Privacy Policy

Last updated: 25 September 2026

At Surulere Foods, we bring the taste of home to kitchens across the UK, and we look after your personal information with the same care. This Privacy Policy explains what personal information we collect, why we use it, the legal basis we rely on, who we share it with, how long we keep it, and the rights you have under UK data protection law, including the UK General Data Protection Regulation (UK GDPR), the Data Protection Act 2018, the Privacy and Electronic Communications Regulations 2003 (PECR) and the Data (Use and Access) Act 2025.

This policy applies to our website www.surulerefoods.com, our online checkout, our emails and text messages, our social media pages and any other place that links to this policy. If you use the Surulere Foods app for iPhone or Android, section 7 (Our mobile app) explains how the app handles your information.

1. Who we are

Surulere Foods Limited ("Surulere Foods", "we", "us", "our") is the data controller of your personal information. This means we decide how and why it is used and we are responsible for protecting it.

Company: Surulere Foods Limited, a private limited company registered in England and Wales, company number 15941988
Registered office: 3rd Floor, 86–90 Paul Street, London EC2A 4NE, United Kingdom
Privacy contact: info@surulerefoods.com (please put "Privacy" in the subject line)

We are not required to appoint a Data Protection Officer. Our privacy contact above is responsible for all data protection questions and requests.

2. What information we collect

2.1 Information you give us

• Identity and contact details – name, email address, phone number, billing and delivery addresses.
• Order details – products bought, delivery method, order notes, returns and refunds, and payment confirmation. We do not see or store your full card number; card details are collected directly by our payment providers.
• Account details – login email, encrypted password, saved addresses and preferences.
• Subscriptions, loyalty and referrals – subscription box choices and delivery schedules, loyalty points, rewards and referral codes.
• Wholesale, catering and trade enquiries – business name, trading details, contact person, delivery requirements and order history.
• Communications – anything you send us by email, contact form, live chat, phone, social media or messaging apps, and any reviews or photos you submit.
• Marketing preferences – whether you have agreed to or opted out of marketing, and when.
• Information you type into our tools – for example, the event size, dishes and quantities you enter into our Bulk Order Builder or Recipe Builder.

2.2 Special category (health) information

If you choose to tell us about an allergy, intolerance or medical dietary need (for example in an order note or a message), this is "special category" health data. We only use it with your explicit consent, only to deal with your request, and never for marketing or profiling. Please do not send us health information we have not asked for. Our product pages show allergen and ingredient information supplied by manufacturers, but you should always check the product packaging before eating.

2.3 Information about other people

If you give us someone else's details – for example a gift recipient's name and address, or a friend's email for a referral – you confirm that you have their permission, or are otherwise entitled, to share them, and that you have told them about this policy. We use their details only to deliver the gift or send the single referral invitation, and we do not add them to our marketing lists.

2.4 Information collected automatically

• Device and usage data – IP address, approximate location (derived from IP), browser and device type, pages viewed, products added to your basket, referring website and the date and time of your visit.
• Cookies, pixels and similar technologies – see section 6.

2.5 Information from third parties

• Shopify, which hosts our store and checkout.
• Payment providers – payment status and fraud-risk indicators.
• Delivery partners – delivery status and proof of delivery.
• Advertising and social media platforms – for example, that you clicked one of our ads, where you have consented to this.
• Public sources – for trade customers, publicly available business information such as Companies House records.

2.6 What happens if you don't give us your information

We need your name, contact details, delivery address and payment to take and deliver an order. This is a contractual requirement: without it we cannot fulfil your order. Other information, such as marketing preferences or reviews, is optional.

3. How we use your information and our legal basis

Under UK GDPR we must have a lawful basis for every use of your personal information. The table below sets out what we do and why.

Where we rely on legitimate interests, we have balanced our interests against your rights and freedoms and concluded that the processing is fair. You can ask us for more information about this balancing, and you have the right to object (see section 11).

We will only use your information for a new purpose if it is compatible with the purpose for which we collected it, or if we have your consent or another lawful basis. We will tell you before we do so where required.

4. Automated decisions and profiling

We do not make decisions about you based solely on automated processing that have a legal or similarly significant effect on you.

Our payment providers and Shopify use automated fraud-screening tools. If an order is flagged, it is reviewed by a person before being cancelled, and you can contact us to challenge the outcome.

We group customers into broad segments (for example, by the types of products bought) so our marketing is relevant. You can object to this at any time by unsubscribing or contacting us.

5. Marketing – your choice

• Email and text: we only send marketing messages if you have opted in, or if you have bought from us (or started to) and did not opt out when we collected your details. In that second case ("soft opt-in") we only tell you about our own similar products and offers.
• Every message includes a free and simple way to unsubscribe (an unsubscribe link, or replying STOP to a text).
• Post: we may occasionally post offers to existing customers based on our legitimate interests. Tell us if you'd prefer not to receive them.
• Online adverts: we only use your information for targeted advertising if you accept marketing cookies, and you can withdraw this at any time via Cookie settings.

Opting out of marketing does not affect service messages about your orders, account or subscription, and does not affect any purchase.

6. Cookies and similar technologies

Cookies are small files placed on your device. When you first visit our site, a cookie banner lets you Accept all, Reject all or Manage choices. Analytics and marketing cookies are switched off by default and are only set if you choose to allow them. Rejecting them does not affect your ability to shop with us.

Changing your mind: you can change or withdraw your consent at any time by clicking Cookie settings (also in our website footer). If you withdraw consent, we stop the relevant tools and delete the analytics and marketing cookies they set on our domain. You can also block or delete cookies in your browser settings, although some parts of the site may then not work.

How long your choice lasts: we remember your choice for 12 months, then ask you again.

More detail on the cookies used by our platform is available in Shopify's cookie policy.

Joint controllers: where you allow marketing cookies and we use tools such as the Meta pixel, we and that platform may be joint controllers for collecting and sending your data. The platform is responsible for its own further use of the data under its own privacy policy.

7. Our mobile app

This section covers the Surulere Foods app for iPhone and Android. The app is a way to shop the same store, and the information we hold is the same information we hold for surulerefoods.com.

What the app collects

If you shop without an account, the app sends only what is needed to show you products and to build your basket. We do not collect your name, your email address or any device identifier at that point.

If you sign in, you use a Surulere Foods customer account. Shopify emails you a one-time code; there is no password for us to store. Once signed in, the app shows your name, your email address, your delivery addresses and your order history, so that you can reorder.

When you check out, you enter your delivery address, contact details and payment details in Shopify's secure checkout. Card details are handled by Shopify and its payment providers, and are never seen or stored by the app or by us.

What the app stores on your phone

Your sign-in token is kept in the device's secure store (Keychain on iPhone, Keystore on Android) and is removed when you sign out. Your basket is stored on your device by reference, so it survives closing the app.

What the app does not do

The app contains no advertising, no analytics and no tracking libraries. It does not track you across other apps or websites, does not read your contacts, photos, files or location, and does not send notifications.

Who else sees your information

Shopify International Limited hosts our store and processes this information on our behalf, as our service provider. We use delivery partners to bring your order to you, and they receive your name, delivery address and phone number and, where the courier sends delivery updates, your email address. They use this only to deliver your order. We do not sell your personal information.

How long we keep it

We keep your customer account for as long as you have one. We keep records of completed orders and invoices for six years, because UK tax and accounting law requires it.

Deleting your account

You can start deletion in the app: Account, then Delete account. You can also ask on our website at surulerefoods.com/pages/delete-account, which works whether or not you still have the app installed. We complete requests within 30 days and email you to confirm. Records we must keep for tax purposes are deleted once that six-year period ends.

Your rights and contact

You can ask us for a copy of your information, ask us to correct it, or ask us to delete it. Contact us through surulerefoods.com/pages/contact.

8. Who we share your information with

We do not sell your personal information. We share it only where necessary, with the following:

8.1 Service providers acting on our instructions (processors)

• Shopify International Limited and its group companies (store hosting, checkout, customer and order data).
• Apps and tools that power store features – subscriptions, loyalty and rewards, reviews, customer support, email and SMS marketing, and website tools.
• IT, cloud storage and security providers.
• AI service providers used by some on-site tools (such as our Bulk Order Builder) to process what you type in and generate suggestions. Please do not enter personal or health information into these tools.

These providers are bound by written contracts and may only use your information to provide services to us.

8.2 Independent controllers

• Payment providers (such as Shopify Payments), who also use your data for fraud prevention and to meet their own legal duties.
• Couriers and delivery partners, who receive your name, delivery address and phone number and, where the courier sends delivery updates, your email address, only to deliver your order (including chilled and frozen deliveries).
• Shopify, where you choose to use Shop Pay or the Shop app, or where Shopify matches your account with its other services. See Shopify's Privacy Policy.
• Advertising and social media platforms, where you have consented.
• Professional advisers – accountants, lawyers and insurers.
• Authorities – HMRC, the police, local authority trading standards or environmental health, the Food Standards Agency, courts and regulators, where the law requires or allows it.
• A buyer or investor – if all or part of our business is sold or restructured, your information may transfer to the new owner, who must use it in line with this policy.

9. International transfers

Some of our providers, including Shopify, store or access data outside the UK (for example in Canada, the European Economic Area or the United States). We only transfer your information where the destination has been approved by the UK Government as having adequate data protection, or where we use a recognised safeguard such as the UK International Data Transfer Agreement, the UK Addendum to the EU Standard Contractual Clauses, or the UK Extension to the EU–US Data Privacy Framework. You can ask us for a copy of the relevant safeguards by contacting us.

10. How long we keep your information

When information is no longer needed, we delete it securely or anonymise it so it can no longer identify you.

11. Your rights

You have the following rights under UK data protection law:

• Right to be informed – about how we use your information (this policy).
• Right of access – to get a copy of the personal information we hold about you.
• Right to rectification – to have inaccurate or incomplete information corrected.
• Right to erasure – to have your information deleted, where there is no good reason for us to keep it.
• Right to restrict processing – to ask us to pause using your information in certain situations.
• Right to data portability – to receive information you gave us in a structured, machine-readable format, or have it sent to another organisation.
• Right to object – to processing based on legitimate interests. You have an absolute right to object to direct marketing, including profiling for marketing.
• Rights relating to automated decisions – see section 4.
• Right to withdraw consent – at any time, where we rely on consent. This does not affect anything we did lawfully before you withdrew it.

How to make a request: email info@surulerefoods.com or write to us at the address above. You do not need to use a particular form.

Our response: we will respond within one month of receiving your request. We may extend this by up to two further months if your request is complex or you have made several requests, and we will tell you why within the first month. If we need to confirm your identity or need more information to find what you are asking for, the time limit starts once we receive it. We will carry out reasonable and proportionate searches.

Fees: there is normally no charge. We may charge a reasonable fee, or refuse, if a request is manifestly unfounded or excessive, and we will explain why.

Some rights have legal exceptions. For example, we may need to keep order records for tax purposes even if you ask us to delete them. If we cannot fully meet your request, we will tell you why.

12. Keeping your information secure

Our store runs on Shopify, a PCI-DSS Level 1 certified platform, and all pages use encrypted (HTTPS) connections. We limit access to personal information to people who need it, use strong passwords and two-step verification on our admin systems, and require our service providers to protect your data. No system is completely secure, but if a personal data breach happens that is likely to put you at high risk, we will tell you without undue delay and report it to the Information Commissioner's Office where required.

Please keep your password private and tell us straight away if you think your account has been used without your permission.

13. Children

Our store is for adults aged 18 and over. We do not knowingly collect information about children. If you believe a child has given us their information, please contact us and we will delete it.

14. Visitors outside the UK

We sell to and deliver within the United Kingdom only, and this policy is written under UK law. If you visit our site from elsewhere, your information will be processed in the UK and by our providers as described in section 9.

15. Links to other websites

Our site may link to other websites, social media platforms and apps. We are not responsible for their privacy practices, so please read their privacy policies before sharing your information with them.

16. Complaints

If you are unhappy with how we have used your personal information, please tell us first so we can put it right. You can complain by email, by post, or through any of our customer service channels. We will:

• acknowledge your complaint within 30 days of receiving it;
• look into it without undue delay;
• keep you updated on progress; and
• tell you the outcome without undue delay.

You also have the right to complain to the Information Commissioner's Office (ICO), the UK's data protection regulator, at ico.org.uk/make-a-complaint. The ICO usually expects you to raise your concern with us first.

17. Changes to this policy

We keep this policy under review and may update it to reflect changes to our services or the law. The "Last updated" date at the top shows when it was last changed. If we make a significant change that affects how we use your information, we will tell you by email or with a notice on our website before the change takes effect, and ask for your consent where the law requires it.

18. Contact us

If you have any questions about this policy or your information, please contact us:
Email: info@surulerefoods.com (subject line: "Privacy")
Post: Privacy, Surulere Foods Limited, 3rd Floor, 86–90 Paul Street, London EC2A 4NE, United Kingdom
Company number: 15941988 (registered in England and Wales)