Privacy Policy

1. Information We Collect

We collect the following categories of personal data:

• Account Data: Name, email address, phone number, delivery address, and password when you create an account.
• Order Data: Items ordered, delivery address, payment method (last 4 digits only), order history, and preferences.
• Communication Data: Messages, feedback, reviews, and customer service correspondence.
• Device Data: IP address, browser type, device type, operating system, and screen resolution.
• Usage Data: Pages visited, time on site, click patterns, and browsing behaviour.
• Location Data: Approximate location based on IP address or postcode entry (with your consent).
• Cookie Data: See our Cookie Policy for full details.

2. How We Use Your Data

Purpose	Legal Basis
Processing and delivering your orders	Contract performance
Managing your account	Contract performance
Sending order updates and receipts	Contract performance
Sending marketing emails and offers	Consent
Personalising your experience	Legitimate interests
Improving our website and services	Legitimate interests
Fraud prevention and security	Legitimate interests
Complying with legal obligations	Legal obligation

3. Data Sharing

We share your personal data only with the following categories of recipients:

• Delivery Partners: Deliveroo, Uber Eats, Just Eat — to fulfil delivery orders.
• Payment Processors: Stripe, PayPal — to process payments securely.
• Analytics Providers: Google Analytics — to understand how our website is used.
• Marketing Platforms: Mailchimp, Meta, Google Ads — for marketing communications (with consent).

We never sell your personal data to third parties.

4. Data Retention

• Account data: Retained while your account is active, then deleted 30 days after account closure.
• Order data: Retained for 6 years for tax and legal compliance.
• Marketing data: Retained until you withdraw consent or unsubscribe.
• Cookie data: Varies by cookie — see Cookie Policy.

5. Your Rights

Under UK GDPR, you have the following rights:

• Access: Request a copy of the personal data we hold about you.
• Rectification: Request correction of inaccurate or incomplete data.
• Erasure: Request deletion of your personal data ("right to be forgotten").
• Restriction: Request restriction of processing in certain circumstances.
• Objection: Object to processing based on legitimate interests or direct marketing.
• Portability: Request transfer of your data to another service provider.
• Withdraw Consent: Withdraw consent at any time where processing is based on consent.

To exercise any of these rights, contact us at [email protected]. We will respond within 30 days.

6. Data Security

We implement appropriate technical and organisational measures to protect your personal data, including SSL/TLS encryption for all data in transit, encrypted storage for sensitive data, regular security audits and penetration testing, and employee training on data protection.

7. International Transfers

Your data is primarily stored within the UK and EEA. Where we use service providers based outside the UK (such as cloud infrastructure), we ensure appropriate safeguards are in place, including Standard Contractual Clauses approved by the ICO.

8. Children's Privacy

Our services are not directed at individuals under the age of 16. We do not knowingly collect personal data from children under 16. If you believe we have inadvertently collected such data, please contact us immediately.

9. Complaints

If you are unhappy with how we handle your personal data, please contact us first at [email protected]. You also have the right to lodge a complaint with the Information Commissioner's Office (ICO) at ico.org.uk or by calling 0303 123 1113.

10. Changes to This Policy

We may update this policy from time to time. Material changes will be communicated via email or a prominent notice on our website. We encourage you to review this page periodically.