Privacy Policy

1. Introduction

N'Dough (“we”, “us”, “our”) is committed to protecting your privacy. This Privacy Policy explains how we collect, use, store, and protect your personal data in compliance with UK GDPR and the Data Protection Act 2018.

Data Controller:
N'Dough — a registered company based in the UK
Email: info@ndough.co.uk

2. Information We Collect

Information You Provide

When you place an order or contact us, we collect:

• Personal Details: Name, email address
• Delivery Information: Delivery address, delivery instructions
• Payment Information: Processed securely by our payment processor (we do not store card details)
• Order History: Products purchased, order dates, preferences
• Communications: Messages sent via contact forms or email

Information Automatically Collected

• Technical Data: IP address, browser type, device information, operating system
• Usage Data: Pages visited, time spent on site, links clicked, referral source
• Cookies: See our Cookie Policy for details

3. How We Use Your Information

We use your personal data for the following purposes:

4. Legal Basis for Processing

Under UK GDPR, we process your data based on:

• Contract: To fulfil your order and provide services
• Consent: For marketing emails (you can withdraw consent anytime)
• Legitimate Interest: For fraud prevention, website improvement, customer service
• Legal Obligation: To comply with tax, accounting, and food safety laws

5. Sharing Your Information

We do not sell your personal data. We share data only with trusted third parties necessary for our business operations:

• Payment Processors: Secure, PCI-DSS compliant payment processing
• Delivery Couriers: Name and delivery address shared for delivery
• Email Service Providers: For sending order confirmations and marketing emails
• Analytics Providers: Google Analytics (anonymised data)
• Hosting Providers: Vercel (website hosting), Supabase (database)
• Legal Authorities: If required by law or to protect our rights

All third parties are contractually obligated to protect your data and use it only for specified purposes.

6. International Transfers

Some of our service providers may be located outside the UK/EEA (e.g., cloud hosting). We ensure appropriate safeguards are in place, such as Standard Contractual Clauses (SCCs) or adequacy decisions, to protect your data during international transfers.

7. Data Retention

We retain your data only as long as necessary:

• Order Data: 7 years (UK tax and accounting requirements)
• Marketing Consent: Until you unsubscribe or we close your account
• Website Analytics: 26 months (Google Analytics default)
• Customer Service Records: 3 years after last contact

After retention periods expire, data is securely deleted or anonymised.

8. Your Rights Under UK GDPR

You have the following rights regarding your personal data:

• Right to Access: Request a copy of your personal data we hold
• Right to Rectification: Correct inaccurate or incomplete data
• Right to Erasure: Request deletion of your data (subject to legal obligations)
• Right to Restrict Processing: Limit how we use your data
• Right to Data Portability: Receive your data in a structured, machine-readable format
• Right to Object: Object to processing based on legitimate interests or for marketing
• Right to Withdraw Consent: Withdraw consent for marketing or data processing anytime
• Right to Complain: Lodge a complaint with the ICO (ico.org.uk)

To exercise your rights, email us at info@ndough.co.uk. We will respond within 1 month.

9. Security

We implement appropriate technical and organisational measures to protect your data:

• SSL/TLS encryption for data transmission
• Secure, password-protected databases
• Regular security updates
• Access controls limiting staff access to personal data
• Secure payment processing (PCI-DSS compliant)

While we take security seriously, no system is 100% secure. We cannot guarantee absolute security but will notify you of any breaches as required by law.

10. Children's Privacy

Our website is not intended for children under 16. We do not knowingly collect data from children. If you believe we have collected data from a child, please contact us immediately.

11. Marketing Communications

With your consent, we may send marketing emails about:

• New products and flavours
• Special offers and discounts
• Seasonal promotions
• Company news and updates

You can unsubscribe anytime by clicking “Unsubscribe” in any email or contacting us at info@ndough.co.uk.

12. Changes to This Policy

We may update this Privacy Policy from time to time. Changes will be posted on this page with an updated “Last Updated” date. Significant changes will be communicated via email or website notice.