1. Who we are
This Privacy Policy explains how [Business name not provided] ("we", "us") handles your personal data when you use our website or place an order through this shop. We are the data controller of the information you provide.
Registered address: [Registered address not provided]. Contact for any privacy queries: [Privacy contact email not provided].
2. What information we collect
You give us directly
- Account information — phone number (always), and optionally your name and email address
- Order information — what you ordered, delivery address, order notes, special instructions
- Contact information — anything you send us via email or phone
We collect automatically
- Device and usage data — IP address, browser type, pages viewed, approximate location (city level)
- Cookies and similar technologies — see the Cookies section below
From others
- Stripe, our payment processor — confirmation that your payment succeeded, the last four digits of your card, and the card type. We do not see your full card number.
3. Why we use it (lawful basis)
- To take and fulfil your orders — necessary to perform our contract with you (UK GDPR Article 6(1)(b)).
- To verify your phone number — necessary to perform the contract and to prevent fraud (legitimate interest, Article 6(1)(f)).
- To send transactional messages about your order (SMS, push notifications, email) — necessary to perform the contract.
- To keep records for tax and accounting — to comply with our legal obligations (Article 6(1)(c)).
- To improve the service and prevent abuse — legitimate interest in running a safe, reliable business.
- For marketing — only with your consent, which you can withdraw at any time.
4. Who we share it with
We share your data with the following service providers:
- Google Firebase — authentication, database, and hosting
- Stripe — payment processing (subject to Stripe's Privacy Policy)
- Our delivery drivers, where applicable — they receive your name, phone number, address, and any delivery notes
We may also share information if required by law, court order, or to protect our rights and the safety of others. We do not sell your data.
5. International transfers
Most of your data stays in the United Kingdom or the EEA. Some of our processors — including Google and Stripe — may transfer data outside the United Kingdom. When this happens, transfers are protected by appropriate safeguards such as the United Kingdom's international data transfer agreement or the EU Standard Contractual Clauses.
6. How long we keep it
- Order records — typically kept for several years to comply with tax law (in the UK, 7 years)
- Account data — kept while your account is active. If you delete your account, we erase identifying information within 30 days, except records we must retain for legal reasons
- Usage logs — typically 90 days
7. Your rights
Under applicable data protection law you have the right to:
- Access the personal data we hold about you
- Rectify inaccurate or incomplete data
- Erase your data (subject to our legal obligation to keep order records)
- Restrict or object to certain processing
- Portability — receive a copy of your data in a machine-readable format
- Withdraw consent at any time, where consent is the lawful basis
- Complain to your local data protection authority — in the UK, the Information Commissioner's Office (ico.org.uk)
To exercise any of these rights, email [Privacy contact email not provided]. You can also delete your account directly from the account page — this removes most of your data automatically.
8. Cookies
We use a small number of essential cookies and similar storage to make the site work — to keep you signed in, remember your cart, and prevent fraud. These do not need consent under UK law.
We also use Firebase Analytics for anonymous usage statistics. You can opt out of analytics in your browser's privacy settings.
9. Security
We protect your data using industry-standard measures: encrypted connections (HTTPS), encrypted storage, access controls on our backend, and PCI-compliant payment processing via Stripe. No system is perfectly secure, but we take reasonable steps to protect your information.
10. Children
This service is not directed at children under 13. We do not knowingly collect data from children under 13. If you believe we have, please contact us and we will delete it.
11. Changes to this Policy
We may update this Policy from time to time. The "last updated" date at the top tells you when it last changed. Material changes will be communicated to you by email or an on-site notice.
12. Contact
For any privacy questions, email [Privacy contact email not provided].