Privacy Policy

Who controls your data

JOARR HOT FOOD EMPORIUM LIMITED (company number 10283868) of 139 Bispham Road, Southport, PR9 7BL, trading as Jo Kelly's, is the data controller for personal data collected through this site.

What we collect and why

• Account details — name, email, password (stored hashed, never in readable form). Needed to operate your account. Lawful basis: contract.
• Order details — items, delivery address, order history. Needed to fulfil and support your order. Lawful basis: contract.
• 18+ declaration — when your basket contains age-restricted items you confirm at checkout that you are 18 or over, and we record that confirmation against the order. We do not run an online identity check and we do not ask for your date of birth to place an order. Lawful basis: legal obligation (licensing and tobacco law).
• Delivery ID checks — when our rider performs a Challenge 25 check, we record only the outcome (passed on appearance, passed on ID, or the ground for a refusal), which rider carried it out, and when. We do not photograph, scan, copy or retain your ID document. Lawful basis: legal obligation (licensing and tobacco law).
• Refusal history — if a handover has been refused, we keep a count of refusals and the ground for the most recent one against your account. The rider delivering a later order is shown that count and ground, so they know to check carefully. Lawful basis: legal obligation, and our legitimate interest in not repeating an unlawful sale.
• Payment — handled by Stripe. We receive confirmation of payment and a reference; we never receive or store your full card number.

Who we share it with

Only with providers who need it to deliver the service: Supabase (database and authentication, EU region), Stripe (payments), Sentry (error monitoring, EU region), our email provider for order confirmations, and our delivery riders — who see the delivery name, address, items, and any previous refusal count and ground, and nothing more. We do not sell your data or use it for advertising.

About error monitoring. When something goes wrong on the site we record the technical details needed to fix it — the page, the error, and your browser type. If the fault happened during checkout we may also record a replay of that session, with all text masked and images blocked, so we can see what broke without seeing what you typed. We do not send your name, address or payment details to our monitoring provider.

We will also disclose Challenge 25 and refusal records to the police, Sefton Council licensing officers or Trading Standards where they are lawfully requested, or where we rely on them to show that we met our obligations.

How long we keep it

• Order and transaction records — six years, as required by tax law.
• 18+ declarations, Challenge 25 outcomes and refusal records — two years, as evidence for licensing and tobacco enforcement, then deleted.
• Account details — until you ask us to close your account.

Your rights

Under UK GDPR you may request a copy of your data, ask us to correct or delete it, object to or restrict how we use it, and request it in a portable format. Some data we must keep — we cannot delete records the law requires us to hold, such as transaction records and licensing evidence.

To exercise any of these, contact us through this site. If you are unhappy with our response you can complain to the Information Commissioner's Office at ico.org.uk.

Cookies

We use only cookies that are necessary for the site to work — keeping you signed in and remembering your basket. We do not use advertising or third-party tracking cookies.

Security

Data is transmitted over HTTPS and held in access-controlled systems with row-level security. Staff and rider accounts are issued individually and carry only the access their role requires.

Changes

We will update this page if our practices change, and revise the date at the top.