Privacy Policy

Spice Hut is run by Muhammad Mustafa Chohan, trading as Spice Hut, at 128–130 Bradshawgate, Bolton BL2 1AY. We’re a sole trader, not a limited company.

We decide what happens to the personal information you give us when you order, which makes us the “data controller” for it. We’re registered with the Information Commissioner’s Office, reference ZC229514. If you have any question about this policy, or you want us to do something with your information, email spicehutbolton@gmail.com or phone 01204 528885.

When you place an order we collect:

• your name;
• your phone number;
• for delivery, your address and postcode;
• what you ordered, what it cost, and when;
• anything you write in the note box on your order.

That is all of it. We don’t ask for your email address, we don’t ask you to create an account, and there are no customer passwords anywhere in our system — you order as a guest every time.

We collect this for one reason: to make and deliver your order. In data-protection language, our lawful basis is performance of a contract— we can’t cook your food and bring it to you without knowing what you want, who you are and where you live.

Payment is handled by Stripe. Your card number goes from your browser straight to Stripe and is never sent to, seen by, or stored on our systems. Stripe shows us a few basic details of the card, such as the last four digits and the expiry date, so we can match a payment to your order and refund you if we need to.

When an order is submitted we log the IP addressit came from, in a counter that stops one person flooding the shop with fake orders. It’s kept for about an hour and then deleted, it’s not attached to your order, and it’s never written to our logs. Our basis for this one is legitimate interests— keeping the ordering system usable for everybody — rather than the contract.

We don’t keep your personal details for longer than 120 days after your order. After that your name, phone number, address and any note you left are removed from the order for good.

We keep the rest — what was ordered, the prices, the totals, the times and the order’s status — indefinitely, without any of the details that identify you. Those are our accounting records.

Why 120 days and not less:if a customer disputes a card payment, the card schemes give them roughly that long to do it, and the evidence we’d need to show the order was genuinely made and delivered is the address and the phone number. Deleting them sooner would leave us unable to answer a dispute — including a dispute raised in your name by someone who wasn’t you.

When your details are deleted they’re removed from our live systems straight away. Our database provider also takes an automatic backup of the whole database once a day, and a copy of your details can remain in those backups for up to 14 days afterwards.

Nobody reads those backups in the meantime — they exist only so the shop can recover from a technical failure — and each one is deleted automatically as it ages out. A copy can’t sit in a backup for longer than that.

Three companies, and only because the shop can’t run without them:

Our own drivers deliver the food. We don’t use a delivery company, so nobody outside the shop is given your address. We don’t sell your information, we don’t share it for advertising, and we don’t send marketing of any kind.

When you type a postcode, we check it’s a real one using a free public postcode service — but we make that request from our server, not your browser, so that service never sees your postcode alongside anything else about you.

Some of your information reaches the United States, and we’d rather say so than imply otherwise. Stripe, Supabase and Vercel are all American companies.

Stripe — your payment. Stripe is in the United States, and your payment details are transferred there. Our agreement with them provides for that transfer under the UK Extension to the EU–U.S. Data Privacy Framework — an arrangement the UK government has formally recognised as protecting your information to UK standards — and, where the Framework does not apply, under the Standard Contractual Clauses described below.

Supabase and Vercel — your order, and this website. Both are in the United States, and your information is transferred there. Our agreements with them provide for those transfers under the Standard Contractual Clauses approved by the European Commission, together with the UK International Data Transfer Addendumapproved by the Information Commissioner’s Office. These are standard legal terms that bind a company outside the UK to protect your information to UK standards. If you would like a copy of either, ask us and we’ll send it.

You can ask us to:

• show you what we hold about you;
• correctanything that’s wrong;
• delete it.

Email spicehutbolton@gmail.comand say which. For deletion we’ll ask for the phone number you ordered with, because that’s how we find your orders — we match it exactly, so that nobody can go fishing for somebody else’s. We’ll normally do it within a few days, and always within one month.

Deleting removes your name, phone number, address and note from your past orders — see Backupsabove for what that means for our backup copies. We keep the order itself — the items, prices and dates — because we’re required to retain business records, and once your details are gone it’s no longer information about you.

We use no analytics, no advertising and no tracking of any kind. There’s no Google Analytics on this site, no advertising pixel, and nothing that follows you to other websites. That’s why you haven’t been asked to accept cookies: there’s nothing to accept.

What is stored on your device:

• Your basket, kept by your browser while the tab is open and thrown away when you close it. It holds what you picked. It contains no name, no identifier, and nothing that could be used to recognise you.
• Stripe’s own storage, set while the checkout page prepares the payment form. Stripe uses it to detect fraudulent card use. It’s set by Stripe, on Stripe’s own domain, and we can’t read it.

Staff signing in to the kitchen system get a login cookie. That isn’t something a customer ever receives.

If you think we’ve handled your information badly, please tell us first — email spicehutbolton@gmail.comand we’ll look into it.

You also have the right to complain to the Information Commissioner’s Office, the UK regulator, at ico.org.uk/make-a-complaint or on 0303 123 1113. You can go to them without coming to us first.

If we change this policy we’ll change the date at the top. If we ever start doing something materially different with your information — for example adding analytics — we’ll update this page before we do it, not afterwards, and add a cookie banner if one becomes necessary.

Our terms and conditions and our refunds and delivery policy sit alongside this page.