Privacy Policy
Last updated: 11 October 2026 · Version 2.2
1. Who We Are & Data Controller
This privacy policy applies to Crazy Chips Derby Ltd (trading as "Crazy Chips"), a private limited company registered in England and Wales. We are the designated Data Controller responsible for the processing of your personal information collected via our website, mobile interface, and direct in-store ordering systems.
Trading Address: Crazy Chips, 74D Osmaston Rd, Derby DE1 2HZ, United Kingdom
Contact Email: crispy@crazychips.uk
Telephone: +44 7436 348645
2. Personal Data We Collect
We collect and process the following categories of personal information:
Customer Contact Information
Full name, email address, UK phone number, and special dietary/allergy instructions provided at checkout.
Order & Transaction Details
Purchased menu items, total price, discounts applied, timestamps, order status, and collection pickup notes.
Account & Auth Credentials
Encrypted password hashes (bcrypt), OAuth account IDs (Google/Apple), and reward loyalty points.
Payment Tokens
Stripe PaymentIntent IDs and last 4 card digits. Raw card numbers, expiry dates, and CVVs are handled exclusively by Stripe and are never accessible or stored on our servers.
3. Legal Basis for Processing (UK GDPR)
Under the UK General Data Protection Regulation (UK GDPR), our lawful bases for collecting and processing your personal data include:
- Contractual Necessity (Art. 6(1)(b)): To prepare, fulfill, and notify you regarding your food orders, verify payments, and manage your account.
- Legal Obligation (Art. 6(1)(c)): To maintain mandatory corporate accounting, VAT, and tax records in accordance with HMRC regulations, and food safety traceability.
- Legitimate Interests (Art. 6(1)(f)): To safeguard against fraudulent transactions, maintain site security, manage kitchen inventory, and improve our services.
- Consent (Art. 6(1)(a)): For optional analytics cookies or marketing communications (which you can withdraw at any time).
4. Data Security & Third-Party Processors
We do not sell, rent, or trade your personal information. We partner exclusively with vetted, industry-leading infrastructure providers that maintain strict UK/EU adequacy standards:
5. Data Retention
We retain your personal data only as long as necessary:
- Order & Sales Records: Retained for 6 years following the end of the relevant financial year, in compliance with UK tax law (HMRC requirements).
- Customer Account Data: Retained for as long as your account remains active. You may request account deletion at any time via your account settings.
- Anonymous Analytics: Aggregated, non-personally identifiable metrics are retained indefinitely for business reporting.
6. Your Rights Under UK GDPR
As a data subject located in the UK, you possess specific statutory rights:
To exercise any of these rights, please contact our team at crispy@crazychips.uk. We respond to all verified requests within 30 days without charge.
7. Cookies & Tracking
We use essential cookies strictly necessary for the operation of our shopping cart and authentication. For full details on our cookie usage and how to modify your preferences, please see our dedicated Cookie Policy.
8. Supervisory Authority & Complaints
If you are dissatisfied with how we handle your personal data, you have the right to lodge a formal complaint with the UK supervisory body, the Information Commissioner's Office (ICO), at ico.org.uk or by calling their helpline on 0303 123 1113.