Privacy Policy

1. Who We Are

We are committed to protecting your personal data. This Privacy Policy explains what information we collect, why we collect it, how we use it, and your rights under the UK General Data Protection Regulation (UK GDPR) and the Data Protection Act 2018.

2. What Personal Data We Collect

When you place an order

• Full name (first and last name)
• Email address
• Phone number
• Delivery address (street, city, postcode)
• Order details (items ordered, quantities, special instructions)
• Payment information (processed securely — we do not store full card details)

When you browse our website

• Browser type and version
• Pages visited and time spent
• IP address (anonymised where possible)
• Referring URL
• Cookie data (see Section 7)

Data stored in your browser (localStorage)

To improve your experience, we store the following locally in your browser — this data never leaves your device unless you place an order:

• Your saved delivery address and postcode (to pre-fill the checkout form on repeat visits)
• Your last order items (to show the Order Again section)
• Your delivery zone and shipping cost (cached to avoid repeat lookups)

You can clear this data at any time by clearing your browser local storage or site data.

3. Legal Basis for Processing

Order fulfilment	Contract performance — Art. 6(1)(b) UK GDPR. We need your name, address, phone and email to prepare and deliver your order.
Payment processing	Contract performance — Art. 6(1)(b) UK GDPR.
Legal obligations	Legal obligation — Art. 6(1)(c) UK GDPR. We are required to retain financial records for 6 years under HMRC rules.
Website analytics	Legitimate interests — Art. 6(1)(f) UK GDPR. To understand how our website is used and improve it.
Marketing (if applicable)	Consent — Art. 6(1)(a) UK GDPR. We will only send you marketing emails if you have explicitly opted in.

4. How We Use Your Data

• Processing and fulfilling your food order
• Contacting you about your order (e.g. delivery status, issues)
• Processing payment for your order
• Complying with our legal and regulatory obligations (food safety, tax records)
• Improving our website and service
• Responding to your enquiries or complaints

We do not sell your personal data to third parties. We do not use your data for automated decision-making or profiling.

5. Who We Share Your Data With

Service providers

We share data only where necessary with trusted third parties:

• Hosting provider: Hostinger (server located in EU/UK). Your data is stored on their servers.
• Payment processors: WooCommerce Payments / Stripe (if online payment is used). They are PCI-DSS compliant and have their own privacy policies.
• Delivery drivers: Your name, phone number, and delivery address are shared with our delivery personnel to complete your order.

Legal disclosures

We may disclose your data if required by law, court order, or to protect the rights and safety of our business, staff, or customers.

6. Data Retention

Order records	6 years (required by HMRC / Companies Act 2006)
Customer contact data	2 years after your last order, then deleted
Website analytics	Up to 26 months (standard analytics retention)
Browser localStorage	Until you clear your browser data — we do not control this

7. Cookies

Our website uses the following types of cookies:

Strictly necessary cookies

Required for the website to function. These include your WooCommerce shopping cart session and security tokens. You cannot opt out of these.

Functional cookies

Remember your preferences (e.g. saved delivery address). These are stored as browser localStorage, not traditional cookies.

Analytics cookies

We may use anonymous analytics (e.g. Google Analytics) to understand website traffic. These collect no personally identifiable information. You can opt out via browser settings.

To manage cookies, you can adjust your browser settings. Note that disabling certain cookies may affect the functionality of our website.

8. Your Rights Under UK GDPR

• Right of access — You can request a copy of the personal data we hold about you.
• Right to rectification — You can ask us to correct inaccurate or incomplete data.
• Right to erasure (right to be forgotten) — You can ask us to delete your data, subject to our legal retention obligations.
• Right to restrict processing — You can ask us to pause processing of your data in certain circumstances.
• Right to data portability — You can request your data in a structured, machine-readable format.
• Right to object — You can object to processing based on legitimate interests.
• Right to withdraw consent — Where processing is based on consent, you may withdraw it at any time.

To exercise any of these rights, contact us at info@sushiolaland.co.uk. We will respond within 30 days.

9. Right to Complain

If you are unhappy with how we handle your data, you have the right to complain to the UK data protection authority:

We would appreciate the opportunity to address your concerns before you approach the ICO, so please contact us first.

10. Data Security

We take appropriate technical and organisational measures to protect your personal data against unauthorised access, loss, or disclosure. These include SSL/TLS encryption on all data transmissions, secure hosting with Hostinger, and restricted access to order data.

In the event of a data breach that is likely to result in a risk to your rights and freedoms, we will notify you and the ICO without undue delay as required by UK GDPR.

11. Children Privacy

Our website and services are not directed at children under the age of 13. We do not knowingly collect personal data from children. If you believe a child has provided us with personal data, please contact us and we will delete it promptly.

12. Changes to This Policy

We may update this Privacy Policy from time to time. When we do, we will update the Last updated date at the top of this page. For significant changes, we will make a reasonable effort to notify you.

13. Contact Us