Privacy Policy

Personal data we collect

We collect the following personal data when you place an order or create an account:

• Contact details: Your name, email address, and phone number.
• Delivery address: Your delivery address including postcode.
• Order history: Details of the products you order, delivery dates, and order status.
• Messages: Any messages you send to us through our in-app chat or WhatsApp.
• Payment data: Payments are processed securely by Stripe. We never see or store your full card details — only Stripe does.

Why we collect your data

We use your personal data only for the following purposes:

• Processing orders: To take payment, prepare, and dispatch your orders.
• Delivery: To deliver your order to the address you provide.
• Customer support: To respond to your queries and resolve any order issues.
• Marketing: We will only send you marketing communications if you have explicitly opted in. You can opt out at any time.

Legal basis for processing

We rely on the following legal bases under the UK GDPR:

• Contract: Processing your data is necessary to fulfil your order and deliver the goods you purchased.
• Legal obligation: We may need to retain records to comply with tax and accounting laws.
• Consent: For any marketing communications, we rely on your explicit consent, which you can withdraw at any time.
• Legitimate interests: To provide customer support and improve our service, where this does not override your rights.

Who we share your data with

We only share your data with third parties where necessary to fulfil your order:

• Stripe: Our payment provider, to process your payment securely. Stripe processes your card details under its own privacy policy.
• Delivery partners: Couriers and delivery services that deliver your order, who receive your name, address, and phone number for delivery purposes only.

We never sell your personal data to anyone.

How long we keep your data

We retain your personal data only for as long as necessary to fulfil the purposes set out above, including meeting our legal and accounting obligations. Order records are typically kept for the duration of your relationship with us plus the period required by UK tax law. You can request earlier deletion of your data at any time (see your rights below).

Your data protection rights

Under the UK GDPR, you have the following rights regarding your personal data:

• Access: You can ask what personal data we hold about you and receive a copy.
• Rectification: You can ask us to correct any inaccurate or incomplete data.
• Erasure: You can ask us to delete your personal data, subject to legal retention requirements.
• Objection: You can object to us processing your data for certain purposes, such as marketing.
• Complain to the ICO: If you are not satisfied with how we handle your data, you have the right to complain to the Information Commissioner’s Office at ico.org.uk.

Contact us about your privacy

For any privacy queries or to exercise your rights, please email us at contact@malayalistore.co.uk.