Privacy Policy

Chandra Stores, chandrastores.co.uk

Version 1.0. Last updated: [DATE OF PUBLICATION]

This Privacy Policy explains what personal information we collect, why we collect it, how we use it, who we share it with, how long we keep it and what rights you have.

1. Who we are

1.1 NEW CHANDRA STORES LIMITED, trading as Chandra Stores, is the controller of the personal information described in this policy.

Company number: 12223357

Registered office: 32 Woodford Avenue, Ilford, England, IG2 6XQ

Email: [CUSTOMER SERVICE EMAIL]

Telephone: [PHONE NUMBER]

Information Commissioner's Office registration number: [ICO REGISTRATION NUMBER]

1.2 We have not appointed a Data Protection Officer, as we are not required to do so. Privacy enquiries are handled by [PRIVACY CONTACT ROLE] and should be sent through our Contact Us page.

1.3 We process personal information in accordance with the UK General Data Protection Regulation and the Data Protection Act 2018, as amended by the Data (Use and Access) Act 2025.

2. Information we collect

Information you give us

2.1 Depending on how you use our website, this may include:

your name;
your billing address and delivery address;
your email address;
your telephone or mobile number;
your account login details;
your order details and delivery instructions;
payment-related information;
your date of birth or age confirmation, where you order alcohol or another age-restricted product;
your dietary, allergen or product preferences, where you tell us;
the content of enquiries, complaints, reviews and feedback; and
your marketing preferences.

Information we collect automatically

2.2 When you use our website we may collect:

your IP address;
your browser type, device type and operating system;
an approximate location derived from your IP address;
pages visited, products viewed and searches carried out;
the website that referred you to us;
the date and time of your visit; and
information from cookies and similar technologies, as described in our Cookie Policy.

Order and transaction information

2.3 When you buy from us we collect information about the products purchased, quantities, prices, discounts applied, delivery details, order number, transaction status, and any returns, refunds or complaints.

2.4 We do not receive or store your full payment card number. Card details are handled directly by our payment providers.

3. Why we use your information, and our legal basis

3.1 The table below sets out what we use personal information for and the lawful basis on which we rely.

Purpose

Information used

Lawful basis

Creating and managing your account

Contact details, login details

Performance of a contract

Processing and fulfilling your order

Contact details, order details, delivery instructions

Performance of a contract

Taking payment and preventing payment fraud

Order details, payment-related information

Performance of a contract. Legitimate interests in preventing fraud

Delivering your order

Name, address, telephone number, delivery instructions

Performance of a contract

Verifying your age for alcohol and other restricted products

Age confirmation, date of birth, identification checked at the door

Legal obligation under the Licensing Act 2003

Providing customer service and handling returns, refunds and complaints

Order details, correspondence

Performance of a contract. Legal obligation

Contacting you about a product recall or withdrawal

Contact details, order details

Legal obligation under food safety law. Vital interests where there is a risk to health

Keeping accounting, tax and business records

Order and transaction details

Legal obligation

Keeping food traceability records

Order and product details

Legal obligation under food law

Sending marketing emails or text messages

Contact details, purchase history

Consent, or the soft opt-in where you have bought from us

Sending postal marketing

Name and postal address

Legitimate interests in promoting our business

Improving our website, range and service

Usage information, order information

Legitimate interests in operating and improving our business

Website security and preventing misuse

Technical and usage information

Legitimate interests in keeping our website secure

Managing product reviews

Review content, name or display name, order details

Legitimate interests in publishing genuine reviews. Legal obligation to prevent fake reviews

Establishing, exercising or defending legal claims

Any relevant information

Legitimate interests in protecting our legal position

3.2 Where we rely on legitimate interests, we have considered whether those interests are overridden by your interests, rights and freedoms, and have concluded that they are not. You may object to processing based on legitimate interests at any time, as described in clause 8.

3.3 We do not carry out automated decision-making that produces legal effects concerning you or similarly significantly affects you. Where we use automated checks to screen orders for fraud, a member of our team reviews any order that is declined, and you may ask us to review such a decision, make representations and contest the outcome.

3.4 We do not knowingly collect special category data. We do not use your purchase history to infer your religion, health or ethnicity.

4. Marketing

4.1 We will send you marketing emails or text messages only where you have consented, or where you have bought a similar product from us, we gave you a simple means of refusing marketing when we collected your details, and we give you that opportunity in every message.

4.2 We do not sell your personal information, and we do not share it with third parties for their own marketing purposes.

4.3 You may unsubscribe at any time using the link in any marketing message, through your account, or by contacting us. Unsubscribing does not stop messages we must send you about an order, a delivery, a refund or a product recall.

5. Who we share information with

5.1 We share personal information with the following categories of recipient, and only where there is a lawful basis and appropriate contractual and security safeguards.

Recipient

Purpose

Location of processing

Shopify International Limited

E-commerce platform hosting our website, orders and customer accounts

Ireland, with processing in the United States and Canada

[PAYMENT PROVIDER]

Processing payments and preventing payment fraud

[LOCATION]

[COURIER OR DELIVERY PARTNER]

Delivering your order

United Kingdom

[EMAIL AND SMS MARKETING PLATFORM]

Sending marketing and transactional messages

[LOCATION]

[REVIEW PLATFORM]

Collecting and publishing product reviews

[LOCATION]

[ANALYTICS PROVIDER]

Understanding how our website is used

[LOCATION]

[ACCOUNTANT / BOOKKEEPING SOFTWARE]

Accounting and tax records

United Kingdom

Our professional advisers, including accountants, auditors, insurers and solicitors

Professional advice and protecting our legal position

United Kingdom

The Food Standards Agency, our local authority and other regulators

Food safety, product withdrawals and recalls, and licensing

United Kingdom

Police, courts, regulators and other authorities

Where we are required or permitted by law to disclose information

United Kingdom

5.2 If our business is sold or transferred, personal information may be transferred to the buyer, subject to the protections in this policy.

6. Sending information outside the United Kingdom

6.1 Some of our service providers process personal information outside the United Kingdom.

6.2 Where that happens, we ensure that one of the following applies:

the country has been found by the UK Government to provide an adequate level of protection;
the transfer is covered by the UK International Data Transfer Agreement, or by the Addendum to the European Commission's standard contractual clauses;
the recipient is certified under the UK Extension to the EU-US Data Privacy Framework; or
another lawful safeguard or exception applies.

6.3 You may ask us for details of the safeguard applying to a particular transfer by contacting us.

7. How long we keep information

7.1 We keep personal information only for as long as necessary for the purpose for which it was collected, and to meet our legal obligations.

Information

Retention period

Order and transaction records, including invoices

6 years from the end of the financial year in which the order was placed, to meet accounting and tax obligations and the limitation period for contract claims

Customer account details

For as long as the account is active, and 24 months after your last order, after which the account is closed and the data deleted

Food traceability records

[5] years, in line with food law and our supplier records

Age verification records for alcohol sales

[12] months, to evidence compliance with our licensing obligations

Customer service correspondence, returns and refunds

3 years from the date the matter is closed

Complaints

6 years from the date the complaint is closed

Marketing consents and preferences, including unsubscribe records

For as long as we rely on them, and a permanent suppression record so that we do not contact you again after you unsubscribe

Product reviews

For as long as the product is listed, and [12] months afterwards

Website analytics and cookie data

As set out in our Cookie Policy

CCTV at our premises

[31] days

7.2 Where information is no longer needed, we delete it or anonymise it so that it can no longer be linked to you.

8. Your rights

8.1 You have the following rights in relation to your personal information:

the right to be informed about how we use it, which this policy provides;
the right of access to a copy of the information we hold about you;
the right to have inaccurate information corrected;
the right to have information erased in certain circumstances;
the right to restrict how we use your information in certain circumstances;
the right to object to processing carried out on the basis of legitimate interests, and an absolute right to object to direct marketing;
the right to data portability, where processing is based on consent or a contract and is carried out by automated means;
the right to withdraw consent at any time, where we rely on consent; and
the right not to be subject to a solely automated decision with legal or similarly significant effects.

8.2 To exercise a right, contact us through chandrastores.co.uk/pages/contact. We may ask for information to confirm your identity. We will respond within one month. Where a request is complex, or where you have made several requests, we may extend that period by up to two further months and will tell you if we do.

8.3 Exercising these rights is free. We may charge a reasonable fee, or refuse to act, only where a request is manifestly unfounded or excessive, and we will explain our reasons if that happens.

8.4 Some rights do not apply in every case. For example, we cannot delete order records that we are required by law to keep for accounting or food traceability purposes.

9. How to complain about our use of your information

9.1 If you are unhappy with how we have handled your personal information, please tell us first through our Contact Us page at chandrastores.co.uk/pages/contact, marking your message for the attention of [PRIVACY CONTACT ROLE]. A data protection complaint form is available on request.

9.2 We will acknowledge your complaint within 30 days of receiving it, investigate it and respond to you without undue delay.

9.3 If you remain dissatisfied, you may complain to the Information Commissioner's Office:

Information Commissioner's Office, Wycliffe House, Water Lane, Wilmslow, Cheshire, SK9 5AF

Helpline: 0303 123 1113

Website: ico.org.uk

9.4 The Information Commissioner's Office may ask whether you have raised your complaint with us first, so please contact us before complaining to them.

10. Security

10.1 We use appropriate technical and organisational measures to protect personal information against unauthorised access, loss, misuse, alteration and disclosure. These include encrypted connections to our website, access controls, restricting staff access to what each role requires, and using established providers for payments and hosting.

10.2 No method of transmission over the internet, and no method of electronic storage, is completely secure. Where a personal data breach is likely to result in a risk to your rights and freedoms, we will report it to the Information Commissioner's Office within 72 hours, and we will tell you directly where the risk is high.

11. Cookies

11.1 Our website uses cookies and similar technologies. Our Cookie Policy explains which ones we use, what they do, how long they last and how to control them.

12. Children

12.1 Our website is intended for adults. You must be 18 or over to place an order.

12.2 We do not knowingly collect personal information from children. If you believe a child has provided us with personal information, please contact us and we will delete it.

13. Changes to this policy

13.1 We may update this policy from time to time. The current version, with its version number and date, is always published on this page.

13.2 Where a change materially affects how we use your personal information, we will tell you directly before the change takes effect.

NEW CHANDRA STORES LIMITED trading as Chandra Stores

Registered in England and Wales, company number 12223357

Registered office: 32 Woodford Avenue, Ilford, England, IG2 6XQ

Email: [CUSTOMER SERVICE EMAIL]. Telephone: [PHONE NUMBER]