This Privacy Policy explains how HEDEO FOODS ("we", "us", "our") collects, uses and protects the personal information you provide when using our website and ordering platform. We are committed to handling your data responsibly and in compliance with the UK General Data Protection Regulation (UK GDPR) and the Data Protection Act 2018.

1. Who we are

HEDEO FOODS is a UK-based food business and the data controller for the personal information collected through this website. If you have any questions about how we handle your data, please contact us via our Contact page.

2. What information we collect

We collect the following categories of personal information:

• Identity and contact details — your full name, email address, and phone number provided at checkout or when creating an account.
• Delivery information — your delivery address, where you select delivery as your fulfilment method.
• Order details — items ordered, quantities, fulfilment method (delivery or pickup), preferred date and time, and any special instructions.
• Order tracking token — a randomly generated, secure identifier linked to your order, stored in your browser to allow you to track your order without signing in.
• Account information — email address and password (stored in hashed form) if you create an account. Your account may also store your display name and order history.
• Catering and cooking enquiry details — event type, date, location, guest numbers, and any additional information you provide when submitting a catering or cooking service request.
• Communications — messages you send us via email, WhatsApp, or the contact form.

3. Lawful basis for processing (UK GDPR Article 6)

We process your personal information on the following lawful bases:

• Performance of a contract — processing is necessary to fulfil your order, deliver your food, and provide the services you have requested.
• Legitimate interests — we have a legitimate interest in preventing fraud, protecting the security of our systems, improving our service, and communicating with customers about their orders and enquiries.
• Legal obligation — we are required to retain certain records (such as transaction records) to meet our accounting, tax, and other legal obligations under UK law.

4. Payment information

When you pay online, your payment is processed by Stripe, our third-party payment provider. Your card details are entered directly into Stripe's secure, PCI-DSS-compliant environment. HEDEO FOODS never sees, handles, or stores your card number, expiry date, or CVV. We receive only a payment status confirmation and a transaction reference from Stripe. Stripe's own privacy policy governs how they handle your payment data.

5. Order tracking and guest access

If you place an order without creating an account, your order number and a secure order-specific token are stored in your browser's local storage. This allows the order tracking and order history features to work without you needing to sign in. You can clear this data at any time by clearing your browser's local storage or browsing data.

6. Cookies and local storage

We do not use advertising or analytics cookies. The following data is stored on your device:

• Cart contents (localStorage, hedeo_cart_v1) — items in your shopping basket, persisted between visits so you do not lose your cart.
• Checkout draft (localStorage, hedeo_checkout_draft_v1) — your in-progress checkout details (name, contact, delivery preference) saved so you can resume where you left off. Cleared when you complete or abandon checkout.
• Review vote history (localStorage, hf_helpful_votes) — a list of review IDs you have marked as helpful, so the button shows as already voted when you return.
• Review session identifier (sessionStorage, hf_voter_fp) — a randomly generated identifier created when you visit the Reviews page, used to prevent duplicate "helpful" votes. Cleared automatically when you close your browser tab.
• Authentication session (localStorage, Supabase auth keys) — if you sign in to an account, your session token is stored locally to keep you logged in. Cleared when you sign out.
• Admin sidebar preference (cookie, sidebar_state, 7 days) — stores whether the admin sidebar is expanded or collapsed. Only set for admin users who are signed in.
• Stripe fraud-prevention cookies (_stripe_mid, _stripe_sid) — set by Stripe when you reach the payment step. Used by Stripe to prevent fraudulent transactions. These cookies are strictly necessary to process payments securely and are governed by Stripe's own privacy policy.

7. How we use your information

• To process, prepare and fulfil your food order or service booking.
• To contact you about your order status, delivery, or catering/cooking request.
• To send order confirmation, status update, and payment confirmation emails.
• To invite you to leave a review after your order is completed (you may opt out at any time).
• To respond to your enquiries and support requests.
• To meet our accounting, tax, and other legal obligations.
• To detect and prevent fraud and abuse of our website and services.

8. Who we share your information with

We share your personal information only with the third-party service providers we rely on to run our business, and only to the extent necessary to provide our services:

• Stripe — payment processing. Your payment data is subject to Stripe's privacy policy.
• Supabase — our database and authentication infrastructure provider. Your data is stored on Supabase's servers in compliance with their data processing terms.
• Resend — our email delivery provider, used to send order confirmations, status updates, and other transactional emails.

We do not sell, rent, or trade your personal information with any third party for marketing purposes.

9. International data transfers

Some of our service providers may process data outside the UK or European Economic Area (EEA). Where this occurs, we ensure that appropriate safeguards are in place — such as Standard Contractual Clauses or an adequacy decision — as required by UK GDPR.

10. Data retention

We retain your personal information for as long as necessary to fulfil the purposes described in this policy and to meet our legal obligations. In practice:

• Order and transaction records are retained for a minimum of 6 years to comply with HMRC accounting and tax requirements.
• Account information is retained for as long as your account is active. You may request deletion of your account at any time.
• Enquiry and communication records are retained for a reasonable period to support ongoing customer relationships and any potential disputes.

11. Your rights under UK GDPR

As a UK resident, you have the following rights in relation to your personal data:

• Right of access — you may request a copy of the personal data we hold about you.
• Right to rectification — you may ask us to correct inaccurate or incomplete data.
• Right to erasure — you may ask us to delete your personal data where there is no compelling reason for us to continue holding it (subject to legal retention obligations).
• Right to restriction of processing — you may ask us to restrict how we use your data in certain circumstances.
• Right to data portability — you may request a copy of data you provided to us in a structured, machine-readable format.
• Right to object — you may object to processing based on our legitimate interests.

To exercise any of these rights, please contact us via our Contact page. We will respond within one calendar month.

12. Right to complain

If you believe we have handled your personal data unlawfully, you have the right to lodge a complaint with the Information Commissioner's Office (ICO), the UK's data protection supervisory authority, at ico.org.uk. We would, however, appreciate the opportunity to address your concerns before you contact the ICO.

13. Changes to this policy

We may update this Privacy Policy from time to time to reflect changes in our practices or applicable law. The date at the top of this page shows when it was last revised. We encourage you to check this page periodically.

14. Contact

For any questions, requests, or concerns regarding your personal data, please contact us via our Contact page.