to you; or Necessary for our legitimate interests to ensure that our customers receive an appropriate level of service and to investigate and resolve the reasons why that may not be the case.
Order fulfilment To fulfil your order, complete your transaction and update aspects of your Greggs account such as your rewards information.	This is both: Necessary for the performance of a contract with you to fulfil your order; and Necessary for our legitimate interests to ensure that our customers receive an appropriate level of service.
Custom Audiences To help Social Media networks target you with tailored adverts. In some cases we will send encrypted customer emails to social media networks so that they can build custom audiences of our customers, which we can then target with tailored adverts. Social media networks will only be able to use customer emails to identify a user profile where this email data already exists on their network.	This is necessary for our legitimate interests to ensure that we can better understand the type of customer holding an account.
Group Wide and Partner Marketing To send you marketing about activities carried out by any Greggs group company which may also include the Greggs Foundation, and selected third party partner brands whose products, services, offers or promotions we believe may be of interest to you. Unless otherwise stated, Greggs will send these communications itself and will not share your personal information with partner brands for their own marketing purposes without your consent.	On the basis of consent, specifically where you have opted to receive direct marketing via the preference settings in any Greggs account, where you have opted to receive our email communications or indicated you consent to being tracked using the first and third-party cookies as detailed in our Cookie Policy.
Customer Insights and Customer Satisfaction Surveys To send you survey and feedback requests to help improve our products and services. Customer satisfaction surveys will not include any promotional content. You are under no obligation to complete any surveys.	This is either (depending on the circumstances): Necessary for our legitimate interests so we can measure how satisfied our customers are and for internal business processes such as improving our services and products. On the basis of consent where you have opted to receive direct marketing, we’ll send customer insight surveys so we can gain an understanding of your thoughts on our products and services, and related matters.
Competitions To administer and manage your participation in any competition that you choose to enter.	This is necessary for the performance of our contract with you so that we can contact you and send you a prize if you are a winner.
Security and crime prevention, including incident records To assist in crime prevention and detection, and to protect our customers, employees and premises from crime, we operate CCTV systems in our shops and body cameras are worn by employees at selected shops. In a limited number of Greggs shops where there is an increased risk of crime, violence, threats to staff or repeat offending, we may use retrospective (non-live) facial recognition technology as part of our security measures. This means that facial recognition technology is only used following a security incident and we do not scan customers' faces in real time as they enter our shops. Where security incidents occur, we may create records of those incidents. These records may include CCTV images, body camera footage, descriptions of the incident and information relating to individuals suspected of involvement in criminal or anti-social behaviour. Where facial recognition technology is used, facial images obtained from CCTV footage may be processed to create biometric templates for the purpose of identifying individuals suspected of involvement in criminal or anti-social behaviour. This processing is only carried out in relation to individuals recorded in our incident records and suspected of involvement in a security incident. Any potential match generated by the technology is subject to appropriate human review and oversight before any action is taken.	This is necessary for our legitimate interests to ensure that we are maintaining a safe and secure environment for our colleagues and customers, preventing crime and anti-social behaviour, protecting our property and assets, and investigating security incidents. Where facial recognition technology involves the processing of biometric data for the purpose of uniquely identifying an individual, we will process that biometric data in accordance with applicable data protection laws. This includes reliance on the substantial public interest condition for the prevention or detection of unlawful acts and, where applicable, the establishment, exercise or defence of legal claims.

We also need to compile reports detailing the number and nature of customer contacts received within certain periods of time, which we will use within the business for management purposes. We use reasonable efforts to remove all personal information from these reports, but sometimes (for example, where personal information is contained in the message box of the “Write to us” section on our website), it may not be practical for this personal information to be removed or anonymised.

We always aim to use your personal information in an ethical and non-intrusive way. We will not use your personal data to target, segment, or profile individuals based on their health, negative financial status or condition, political affiliation or beliefs, racial or ethnic origin, religious or philosophical affiliation or beliefs, sex life or sexual orientation, data relating to an alleged or actual commission of a crime, for any unlawful or discriminatory purpose or in any other manner that would be inconsistent with your reasonable expectation of privacy.

1. HOW LONG WILL WE HOLD YOUR INFORMATION FOR?

We will only hold your personal information for as long as is reasonably necessary to fulfil the purposes we collected it for, including for the purposes of satisfying any legal, regulatory, tax, accounting or reporting requirements. 

In general, this means we will hold your personal information for as long as you are an active customer of Greggs. While this will vary for each customer, this data will typically cover up to a 10-year period of your activity with us, but may be longer depending on how long you have used our Digital Services.

How we consider you to be an active customer of Greggs

We consider you an ‘active’ customer of Greggs, and therefore retained on the database, if within the previous 24 month period you have: 

Made a digital transaction with us – such as placing a click and collect order via the Greggs App, making a purchase on greggs.co.uk, or scanning/using the Greggs App at a Greggs shop; or
Received 1 or more stamps, or rewards, in any of the six product categories in the last 24 months; or 
Had a financial account/wallet balance of any size that has been topped up within this period (auto or manual); or 
Not otherwise already contacted our Customer Care Team to request that your personal information or Greggs account is removed from our system.

If you cease to be an active customer of Greggs by not engaging in any of the above interactions with us, we will delete your Greggs account and your personal information.

Circumstances where we may retain your personal data

If you make a complaint we also may need to hold your personal details for a longer period. We may also retain your transaction history for analysis purposes.

In some circumstances you may continue to receive marketing communications from Greggs after your Greggs account is deleted if you do not opt out.

Notice of deletion

If your contact details are still valid, in most cases we will aim to notify you in advance of our intention to close your Greggs account after 24 months of inactivity. However, we may, at our discretion, proceed to close your Greggs account sooner if we deem you to no longer be an active customer of Greggs.

Data Retained by our Customer Care Team

In all other cases and where you contact our Customer Care Team we hold your information for 3 years from the date of your contact or if you contact us again within that period of time, for a period of 3 years from the date of your last contact with us.

We will hold your personal information for this length of time because:

In the case of a Greggs account it will ensure that your account is kept available for your use for a reasonable period of time before closure;
It will help us to handle any Greggs account queries you may have within this period of time;
It will identify any trends in the nature of your contact with us; and
It will allow us to investigate a complaint.

After expiry of retention periods your data may be anonymised for market insight purposes and to measure the performance of our business.

We may keep your data for longer if we cannot delete it for legal, regulatory or technical reasons.

We will from time to time review our retention periods but we will only ever hold your personal information for as long as we believe is necessary for reasons set out above.

Only processing the personal information that we need to

Your personal information will only be processed to the extent that it is necessary for the specific purposes we tell you about.

2. WHO HAS ACCESS TO YOUR INFORMATION?

We reserve the right to pass any or all your personal information to the police, or any other law enforcement agency for the purposes of:

Compliance with any of our legal obligations;
Crime detection or prevention;
Your misuse, or suspected misuse, of our website or any Greggs account.

Where your contact relates to any legal proceedings or prospective legal proceedings against us, we may need to pass your personal information onto our insurers and legal advisers for the purposes of assessing any such proceedings. We may also be required to share your personal information if we are under a duty to do so in order to comply with any legal obligation or to protect our rights, property or the safety of our business, customers, suppliers or employees. This includes exchanging information with other companies and organisations for the purposes of fraud protection.

We will also share your personal information with the following categories of third parties:

Service providers acting as processors who provide insight services, delivery of marketing and communications services, customer services, competition administrators and IT and system administration services.
Service providers acting on our behalf in connection with security, crime prevention, incident management and investigative technologies. These providers may process CCTV footage, incident records and related information solely for the purpose of providing services to Greggs and in accordance with our instructions.
Where you need to send something to us (for example, a sample of a product you have purchased from us) or where we need to send something to you (for example a gift), your personal information may need to be passed onto our third-party suppliers to help us to achieve this.
Where your contact involves one of our third-party partners (for example Just Eat, Iceland and franchise partners) if necessary, we will pass on your information (unless you ask us not to) in order to resolve your complaint or query.
Where you have used our click and collect service or top up functionality via the Greggs App, your payment has been processed by our payment provider Adyen. For more information on how your information has been processed by our payment provider please go to: Adyen Privacy Policy.
When you contact us via networks such as Instagram, Facebook, TikTok and X (formerly Twitter) we will occasionally use this data for internal analysis purposes. Please refer to the below links for their individual privacy policies and how your data is used: (i) Instagram Privacy Centre, (ii) Facebook Privacy Centre, (iii) TikTok Privacy Policy, (iv) X Privacy Policy.
If you have any queries on how we work with these third-party providers, please contact data.protection@greggs.co.uk

Apart from the circumstances set out above, we will not disclose your personal information to any third parties without your consent, unless we are satisfied that they are legally entitled to the information. Where we disclose your personal information to a third party, we will have regard to the data protection principles.

We will not:

Sell your personal information to third parties; or
Share your personal information with third parties for marketing purposes (unless you have given your consent for us to do so).
Permit any decisions to be taken about you using automated decision-making means.

Links to other web sites and services

Greggs App and website may contain links to and from third party websites of our business partners, advertisers, and social media sites and our users may post links to third party websites. If you follow a link to any of these websites, please note that these websites have their own privacy policies and that we do not accept any responsibility or liability resulting from you following a link to these websites. Additionally, other privacy policies may apply when you engage with us through a co-branded or co-sponsored promotional or marketing activity. We strongly recommend that you read the privacy policies and terms and conditions of use of any third-party website or service to understand how your information will be collected, used and shared. We are not responsible for the privacy practices or the content on the websites of third-party sites.

3. HOW WE KEEP YOUR DATA SECURE

We and our third-party suppliers use reasonable, appropriate and up to date security methods to keep your data secure and to prevent unauthorised or unlawful access to your information. We limit access to your personal information to those employees, subcontractors, consultants and other third parties who have a business need to use it. They will only process your personal information on our instructions. They are subject to obligations of confidentiality.

We have put in place procedures so that we can deal with any actual or suspected personal information breach and we will let you and the Information Commissioner's Office know of a breach where we are legally required to do so.

4. TRANSFERRING YOUR PERSONAL INFORMATION OUTSIDE THE UK

We will not transfer your personal information outside the UK unless such transfer is compliant with the UK GDPR. This means that we cannot transfer any of your personal information outside the UK unless:

The UK Government has decided that another country or international organisation ensures an adequate level of protection for your personal information; or
The transfer of your personal information is subject to appropriate safeguards, which may include: (i) binding corporate rules; or (ii) standard data protection clauses adopted by the UK Government; or
One of the derogations in the UK GDPR applies (including if you explicitly consent to the proposed transfer).

Some of our service providers may process personal data outside the UK. Where this occurs, we ensure appropriate safeguards are in place, including the UK International Data Transfer Agreement (IDTA), the UK Addendum to the EU Standard Contractual Clauses, or transfers to countries that benefit from UK adequacy regulations.

5. YOUR DATA RIGHTS

You have the right to ask for a copy of the personal information that we hold about you.

If you wish to do so, please contact us:

By email at data.protection@greggs.co.uk
By post for the attention of the Data Protection Analyst, Greggs plc, Greggs House, Quorum Business Park, Newcastle upon Tyne, NE12 8BU.

In order to fulfil your request, we may need to first verify your identity.

Any questions regarding this Privacy Policy can be sent to us using the same contact details above.

The accuracy of your information is also important to us. If you change contact details or if you believe that any of the other personal information we hold is inaccurate, incomplete or out of date, you can first try to make the changes via the Greggs App, otherwise please contact us:

Via our Contact page;
By post for the attention of the Customer Care Team, Greggs plc, Greggs House, Quorum Business Park, Newcastle upon Tyne, NE12 8BU;
By telephone on 0808 1473447.

You may also request an accessible format of this Privacy Policy using these contact details.

In addition to your rights set out elsewhere in this Privacy Policy, you also have the right to:

Request details from us of the recipients of your personal information or the categories of recipients of your personal information, if it is supplied by us to any third parties;
In certain circumstances have the processing of your personal information restricted;
In certain circumstances be provided with the personal information that you have supplied to us, in a portable format that can be transmitted to another company;
In certain circumstances not to be subject to a decision that is based solely on automated processing which would have a legal or significant impact on you; and
In certain circumstances object to any processing we are carrying out about you when the basis for our processing is legitimate interests.

If you wish to exercise any of the rights set out above, you must make the request in writing addressed to the "Data Protection Analyst" using one of the methods set out above.

Withdrawal of consent

If you have provided your consent for us to process your personal information, you have the right to withdraw your consent at any time. This will not affect the legality of our consent-based use before you withdrew your consent.

Unsubscribing from email or SMS marketing will not automatically disable push notifications on your device because push notifications are controlled through your device settings. If you no longer wish to receive push notifications from the Greggs App, you can disable them through your personal device settings.

If you wish to exercise your right to withdraw your consent, you must make the request in writing addressed to the "Data Protection Analyst " using one of the methods set out in the “How can you find out about and update your information?” section of this Privacy Policy.

The right to object and deletion

You have the right to object to our use of your personal information, or to ask us to delete, remove, or stop using your personal information if there is no need for us to keep it. This is known as the “right to be forgotten”.

There may be legal or other reasons why we need to keep or use your information, but please tell us if you think that we should not be using it.

We may sometimes be able to restrict the use of your personal information (although in doing so this may affect your ability to continue using your Greggs account). This means that it can only be used for certain things, such as legal claims or to exercise legal rights. In this situation, we would not use or share your information in other ways while it is restricted.

If you object to our processing of any of your personal information, you must make the request in writing addressed to the “Data Protection Analyst” using one of the methods set out in the “How can you find out about and update your information?” section of this Privacy Policy.

6. COMPLAINTS

If you have any issues with our processing of your personal information and would like to make a complaint, you can contact our Data Protection Analyst or alternatively you may contact the Information Commissioner's Office on 0303 123 1113 or at Wycliffe House, Water Lane, Wilmslow, Cheshire, SK9 5AF.

Although you can complain to the relevant data protection regulator without speaking to us first, they expect you to raise the issue with us first so if you haven’t already, please contact our Data Protection Analyst and we will try and help.

You can also find further information about your rights and how to complain on the ICO website at ico.org.uk.