1. Who we are

This site is run by [OWNER / LEGAL TRADING NAME], trading as Bo’ness Spice. We are the data controller for the information described on this page — meaning we’re the ones responsible for it, and the ones you come to with any question about it.

2. What we collect, and why

We only ask for something when we actually need it for what you’re doing. Here’s the whole list.

When you place an order

Your name, phone number and email address, plus your delivery address if you’ve asked us to deliver rather than to have it ready for collection. We also keep what you ordered, and any note you leave for the kitchen.

We need all of this to make and hand over the food you’ve paid for, so our lawful basis is performance of a contract. Without it there is no order — we can’t cook for someone we can’t name or ring.

When you pay cash

For orders paid in cash we text a short code to your phone and ask you to type it back in. That confirms the number is real and reachable before we start cooking food nobody has paid for yet. Our lawful basis is our legitimate interest in preventing hoax and fraudulent orders — a genuine problem for a small kitchen, and this is the lightest-touch check we could find. We keep the fact that a number was verified, not the code itself.

When you book a table

Your name, phone number, email address, the date and time you’d like, how many of you there are, and anything you write in the notes box. We use it to hold the table and to come back to you and confirm it.

When you pay by card

Your card details never touch us. The card form on our checkout is served directly by Stripe, our payment provider, and your card number, expiry date and security code go straight to them. They never pass through our website and we have nowhere to store them even if we wanted to — there is no card number field anywhere in our database. All we get back is whether the payment worked, the amount, and the last four digits so you can tell one payment from another.

The same is true of Apple Pay, Google Pay and Pay by Bank, which are all handled by Stripe. What Stripe does with the details you give them is covered by Stripe’s privacy policy.

If you make an account

You don’t have to — you can order perfectly well as a guest. If you do, we store your name, email address and a scrambled version of your password that we can’t read, along with any passkey or two-factor setup you turn on, so that we can keep your account secure and show you your past orders.

3. Marketing emails

We’d like to email you the occasional offer. Here’s the honest version of how that works.

• The box on the checkout page starts ticked. The rules let us do that for someone who is actually buying from us, which is why it’s ticked there and nowhere else. Every other form on this site — table bookings included — starts unticked, and stays that way unless you tick it yourself.
• Untick it and nothing happens to your order. It’s right there on the page, it takes one tap, and your food arrives exactly the same.
• It’s only ever us. Our own food, our own offers, from Bo’ness Spice. We don’t email you on anyone else’s behalf, and we never sell or rent your address to another business.
• Every marketing email has an unsubscribe link. One click, no login, no questions, and it takes effect immediately.
• Once you unsubscribe, we keep your address on a suppression list. That may sound backwards, so to be clear: it’s a do-not-contact list and nothing else. We keep it purely so that a future order with a pre-ticked box can never put you back on the mailing list by accident. It is never used to send you anything.

None of this affects order confirmations, receipts or booking emails. Those aren’t marketing — they’re us telling you what’s happening with something you asked for, so you get them either way.

4. How long we keep things

Not forever. Deletion runs automatically on a schedule — it isn’t something somebody has to remember to do.

Guest order details — 18 months

After 18 months we strip the name, phone number, email address and delivery address off a guest order. What’s left is an anonymous record of what was sold and for how much, which we have to keep for our accounts and our tax return. It can’t be traced back to you.

Table bookings — 90 days

Deleted outright 90 days after the booking, including anything you wrote in the notes box. This is the shorter window mentioned in section 2: allergy and health notes go with it.

Email send records — 12 months

We log that a confirmation or receipt was sent, so that we can prove it went out and chase it if it didn’t. Those logs are deleted after 12 months.

Printed ticket data — 90 days

The exact copy of the ticket sent to the kitchen printer carries your name and address, so we bin it after 90 days once it’s no longer useful for chasing a printing fault.

If you have an account, we keep it until you ask us to close it. The suppression list in section 3 is the one thing we keep indefinitely, because forgetting it would mean emailing someone who asked us not to.

5. Who else sees your data

We do not sell your data, and we do not use it for advertising. We use a handful of specialist companies to run the practical parts of the business. They act on our instructions, they’re contractually bound to protect your data, and none of them may use it for their own purposes:

Stripe

— takes your card, Apple Pay, Google Pay and Pay by Bank payments.

Laravel Cloud

— hosts this website and its database.

PrintNode

— sends your order to the printer in our kitchen.

Resend

— delivers our confirmation and receipt emails.

Twilio

— sends our text messages, including cash-order verification codes.

Sentry

— tells us when the site hits an error so we can fix it.

We’ll also hand over information if the law requires it — for example to Environmental Health after a food-safety incident, or in response to a court order.

6. Cookies and browser storage

There’s no cookie banner on this site, and that’s not an oversight — we don’t set anything that needs one.

• One session cookie. It’s what remembers your basket between pages and keeps you signed in. The site cannot work without it, which under the UK’s cookie rules (PECR) makes it “strictly necessary” — the one category that doesn’t require a consent banner. It clears when you close your browser.
• Your light or dark theme choice. Saved by your own browser, on your own device. It never reaches us.
• No tracking or advertising cookies. No advertising pixels, no cross-site trackers, no third-party analytics profiling you.

7. Your rights

The law gives you a set of rights over your own information, and you can use any of them free of charge:

• See it — ask for a copy of what we hold about you.
• Correct it — tell us if something is wrong and we’ll fix it.
• Delete it — ask us to erase it, where we don’t have to keep it for our accounts.
• Object to it — including the fraud checks we run on our legitimate interests, and marketing at any time.
• Take it with you — get the details you gave us in a portable format.

Just ask us — email [CONTACT EMAIL], ring 01506 826 777, or speak to us in the shop. We’ll reply within one month. We may need to check you’re who you say you are first — we’re not going to hand your order history to somebody who just knows your name.

If you think we’ve got it wrong, please tell us so we can put it right. You also have the right to go straight to the UK’s data protection regulator, the Information Commissioner’s Office, at ico.org.uk or on 0303 123 1113.

8. Changes to this policy

If we change how we handle your information, we’ll update this page and move the date at the top. This page is always the current version, so it’s worth a glance if it matters to you. If a change is a significant one, we’ll say so plainly rather than slipping it in.

Last updated 28 August 2026.