Privacy notice

This notice explains how Havana Chippy ("we") uses your personal data under the UK GDPR and the Data Protection Act 2018.

What we collect

Account details: name, email address, telephone number, password (stored only as a secure hash).
Delivery addresses you save or use for an order.
Order history: items, prices, fees, delivery or collection details and any notes you add.
Payment information: payments are processed by Stripe. We receive the card brand, last four digits and payment status – never your full card number or security code.
Technical data needed to keep your account secure (session cookie, IP address for fraud and abuse prevention).

Why we use it (lawful basis)

To take, prepare, deliver and support your orders – performance of a contract.
To keep financial records – legal obligation (HMRC requires records for 6 years).
To prevent fraud and keep the service secure – legitimate interests.
To send offers, only if you opt in – consent (withdraw any time in your account).

Who we share it with

Stripe (payments), our email provider (order and account emails), our hosting and database providers. They act on our instructions. Delivery drivers see the name, phone number and address for your order.

How long we keep it

Account data is kept while your account is open. Personal details on orders are anonymised after about 6 years; anonymised financial records may be kept longer. You can delete your account at any time from your account page.

Your rights

You can access, correct, export or delete your data from your account page, object to processing, or complain to the Information Commissioner's Office (ico.org.uk). Contact us with any request.

Cookies

We use one strictly necessary cookie to keep you signed in, and your browser's local storage to remember your basket. We do not use advertising or analytics cookies.