Privacy Policy
This policy explains what personal information this restaurant collects when you order through this website, and how it's used.
Who's responsible for your data
this restaurant takes your orders and prepares your food - for the purposes of data protection law, this restaurant is the "data controller" for the personal information in your order (your name, contact details, and what you ordered). Our ordering platform provider processes that data on this restaurant's behalf as a "data processor," under a data processing agreement, and never uses it for its own purposes. If you have a question about your data, or want to exercise any of the rights below, contact this restaurant directly using the details on our Restaurant Info page.
What we collect
When you place an order: your name, email address, and phone number; your delivery address, if you order delivery; details of what you ordered, including any allergen information you're shown; and payment confirmation from Stripe (we never see or store your full card details - Stripe handles that directly). If you opt in to marketing, we also keep a record of that consent and when you gave it.
How we use it, and our lawful basis
We use your order details to take payment, prepare and fulfil your order, and get it to you. This is necessary to perform our contract with you. We also use order data to meet our legal obligations - for example keeping financial records for tax purposes. If you've opted in, we may email or text you about offers or news - only ever with your consent, and you can withdraw it at any time.
Cookies
This site only sets strictly-necessary cookies - the ones needed to process payment securely at checkout. We don't use analytics, advertising, or tracking cookies. Full details are in our Cookie Policy.
Marketing
We only send marketing emails or texts if you've actively opted in - the checkbox is never pre-ticked. Every marketing message includes a clear way to unsubscribe or reply STOP, which we action immediately.
Who we share it with
We use the following service providers to run this website, each under a data-processing agreement:
- Supabase - database, authentication, and realtime hosting
- Stripe - payment processing and fraud prevention
- Resend - transactional and marketing email delivery
- Twilio - SMS delivery. Reserved for a future feature and not currently used: we don't send any text messages yet, and no data about you has been shared with Twilio. We're naming them here in advance so this list is complete on the day SMS notifications go live.
- Cloudflare - content delivery and network security
We don't sell your data, and we don't share it with anyone for their own marketing purposes.
How long we keep it
We keep order records for around six years, in line with UK tax record-keeping requirements. If you ask us to delete your data (see "Your rights" below), we remove your personal details from past orders but keep the underlying financial record - amounts, dates, VAT - in a de-identified form for that same retention period, since we're legally required to. Marketing consent records are kept for as long as you're subscribed, plus a short period afterwards so we can demonstrate when and how you opted in or out.
Your rights
Under UK data protection law, you can ask us to:
- Access a copy of the personal data we hold about you
- Correct inaccurate details (for example a mistyped name or email)
- Erase your personal data, subject to our legal duty to retain financial records for tax purposes as described above
To exercise any of these rights, contact this restaurant using the details on our Restaurant Info page. We'll verify your identity before actioning any request.
This website is operated by this restaurant.