Privacy Policy

Last updated: March  2026

3.1 Who We Are

Ismo Foodies Cash and Carry (“we”, “us”, “our”) is the data controller for personal information collected through our business operations. We are committed to protecting your personal data in accordance with the UK General Data Protection Regulation (UK GDPR) and the Data Protection Act 2018.

3.2 What Data We Collect

We may collect and process the following personal information:

• Name, address, email address, and telephone number.
• Payment and transaction information (processed securely — we do not store full card details).
• Order history and purchasing preferences.
• CCTV footage captured on our premises for security purposes.
• Communication records (e.g., emails, phone enquiries).
• Website usage data (cookies and analytics, where applicable).

3.3 How We Use Your Data

We use your personal data for the following purposes:

• Processing and fulfilling your orders.
• Communicating with you about your orders, deliveries, or enquiries.
• Maintaining our business records and accounts.
• Improving our products and services.
• Sending promotional communications (only where you have given consent).
• Complying with our legal obligations.

3.4 Legal Basis for Processing

We process your personal data on the following lawful bases:

• Contract: to fulfil orders you have placed with us.
• Legal obligation: to comply with UK tax, accounting, and regulatory requirements.
• Legitimate interests: to improve our services and protect our business.
• Consent: where you have opted in to receive marketing communications.

3.5 Data Sharing

We do not sell your personal data. We may share your data with trusted third parties where necessary:

• Delivery and courier companies (to fulfil your order).
• Payment processors (to handle transactions securely).
• IT and website service providers.
• HMRC or other regulatory bodies where required by law.

3.6 Data Retention

We retain personal data only for as long as necessary:

• Customer order and transaction records: 7 years (for tax and legal compliance).
• CCTV footage: up to 30 days unless required for an ongoing investigation.

Marketing contact data: until you withdraw consent.