Privacy Policy

1. Definitions and Interpretation

“Personal data” means any data that relates to an identifiable person who can be directly or indirectly identified from it — in this case, data you give us via our Site. This incorporates the definitions in UK GDPR. “We / Us / Our” means Sushi Home Town, a company whose registered address is St Margaret's Terrace, Inside Church Building, Bradford, BD7 3AP.

2. Information About Us

Our Site is operated by Sushi Home Town. We are the data controller for the personal data described in this policy — meaning we decide how and why it's used, even where a third party (such as our payment processor, described in section 5) is involved in handling it on our behalf.

3. What Does This Policy Cover?

This Privacy Policy applies only to your use of our Site. Our Site may contain links to other websites, provided for your convenience — we don't control how those sites collect, store, or use data, so please check their own privacy policies before providing any data to them.

4. Your Rights

4.1 As a data subject, you have the following rights under UK GDPR, which this policy and our use of your personal data are designed to uphold:

4.1.1 the right to be informed about our collection and use of your personal data;

4.1.2 the right of access to the personal data we hold about you (see section 12);

4.1.3 the right to rectification if any data we hold about you is inaccurate or incomplete;

4.1.4 the right to be forgotten — the right to ask us to delete your personal data. You can do this yourself at any time from your account's Preferences screen (“Delete My Account”), or by contacting us directly;

4.1.5 the right to restrict (prevent) our processing of your personal data;

4.1.6 the right to data portability — obtaining a copy of your personal data to reuse elsewhere. You can export your own data at any time from your account's Preferences screen (“Export My Data”);

4.1.7 the right to object to us using your personal data for particular purposes; and

4.1.8 rights relating to automated decision-making and profiling (we don't currently use either).

4.2 If you have any complaint about our use of your personal data, please contact us (section 14) and we'll do our best to resolve it. If we can't help, you have the right to lodge a complaint with the UK's supervisory authority, the Information Commissioner's Office (ICO).

5. What Data Do We Collect?

Depending on how you use our Site, we may collect:

5.1 your name;

5.2 contact details — email address and phone number;

5.3 a saved address, if you choose to add one to your account (we don't currently offer delivery — this is for your own reference, not dispatch);

5.4 your order history — items ordered, amounts paid, and order status;

5.5 your saved favourite menu items;

5.6 a hashed password, if you register an account directly (never your plain-text password); or your Google account identifier, if you sign in with Google instead;

5.7 your IP address, used for basic security and rate-limiting; and

5.8 standard technical data such as browser type and device information.

Card payments are handled entirely by our payment processor, Stripe — we never see or store your full card details ourselves. See section 8 for more on Stripe's role.

6. How Do We Use Your Data?

6.1 All personal data is processed and stored securely, for no longer than necessary for the reason it was collected. We comply with our obligations under UK GDPR at all times.

6.2 Our use of your data always has a lawful basis — either because it's necessary to perform a contract with you (e.g. taking and fulfilling your order), because you've consented, or because it's in our legitimate interests. Specifically, we may use your data to:

6.2.1 provide and manage your access to our Site and your account;

6.2.2 take, process, and fulfil your orders;

6.2.3 reply to enquiries you send us; and

6.2.4 keep our Site secure and improve how it works.

6.3 We don't currently run an email or SMS marketing programme. If that changes in future, we'll only contact you that way with your clear, opt-in consent, in line with UK GDPR and the Privacy and Electronic Communications Regulations — and you'll always be able to opt out.

6.4 You may withdraw your consent to our use of your personal data at any time, and request that we delete it.

7. How Do We Store Your Data?

We only keep your personal data for as long as we need it for the purposes described in section 6, or for as long as you've given us permission to keep it. Data security matters to us, and we take reasonable technical measures to protect data collected through our Site.

8. Do We Share Your Data?

8.1 We share the minimum data necessary with a small number of trusted third parties who help us run our Site and take payment: Stripe (our payment processor, for handling card payments), and Google (only if you choose to sign in with your Google account, for authentication). We don't sell your data to anyone.

8.2 We may sometimes use third-party infrastructure providers located outside the UK or EEA to store or process data on our behalf. Where that happens, we take reasonable steps to ensure your data is protected to the same standard as it would be under UK GDPR.

8.3 We may be legally required to share data we hold, including personal data, where required by law — for example in response to a court order or a request from a government authority.

9. What Happens If Our Business Changes Hands?

If we expand, restructure, or sell all or part of our business, any personal data you've given us may transfer as part of that change. The new owner would only be permitted to use it for the same purposes it was originally collected for, under the terms of this policy.

10. How Can You Control Your Data?

In addition to the rights in section 4, you can update or remove your saved details (name, phone number, addresses, favourites) directly from your account at any time, and export or delete your account entirely from the Preferences screen — see section 4.1.4 and 4.1.6.

11. Cookies & Similar Technology

11.1 Our Site currently uses only strictly necessary cookies and local browser storage — nothing more. Specifically:

11.1.1 a session cookie that keeps you signed in, set by our authentication system; and

11.1.2 local storage on your device to remember your cart if you're browsing as a guest.

11.2 We don't currently use analytics, advertising, or marketing cookies of any kind — for example, we don't use Google Analytics. Because we only use strictly necessary storage, UK cookie law doesn't require us to show a cookie consent banner, and we don't currently show one. If we ever add analytics or marketing cookies in future, this section and our Site will be updated accordingly, and consent will be requested where required.

11.3 You can still block or delete cookies and local storage yourself at any time through your browser's settings, though parts of our Site (like staying signed in, or keeping items in your cart) may stop working properly if you do.

12. How Can You Access Your Data?

You can export a copy of the personal data we hold about you at any time, yourself, from your account's Preferences screen (“Export My Data”). If you'd prefer, you can also contact us directly using the details in section 14 and we'll provide it to you.

13. Contacting Us

If you have any questions about our Site or this Privacy Policy, please email sushihometown@gmail.com, call +44 7404 138380 / +44 7460 508480, or write to us at St Margaret's Terrace, Inside Church Building, Bradford, BD7 3AP. Please be clear in your message, particularly if you're asking what data we hold about you (section 12).

14. Changes to This Policy

We may change this Privacy Policy from time to time — for example, if the law changes or we start using our data differently. Any changes will be posted on this page, and we recommend checking back occasionally.