Privacy policy
This policy explains how Acomb Pizza & Kebab House ("we", "us", "our") collects, uses and protects your personal data when you use this website and order from us. We comply with the UK General Data Protection Regulation (UK GDPR) and the Data Protection Act 2018.
Who we are
The data controller for your personal data is Acomb Pizza & Kebab House, of 2 Front Street, York, YO24 3BQ. You can contact us about your data by phone on 01904 785588.
What data we collect
- Order data: your name, email address, phone number, delivery address (where applicable), the items in your order, and the time of ordering.
- Account data: if you create an account, your contact details and your order history. If you save a card for future orders, it is stored securely by Stripe — we never see or hold your full card number.
- Payment data: card payments are processed by Stripe. We receive a transaction reference and the last four digits of the card; we never see or store the full card number.
- Marketing preferences: your email and/or SMS marketing choices, with the date you made them.
- Technical data: minimal access logs (IP address, page requested, time) for security and abuse prevention.
Why we use it
- To take, prepare, and deliver or hand over your order — performance of a contract.
- To send order confirmations, "ready time" updates and receipts by email or SMS — performance of a contract.
- To keep records we are legally required to keep, such as tax records — legal obligation.
- To send you marketing about offers and new menu items, by email and/or SMS. The email and SMS marketing boxes are both pre-selected at checkout for customers placing an order; you can untick either before you order, and you can opt out at any time afterwards — use the unsubscribe link in any email, or reply STOP to any text message (legitimate interests).
- To prevent fraud and abuse, and to keep the service secure — legitimate interests.
Who we share it with
We use a small number of trusted processors, only as far as needed to run the service:
- Cloudflare — website hosting and protection.
- Stripe — card payment processing.
- Resend — sending order and account emails.
- Twilio — sending SMS messages (only where relevant).
We never sell your personal data.
How long we keep it
- Order and transaction records: 6 years, to meet HMRC requirements.
- Marketing preferences: until you unsubscribe, plus up to 2 years as evidence of your choice.
- Access logs: a short period for security purposes only.
Your rights
You have the right to access, correct or delete the personal data we hold about you, to restrict or object to how we use it, and to data portability. To exercise any of these, contact us by phone on 01904 785588. You also have the right to complain to the Information Commissioner's Office (ICO) at ico.org.uk.
Cookies
We do not use advertising or tracking cookies. The site uses only the essential storage needed to keep your basket and to keep staff signed in to the orders dashboard.
Changes to this policy
If we change this policy we will update the "Last updated" date above. Please check back from time to time.