Privacy Policy

CurryCrepe ("we", "us") is a home-cooking service operated from Whitburn, Scotland. We are the data controller responsible for your personal data. This policy explains what we collect, why, and your rights under the UK GDPR and Data Protection Act 2018.

To fulfil orders: your name, email address, phone number, collection date/slot, order details and notes.

For payments: card payments are processed by Stripe. We do not store your card details — only a transaction reference linked to your order.

For loyalty: your email is used to track loyalty stamps and rewards.

For reviews: your name and the review you choose to submit.

Marketing: your email, only if you explicitly subscribe.

We process your personal data under the following UK GDPR lawful bases:

• Contract — to take and fulfil your order, process payment, and arrange collection.
• Legal obligation — to retain financial/transaction records for tax and accounting purposes.
• Legitimate interests — to operate the loyalty programme, respond to queries, and prevent fraud.
• Consent — for marketing emails and dish reviews, which you can withdraw at any time.

We keep your personal data only as long as necessary:

• Order & payment records: retained for up to 6 years for tax, accounting and dispute-resolution purposes, as required by law.
• Loyalty data: kept while your account is active, and deleted if you delete your account.
• Marketing subscriptions: until you unsubscribe or delete your account.
• Reviews: kept while relevant, with author identity removed if you delete your account.

You have the right to request erasure of your personal data. You can do this at any time from your account page.

When you request deletion, a 30-day grace period begins. During this period you can cancel the request and reinstate your account by simply signing back in. We'll send you a reminder 15 days and 7 days before permanent deletion, so you have every chance to change your mind.

• Access: request a copy of the personal data we hold about you.
• Rectification: correct inaccurate or incomplete data.
• Restriction / objection: ask us to limit or stop certain processing.
• Portability: receive your data in a structured, machine-readable format.
• Withdraw consent: for marketing and reviews, at any time.

To exercise any of these rights, contact us. We'll respond within one month.

We don't sell your data. We share it only with: Stripe (payment processing), and our email provider (transactional and marketing emails). Each processor acts under strict contractual data-protection terms.

Your data is stored on secure cloud infrastructure with access controls. Payment data never touches our servers. We limit access to personal data to those who need it to run the Service.

If you're not happy with how we handle your data, you have the right to complain to the Information Commissioner's Office (ICO) at ico.org.uk. We'd appreciate the chance to put things right first — please contact us.

We may update this policy from time to time. We'll notify you of significant changes where we're required to.