Privacy notice
Plain English, no small print. Questions? Just ask us.
Draft: this document is awaiting review by The Sarnie Shack and isn't in force yet. Text in [square brackets] still needs to be filled in.
This notice explains what personal information The Sarnie Shack collects, why, and what rights you have. We've tried to keep it short and in plain English. If anything isn't clear, just ask us.
1. Who we are
[The Sarnie Shack's legal name, e.g. sole trader name or Ltd company name], trading as The Sarnie Shack, 424a Sipson Road, West Drayton UB7 0HU, is the "controller" of your personal information. That means we decide how it's used and we're responsible for looking after it.
ICO registration number: [number, once registered with the Information Commissioner's Office].
Questions about your data: email hello@thesarnieshack.co.uk.
2. Visiting our website
- No tracking or advertising cookies. We don't use analytics, advertising or social media tracking.
- Fonts: our pages load fonts from Google Fonts, so your browser sends your IP address to Google to download them. Google's privacy policy.
- Map: the map on our Visit us page is provided by Google Maps. Google may set its own cookies when the map loads.
- Ordering through Just Eat: when you click "Order online" you go to Just Eat, which handles that order under its own privacy policy.
- Storage on your device: if you use school meals, your browser stores your sign-in session and the lunches you've picked but not yet paid for. This is essential for the service to work, so it doesn't need your consent. Signing out removes your session.
3. School meals: what we collect
If you register to order school lunches, we collect:
| About | Information | Where it comes from |
|---|---|---|
| You (parent or carer) | Name, email address, phone number (optional), which school | You, when you register |
| Your child | First and last name, class | You |
| Your child's health | Allergies and any notes you add (see section 4) | You |
| Orders | What you ordered for which days, notes for us, amounts paid and refunded | You, and our payment provider |
| Payments | A payment reference, the amount and the date. We never see or store your card number. | Stripe |
| Sign-ins | When you signed in, and technical details such as IP address and browser, used for security | Your device |
We only ask for what we need. We don't need your child's date of birth, photo or any other details.
4. Your child's allergy information
Allergy information is health information, which the law treats as especially sensitive. We use it only to:
- stop you ordering items containing your child's allergens on our website;
- show our kitchen staff your child's allergies next to their order, so food is prepared and labelled with care; and
- [label your child's lunch with their name, class and allergies so school staff hand the right lunch to the right child].
We rely on your explicit consent to use it. You give it by ticking the consent box when you add allergy information to your child's profile, and we record when you did. You can change or remove it at any time on the School meals page. If you remove it, our website can no longer warn you about unsuitable items.
Our website's allergy check is a safety aid, not a guarantee. Please also read the allergy section of our terms.
5. Why we use it (lawful bases)
| What we do | Lawful basis (UK GDPR) |
|---|---|
| Set up your account, take, prepare and deliver orders, take payment and give refunds | Contract: we need it to provide the service you asked for (Article 6(1)(b)) |
| Use your child's allergy information | Your explicit consent (Articles 6(1)(a) and 9(2)(a)) |
| Contact you about an order (e.g. a problem, a substitution, a refund) | Contract, and our legitimate interest in running the service well (Article 6(1)(f)) |
| Keep financial records | Legal obligation: tax and accounting law (Article 6(1)(c)) |
| Keep the service secure and prevent misuse | Legitimate interests (Article 6(1)(f)) |
We don't send marketing emails, sell your data, or use it to make automated decisions that affect you legally.
6. Who we share it with
Only with companies that help us run the service, under contracts that require them to protect it:
- Supabase: stores our database and handles sign-ins. Our data is stored in their London, UK data centre.
- Stripe: processes card payments and refunds and sends your receipts. Stripe also uses payment information for its own legal and fraud-prevention purposes. Stripe's privacy policy.
- [Brevo]: sends our sign-in emails (and order emails, if we add them).
- Lady Nafisa School: [school staff see your child's name, class and lunch on the delivered food so they can hand it out. We don't share your account, payment or contact details with the school.]
Some of these companies are based outside the UK or may access data from outside it (for example for support). Where that happens, transfers are protected by approved safeguards such as the UK International Data Transfer Agreement or Addendum, or a UK adequacy decision.
We'll only share information with anyone else if the law requires it (for example, the police with a valid request).
7. How long we keep it
- Your account and children's details: while your account is open. If you remove a child, we delete them straight away unless they have past orders (see next point).
- Orders and payment records: 6 years after the end of the financial year they relate to, because tax law requires it. Past orders keep the child's name and class so our records stay accurate.
- Allergy information: [we delete allergy details of removed children, and of accounts closed or unused for 12 months, within 30 days].
- Sign-in records: [up to 90 days].
To close your account and delete your data, email us (see section 10).
8. Keeping it safe
- All connections to our website are encrypted (HTTPS).
- Each parent can only see their own account, children and orders. This is enforced by our database, not just the website.
- Only named cafe staff accounts can see orders, children and allergies, and only for preparing and delivering lunches.
- Card details are handled entirely by Stripe and never reach our systems.
9. Your rights
You have the right to:
- see the information we hold about you and your child (a "subject access request");
- correct anything that's wrong (you can edit most of it yourself on the School meals page);
- delete your information, unless we must keep it (for example financial records);
- withdraw consent for allergy information at any time, by removing it;
- object to or restrict how we use it in some cases; and
- receive a copy of information you gave us, in a common format.
Email us to use any of these rights. We'll reply within one month and won't charge you.
10. Contact and complaints
Email hello@thesarnieshack.co.uk, call [phone number], or write to us at 424a Sipson Road, West Drayton UB7 0HU.
If you're unhappy with how we've handled your information, please tell us first so we can put it right. You can also complain to the Information Commissioner's Office (ICO): ico.org.uk/make-a-complaint, helpline 0303 123 1113.
We'll update this notice if anything changes and show the date at the top. If the changes are significant, we'll email registered parents.