Privacy policy
This policy explains how WESTIN GOURMET LIMITED (“WESTIN GOURMET”, “we”, “us”) collects and uses personal data when you browse this website, buy from us or contact us. We are the controller of that data under the UK GDPR and the Data Protection Act 2018.
Who we are and how to reach us
- Company: WESTIN GOURMET LIMITED, company number 09019603
- Address: Unit L The Fulcrum, Vantage Way, Poole, Dorset, BH12 4NU
- Email: service@westingourmet.store
What we collect, why, and our lawful basis
| Data | Why we use it | Lawful basis |
|---|---|---|
| Name, delivery and billing address, email, telephone | To take, deliver and support your order, and to contact you about it | Contract |
| Order history and payment status (we never see or store your full card number) | To keep accounting records, handle refunds and prevent fraud | Legal obligation; legitimate interests |
| Messages you send us, and allergy or dietary information you choose to share | To answer your questions and keep you safe | Legitimate interests; contract |
| Device and browsing data (IP address, browser, pages viewed) | To keep the website secure, working and fast | Legitimate interests |
| Analytics and advertising identifiers, only if you accept the matching cookies | To understand how the site is used and to measure and improve our advertising | Consent |
| Email address for newsletters, if you subscribe | To send offers and news you asked for | Consent (you can unsubscribe at any time) |
Who receives your data
We share personal data only with organisations that help us run the shop, and only as much as they need:
- Stripe processes card payments. Your card details go directly to Stripe and are not held on our servers.
- Couriers and delivery partners receive your name, address and telephone number so they can deliver.
- Amazon Web Services (SES) sends our transactional emails, such as order confirmations.
- Our hosting and IT providers store the website and its data.
- Accountants, professional advisers and authorities where the law requires it.
We do not sell your personal data.
International transfers
Some providers, such as Stripe, Amazon and Google, may process data outside the United Kingdom. Where they do, we rely on UK adequacy regulations or on approved safeguards, such as the UK International Data Transfer Agreement or the UK Addendum to the EU standard contractual clauses.
How long we keep it
- Order and invoice records: six years from the end of the financial year, for tax and accounting.
- Customer service messages: up to two years after the matter is closed.
- Newsletter subscriptions: until you unsubscribe.
- Cookie choices: six months, then we ask again.
Your rights
You have the right to be informed, to access your data, to have it corrected or erased, to restrict or object to its use, to data portability, and to withdraw consent at any time (withdrawing does not affect what happened before). To use any of these rights, contact us; we will reply within one month.
If you are unhappy with how we handle your data, please tell us first so that we can put it right. You can also complain to the Information Commissioner’s Office at ico.org.uk or on 0303 123 1113.
Children
This website is for adults. We do not knowingly collect data from children under 13.
Changes to this policy
We will update this page when our practices change and show the date above. For significant changes we will tell you directly where we can.