Privacy, in plain English

Last updated: 7 July 2026

This notice explains what Serva does with personal data, in plain English. Serva is a trading name of JDDA Media Limited, registered in England and Wales, company no. 12045526, based in Stokesley, North Yorkshire. Registered office: 15 Oak Tree Road, Stokesley, Middlesbrough, TS9 5FN. We're registered with the Information Commissioner's Office, registration number ZC186891, and we're the contact for anything in this notice: use the form at serva.digital.

There are three situations where we handle personal data. Find yours below.

1. You visited serva.digital or sent us an enquiry

What we collect: only what you type into the interest form - your email address, your venue or event name, and any note you add. Nothing else.

Why, and on what basis: to reply to you about Serva and to arrange the board you asked about. In data-protection terms this is our legitimate interest in responding to people who ask us to get in touch, and it becomes performance of a contract if you go on to sign up. If we ever want to send you marketing beyond replying to your enquiry, we'll ask for your consent first - that's the lawful basis for marketing, and you can withdraw it at any time.

What we'll send you: we'll email you about Serva. Nothing else, ever, and never anyone else. No newsletters you didn't ask for, and your details are never shared or sold.

Cookies: the serva.digital site sets none. Honestly, none. Our visit counts use cookieless analytics (Cloudflare Web Analytics), which gives us anonymous, aggregated numbers and no way to identify you. That's also why there's no cookie banner - there's nothing to consent to.

How long we keep it: until you tell us to remove it, or until it's clear no board is happening, at which point we tidy old enquiries away (as a rule, an enquiry that's gone quiet for a year gets deleted). If you sign up, your details move into your account records.

Your rights: you can ask what we hold, ask for a copy, correct it or have it removed. Send a note through the form and it's done. If you're ever unhappy with how we've handled your data, you can complain to the Information Commissioner's Office (ico.org.uk), but we'd appreciate the chance to fix it first.

2. You're a guest using a venue's Serva board

The pub, taproom or festival whose QR code you scanned is the data controller for anything you do on its board. We process that data on the venue's behalf, as its processor. In short: your data belongs to the venue you gave it to, and we run the plumbing.

What the board handles

• Browsing: the board works without an account and without cookies for tracking you. Anonymous usage events (a visit, a drink viewed) are counted so the venue knows its busy hours. They aren't tied to your identity.
• Ratings and reviews: stored with whatever name you choose to give, which can be nothing.
• Mailing-list sign-up: your email is stored only if you explicitly tick the consent box, with a timestamp and where you signed up from - in data-protection terms, that's consent, and you can withdraw it at any time by unsubscribing. Only the venue you signed up with gets it. Unsubscribing is handled by the venue, whose emails must tell you how; the venue can also remove you on request.
• The quiz: your email is stored as a one-way hash (we can't read it back) so one person gets one entry per round. Your display name appears on the leaderboard while the round runs and is wiped automatically when it ends. If you win, the winner name is cleared once your prize code is redeemed at the bar. Ticking the quiz's marketing box (optional) adds you to the venue's mailing list as above.
• Offline queueing: if you're using the board with no signal, your ratings and sign-ups wait on your phone and send when you're back online. Nothing extra is collected because of this.

What we never do with guest data: sell it, share it, rent it, use it to market to you, or let one venue see another venue's data. We only touch it to keep the service running.

Analytics on boards: venue boards use only the board's own first-party counters - visits and drink views, stored in our database as anonymous counts, not tied to you. No third-party analytics run on venue boards.

Your rights as a guest: point them at the venue first - it's the controller. If you'd rather come to us, use the form at serva.digital and we'll either sort it directly or pass it to the venue and make sure it's actioned. And the right to complain to the ICO (ico.org.uk) is yours here too.

3. You run a venue with a Serva board

What we collect about you: your name, email and venue details, plus payment records once billing starts - what we need to run your account, bill you and support you. Payment card details are handled by our payment provider, never stored by us.

Why: to provide the service you signed up for (performance of a contract), to meet our accounting obligations (legal obligation), and to email you about your board and service changes (part of running the contract). We won't add you to marketing lists without asking - marketing needs your consent.

How long: for as long as you have a board, then per the retention terms in the venue T&Cs - you have 30 days after closure to ask for your data, and we delete your venue's data within 90 days, except what we must keep for legal or accounting reasons.

Where data lives, and who helps us run Serva

Serva runs on Cloudflare's network (hosting and content delivery), with data stored in Cloudflare's D1 database service. Anonymous analytics on our own site run through Cloudflare Web Analytics; venue boards use only their own first-party counters. Transactional email (for example, telling a venue about a new enquiry) is sent through Resend. That's the whole list - even the fonts are served from our own site, so your browser talks to nobody else on our account.

These providers process data under their own agreements with us and don't get to use it for themselves. Cloudflare operates a global network, so requests may be served from outside the UK; where personal data is transferred internationally, it's protected by the safeguards in our providers' data-processing agreements (including standard contractual clauses).

Changes to this notice

If we change this notice in a way that matters, we'll say so on serva.digital and, for venues, by email. The date at the top tells you which version you're reading.