Privacy notice

Who controls your data

The controller is Austin's Dad Limited, at Austin's Dad Ltd, registered office to be confirmed, United Kingdom. Contact mattystjh@gmail.com about this notice or your rights.

What we collect

• Contact details, delivery or collection choice, address and order instructions.
• Basket, allergen selections, payment status, refunds, tips and loyalty history.
• Order progress, courier tracking and delivery evidence needed to fulfil the order.
• Security and dispute evidence such as IP address, device identifier, browser or app details, timestamps and relevant account or order activity.
• Optional product analytics events when analytics is enabled; we do not use ad tracking or session replay in the customer ordering flow.

Why we use it and our lawful bases

• Contract: quote, take payment, prepare, deliver, support and refund your order.
• Legal obligation: maintain VAT, accounting, food-safety and consumer records.
• Legitimate interests: prevent fraud, secure the service, defend payment disputes, measure reliability and improve ordering, balanced against your rights.
• Consent: only for genuinely optional features that ask for it, such as product analytics or saving a payment method. You can withdraw future consent without affecting prior lawful use.

The contact, fulfilment and payment information requested at checkout is needed to perform the order contract. We do not add a consent checkbox for that necessary processing.

Who receives it

We share only what is needed with Stripe for payment processing, the selected in-house or third-party courier for fulfilment and tracking, hosting and security providers, and our configured product-analytics processor. Professional advisers, insurers, tax authorities, regulators or law enforcement may receive records where legally required or needed to establish or defend claims. We do not sell customer data.

International transfers

Some processors may handle data outside the UK. Where UK adequacy regulations do not apply, the controller must use an approved safeguard such as the UK International Data Transfer Agreement or UK Addendum, assess the transfer risk, and provide details on request.

How long we keep it

• Cart and short-lived session data: only as long as needed to complete or recover an order.
• Order, payment, VAT and accounting records: normally six years plus the current period.
• Fraud and dispute evidence: for the applicable chargeback or legal-claims period.
• Courier live location: only for fulfilment and a short support window, then minimised.
• Analytics events: according to the configured processor retention, kept no longer than needed.

These periods may be extended for an active dispute, legal hold or statutory requirement.

Your rights and complaints

Depending on the circumstances, you can ask for access, correction, deletion, restriction, portability or objection, and can withdraw optional consent. Contact the address above; we may need to verify your identity. You may also complain to the UK Information Commissioner at ico.org.uk/make-a-complaint.