Privacy Policy Last updated: April 2026 This privacy policy explains how we collect, use, and protect your personal information when you use our website and services. We are committed to protecting your privacy in accordance with the UK General Data Protection Regulation (UK GDPR) and the Data Protection Act 2018. 1. Who We Are We operate a food ordering and delivery service based in Newport, Wales, United Kingdom. If you have any questions about this privacy policy or how we handle your data, please contact us using the details provided on our Contact page. 2. Information We Collect We may collect and process the following personal data: • Name, email address, and phone number (when you create an account or place an order) • Delivery address and postcode • Payment information (processed securely via Stripe — we do not store your card details) • Order history and preferences • Device information, IP address, and browsing activity on our website • Communications you send to us (e.g. support enquiries) 3. How We Use Your Information We use your personal data for the following purposes: • To process and fulfil your orders • To create and manage your customer account • To communicate order updates, delivery status, and receipts via email • To improve our website, products, and customer experience • To send promotional offers and marketing communications (only with your consent) • To comply with legal obligations 4. Legal Basis for Processing Under UK GDPR, we process your data based on: • Contract performance — to fulfil your orders and provide our services • Legitimate interests — to improve our platform and prevent fraud • Consent — for marketing communications (you can withdraw consent at any time) • Legal obligation — to comply with tax, accounting, and regulatory requirements 5. Sharing Your Information We may share your information with: • Delivery personnel to fulfil your order • Payment processors (Stripe) to handle transactions securely • Email service providers to send order confirmations and receipts • Law enforcement or regulatory bodies when required by law We do not sell your personal data to third parties. 6. Data Retention We retain your personal data only for as long as necessary to fulfil the purposes described in this policy. Order records are kept for up to 7 years in accordance with UK tax and accounting requirements. You may request deletion of your account and associated data at any time. 7. Your Rights Under UK GDPR, you have the right to: • Access the personal data we hold about you • Rectify inaccurate or incomplete data • Erase your data (right to be forgotten) • Restrict or object to processing of your data • Data portability — receive your data in a structured, machine-readable format • Withdraw consent for marketing at any time To exercise any of these rights, please contact us via our Contact page. We will respond within 30 days. 8. Cookies Our website uses essential cookies to enable core functionality such as your shopping cart and login session. We may also use analytics cookies to understand how visitors use our site. You can manage cookie preferences through your browser settings. 9. Data Security We implement appropriate technical and organisational measures to protect your personal data, including encrypted connections (HTTPS), secure password hashing, and access controls. Payment data is processed by Stripe, which is PCI DSS Level 1 certified. 10. Children's Privacy Our services are not directed at individuals under the age of 16. We do not knowingly collect personal data from children. 11. Changes to This Policy We may update this privacy policy from time to time. Any changes will be posted on this page with an updated revision date. We encourage you to review this policy periodically. 12. Contact & Complaints If you have concerns about how we handle your data, you may contact the Information Commissioner's Office (ICO): Website: https://ico.org.uk Telephone: 0303 123 1113