United Kingdom Privacy Notice
This notice supplements our Privacy Notice and applies if you are in the United Kingdom. It is provided under the UK GDPR and the Data Protection Act 2018.
Our online store ships only within the continental United States. We do not sell directly to customers in the UK. You can, however, visit our websites and sign up for our emails from the UK, and we use cookies and similar technologies that monitor how visitors use our sites, so UK data protection law applies to that activity.
Contents
Controller and UK representative
The controller of your personal data is:
Beyond Meat, Inc., 888 N. Douglas Street, Suite 100, El Segundo, CA 90245, United States — privacy@beyondmeat.com
Beyond Meat has no establishment in the United Kingdom.
To the extent required by the UK GDPR, we will appoint a representative in the United Kingdom under Article 27 and publish their name and contact details in this notice.
In the meantime, and at any time, you can contact us about anything in this notice:
Beyond Meat, Inc. — Attn: Privacy
888 N. Douglas Street, Suite 100
El Segundo, CA 90245, United States
Email: privacy@beyondmeat.com
Purposes and legal bases
| What we do | Personal data | Legal basis |
|---|---|---|
| Respond to your enquiries and provide the website | Identity, contact, content of your message, device information | Legitimate interests (Art. 6(1)(f) UK GDPR) — to operate our website and answer people who contact us. Where you are entering into a transaction with us, contract (Art. 6(1)(b)) |
| Send you marketing emails and messages | Identity, contact, preference, engagement and order information | Consent (Art. 6(1)(a) UK GDPR), which you give by opting in and can withdraw at any time. Electronic marketing is also subject to PECR |
| Use non-essential cookies and similar technologies, including for analytics and advertising | Device and online identifiers, activity on our sites, approximate location | Consent (Art. 6(1)(a) UK GDPR), and consent under regulation 6 of the Privacy and Electronic Communications Regulations (PECR) for storing and accessing information on your device. Nothing non-essential runs before you agree |
| Build audience segments and predictions to decide what marketing to send | Order and engagement history and the predictions derived from it | Consent (Art. 6(1)(a) UK GDPR), given with your marketing opt-in |
| Keep records of the consents and choices you give us | The consent record itself, with date, time and method | Legal obligation (Art. 6(1)(c)) and legitimate interests (Art. 6(1)(f)) — to demonstrate compliance |
| Keep our sites and business secure and prevent fraud | Device information, IP address, activity | Legitimate interests (Art. 6(1)(f)) |
| Comply with legal obligations and establish or defend legal claims | Identity, contact, order and transaction records, and the correspondence relevant to the obligation or the claim | Legal obligation (Art. 6(1)(c)) and legitimate interests (Art. 6(1)(f)) |
Where we rely on legitimate interests, we balance those interests against your rights and freedoms, and we do not rely on this basis where your rights and freedoms override it.
We do not process special category data as defined in Article 9 of the UK GDPR, and we do not ask you for any.
Where we did not get your personal data from you. Some of what we hold comes from marketplaces, retailers, and advertising and analytics partners rather than from you; the categories and the sources are set out in Where we get it. Where Article 14 applies, we will give you this information within one month of obtaining the data, or when we first communicate with you, or before we first disclose it to anyone else, whichever comes first.
Automated decision-making and profiling
We profile you for marketing purposes, as described in Profiling and automated processing. We do not take decisions based solely on automated processing that produce legal effects concerning you or similarly significantly affect you within the meaning of Article 22 of the UK GDPR.
Recipients
The categories of recipients are listed in Who we share it with. Where a company processes personal data on our behalf, we put written obligations in place requiring it to process that data only on our instructions, to keep it secure, and to meet the requirements Article 28 of the UK GDPR sets out. The companies named below as advertising and measurement recipients decide for themselves how they use what they receive, and are responsible for it under their own privacy notices.
The companies that receive personal data for advertising and measurement, and that decide for themselves how they use it, are Google, Meta, TikTok, Microsoft Advertising, Pinterest, Spotify, Amazon Advertising, 6sense and 506, together with retail media networks including Instacart and Walmart Connect. Each handles what it receives under its own privacy notice, and our Cookie Notice lists the specific technologies each of them uses on our sites.
The companies that process personal data only on our instructions are our e-commerce platform (Shopify), our marketing platform (Klaviyo), our consent management platform (TrustArc), our reviews platform (Yotpo), our accessibility tool (UserWay), our payment processors, and our fulfillment, cold-chain and delivery partners, together with the agencies and professional advisers described in Who we share it with.
Retention
See How long we keep it. Where we rely on your consent, we stop processing for that purpose when you withdraw it, and retain only the record of the consent and its withdrawal.
Where your personal data is stored, and international transfers
We are a United States company and we store personal data in the United States, and so do the companies that process it for us. Some of those companies are based outside the United States, or have staff outside it who access personal data in order to support us. Those countries are currently Australia, Canada, Ireland, Israel, Singapore and the United Kingdom: our store platform contracts through a Canadian company, our marketing platform is supported by staff in Ireland, the United Kingdom, Australia and Singapore, and our reviews platform holds information in Israel as well as here. If that changes, we will update this notice.
Personal data you give us directly
When you give us your details through our websites, that personal data is collected by us in the United States. We have no establishment in the United Kingdom that collects it on our behalf, so it is not transferred out of the UK, it is provided directly to a company outside it. The UK GDPR still applies to how we handle it. Where a company processes personal data on our behalf, we put written obligations in place requiring it to process that data only on our instructions, to keep it secure, and to protect it to the standard UK law requires. The advertising platforms and marketplaces named under Recipients decide for themselves how they use what they receive, and are responsible for it under their own privacy notices; we describe those arrangements in Who we share it with.
If that changes
In the future we may collect personal data within the United Kingdom and send it to our systems in the United States; for example, if we begin selling directly to customers here, which we do not do today, or run specific promotional activity.
Where that happens, and in any other case where we transfer personal data out of the United Kingdom, we will put the required safeguards in place before the transfer takes place. That means the UK International Data Transfer Agreement, or the European Commission’s Standard Contractual Clauses together with the UK International Data Transfer Addendum, supported by a transfer risk assessment and any supplementary measures it identifies as necessary.
You can ask which of the positions above applies to your personal data, and request a copy of any safeguards we use, by emailing privacy@beyondmeat.com.
Your rights
Under the UK GDPR you have the right to:
- Access — obtain confirmation of whether we process your personal data and a copy of it.
- Rectification — have inaccurate or incomplete data corrected without undue delay.
- Erasure — have your data deleted in the circumstances set out in Article 17.
- Restriction — have our processing restricted in the circumstances set out in Article 18.
- Portability — receive data you gave us in a structured, commonly used, machine-readable format and have it sent to another controller where technically feasible.
- Object — object at any time, on grounds relating to your particular situation, to processing based on legitimate interests. You may object to direct marketing at any time, for any reason, and we will stop.
- Withdraw consent — at any time, without affecting processing carried out before you withdrew it.
To exercise them, use Do Not Sell or Share My Personal Information or email privacy@beyondmeat.com. We respond within one month and may extend by up to two further months for complex requests.
Complaints
You have the right to complain to the UK supervisory authority:
Information Commissioner’s Office
Helpline: 0303 123 1113
ico.org.uk/make-a-complaint
We would appreciate the chance to address your concern first — please contact us before or alongside going to the ICO.
Contact
Beyond Meat, Inc., Attn: Privacy, 888 N. Douglas Street, Suite 100, El Segundo, CA 90245, USA | privacy@beyondmeat.com
If you need this notice in a different format because of a disability, tell us using the details above and we will find a way to get it to you.
Effective date: 1 September 2026 · Last updated: 1 September 2026 · Ref: BYND.5.1.1