Privacy Policy

• Your name, phone number and email address.
• Your delivery address (for delivery orders).
• Your order details and order history with us.
• Any notes you add to an order. Please don't include sensitive information you don't want us to hold.
• Payment is handled by Stripe. We never see or store your full card details.
• Data stored on your own device (in your browser's local storage) to remember your details, basket and last order. We do not use tracking or advertising cookies.

Some of this is necessary to serve you: without a contact number and, for delivery, an address, we cannot accept or deliver your order.

• To take, prepare, deliver and support your order (performance of our contract with you).
• To send order updates by SMS or email (performance of our contract).
• To run our loyalty scheme where you take part (performance of our contract with you for the scheme).
• To prevent fraud and keep the service secure (our legitimate interests in protecting the business).
• To keep proper business, accounting and tax records (our legal obligations).
• To send marketing, only where you have opted in (your consent, which you can withdraw at any time).

We share your data only as needed to fulfil your order, with:

• Ordernised, our ordering platform, acting as our processor.
• Stripe, for payment processing.
• Twilio, for SMS order notifications.
• Our delivery provider (for example iCabbi), where your order is delivered by a third-party driver.
• Our email provider, for order confirmations and receipts.
• Sentry, for error monitoring, so faults get found and fixed. Reports may include technical device data.

We do not sell your personal data, and we do not share it with third parties for their own marketing.

Some of these providers (for example Stripe and Twilio) process data in the United States or other countries outside the UK. Where that happens, the transfer is covered by UK adequacy regulations or appropriate safeguards such as the UK International Data Transfer Addendum to the EU Standard Contractual Clauses.

We keep order records for as long as needed to provide the service and to meet our legal, accounting and tax obligations (typically up to six years for UK tax records), after which they are deleted or anonymised. Marketing consents are kept until you withdraw them. Data held only on your device stays until you clear it.

You have the right to access your data, to have it corrected or erased, to restrict or object to how we use it, to data portability, and to withdraw marketing consent at any time.

You can delete your personal data yourself at any time. Every order confirmation email we send includes a "Manage your personal data" link in its footer. Open the link in your most recent order confirmation email to see what we hold about you, unsubscribe from marketing, or delete your personal data.

Deletion removes your name, email address, phone number, saved delivery addresses and loyalty profile (including any stamps and rewards). Past orders are kept for our legal and accounting obligations but are anonymised so they no longer identify you; they show as "Deleted customer". Deletion cannot be undone, and if you order again you start as a new customer.

To exercise any of your other rights, contact us using the details below and we will respond within one month.

If you are unhappy with how we have handled your data you can complain to the UK Information Commissioner's Office at ico.org.uk.

We do not make decisions with legal or similarly significant effects about you based solely on automated processing. Automated fraud checks on payments are carried out by our payment provider, with human review available.

We may update this policy. The "last updated" date above shows the current version, and material changes will be highlighted on this page.

Cinnamon
124 Derby Road, Stapleford, NG9 7AY
Phone: 0115 917 0170