Privacy Policy
Last updated: January 2025
1. Introduction
INDIANAROMAFLAVOURS LIMITED ("we", "us", "our") is committed to protecting your personal data and respecting your privacy. This Privacy Policy explains how we collect, use, store, and share your information when you use our website ( indianaromaflavours.co.uk) and food ordering service.
We comply with the UK General Data Protection Regulation (UK GDPR) and the Data Protection Act 2018.
2. What Data We Collect
We collect the following personal information when you place an order or create an account:
- Full name
- Email address
- Phone number
- Delivery address and postcode
- Order history and preferences
- Payment information (processed securely via Stripe — we do not store card details)
- Account login credentials (password stored in encrypted form)
3. Why We Collect Your Data
We use your personal data for the following purposes:
- Processing and fulfilling your food orders
- Delivering orders to your specified address
- Communicating order updates and delivery status
- Managing your account and order history
- Processing payments securely
- Improving our service and menu offerings
- Complying with legal obligations
The legal basis for processing your data is the performance of a contract (fulfilling your order) and our legitimate interests in operating our business.
4. How We Store Your Data
Your personal data is stored securely in our PostgreSQL database. We implement the following security measures:
- Passwords are hashed using industry-standard encryption (bcrypt)
- All data transmission is encrypted via HTTPS/TLS
- Access to personal data is restricted to authorised personnel only
- Regular security updates and monitoring
5. Third Parties
We share your data with the following third-party services:
- Stripe — for secure payment processing. Stripe handles your card details directly and is PCI DSS compliant. See Stripe's Privacy Policy.
We do not sell your personal data to any third parties.
6. Data Retention
We retain your personal data for the following periods:
- Account information: retained while your account is active, deleted within 30 days of account deletion request
- Order history: retained for 6 years for tax and legal compliance purposes
- Payment records: retained for 6 years as required by HMRC
- Marketing preferences: retained until you withdraw consent
7. Your Rights Under GDPR
Under the UK GDPR, you have the following rights:
- Right of access — request a copy of the personal data we hold about you
- Right to rectification — request correction of inaccurate or incomplete data
- Right to erasure — request deletion of your personal data ("right to be forgotten")
- Right to data portability — request your data in a machine-readable format
- Right to restrict processing — request that we limit how we use your data
- Right to object — object to processing based on legitimate interests or direct marketing
- Right to withdraw consent — withdraw consent at any time where processing is based on consent
To exercise any of these rights, please contact us at info@indianaromaflavours.co.uk. We will respond to your request within 30 days.
9. Changes to This Policy
We may update this Privacy Policy from time to time. Any changes will be posted on this page with an updated "Last updated" date. We encourage you to review this policy periodically.
10. Contact Us
If you have any questions about this Privacy Policy or wish to exercise your data rights, please contact us:
- Email: info@indianaromaflavours.co.uk
- Business: INDIANAROMAFLAVOURS LIMITED
- Website: indianaromaflavours.co.uk
If you are not satisfied with our response, you have the right to lodge a complaint with the Information Commissioner's Office (ICO) at ico.org.uk.