Privacy Policy
1. Introduction
Nana Foods Ltd ("Nana Foods", "we", "us", "our") is committed to protecting your privacy. This Privacy Policy explains what personal data we collect when you visit or shop with us at www.nanafoods.co.uk (the "Site"), how and why we use it, who we share it with, how long we keep it, and what rights you have over it.
This Policy applies to customers, prospective customers, and visitors to the Site. It does not cover the practices of third-party websites we may link to, or of separate services (for example, a payment provider's own app), which have their own privacy policies.
Please read this Policy alongside our Delivery Terms & Conditions and Returns Policy and our Cookie Policy. If you have any questions, contact us using the details in Section 15.
2. Who We Are — the Data Controller
| Detail | Information |
|---|---|
| Data controller | Nana Foods Ltd |
| Company number | 11323661 |
| Registered address | 50 Tanfield Ln, Broughton, Milton Keynes MK10 9NY |
| ICO registration number | ZB832584 |
| Data protection contact | [privacy@nanafoods.co.uk] |
We determine the purposes and means of processing your personal data, which makes us a "data controller" under UK GDPR. Where we use other companies to process data on our behalf (e.g. a courier or payment provider), those companies act as our "data processors" under a written contract, or as independent controllers of their own where stated in Section 8.
3. Personal Data We Collect
We collect the following categories of personal data, depending on how you interact with us:
| Category | Examples |
|---|---|
| Identity data | Full name, title, date of birth (only where age-restricted products apply) |
| Contact data | Delivery and billing address, email address, phone number |
| Account data | Username, password (encrypted), account preferences, order history |
| Order & transaction data | Products purchased, order value, delivery slot, substitution choices, payment status (we do not store full card numbers — see Section 8) |
| Technical & usage data | IP address, browser type and version, device identifiers, pages viewed, referral source, cookie identifiers |
| Marketing & communications data | Your preferences for receiving marketing from us and our third parties, and your communication preferences |
| Customer support data | Records of calls, emails, WhatsApp messages or webchat with our customer service team, including complaints and returns |
| Special category data (limited) | Dietary/religious preference signals inferred only from your product choices (e.g. Halal products); we do not ask you to declare religion, health or other special category data directly |
4. How We Collect Your Data
- Directly from you: when you create an account, place an order, contact customer service, sign up to our newsletter, enter a competition, or leave a product review.
- Automatically: through cookies and similar technologies when you browse the Site (see Section 9).
- From third parties: for example, our payment provider confirming a transaction has succeeded, our courier partners confirming delivery status, or publicly available sources used for fraud prevention.
5. How and Why We Use Your Data (Purpose and Legal Basis)
UK GDPR requires us to have a valid legal basis for each way we use your personal data. The table below sets out our main purposes and the specific legal basis relied on for each.
| Purpose | Legal Basis |
|---|---|
| Creating and managing your account | Performance of a contract with you |
| Processing and delivering your order, including substitutions and refunds | Performance of a contract with you |
| Taking payment and preventing fraud | Performance of a contract with you; legal obligation; legitimate interests (fraud prevention) |
| Customer service, complaints and returns handling | Performance of a contract with you; legitimate interests |
| Sending order confirmations, delivery updates and service messages | Performance of a contract with you |
| Sending marketing emails/SMS about offers and new products | Consent (you can opt out at any time — see Section 6) |
| Improving the Site, analysing browsing behaviour and testing new features | Consent (for non-essential cookies/analytics) or legitimate interests, as set out in Section 9 |
| Maintaining the security of the Site and preventing misuse | Legitimate interests; legal obligation |
| Complying with food safety, tax, and accounting record-keeping obligations | Legal obligation |
| Handling a legal claim or dispute | Legitimate interests; legal obligation |
Where we rely on "legitimate interests", we have considered that our interest in operating and improving our business is not overridden by your interests or fundamental rights. You can ask us for more detail on this balancing test at any time using the contact details in Section 15.
6. Marketing Communications
- We will only send you marketing emails, SMS or WhatsApp messages about our offers, new products or promotions if you have opted in, or if you bought similar products from us before and did not opt out (the "soft opt-in" permitted under PECR for existing customers).
- You can opt out of marketing at any time by clicking "unsubscribe" in any marketing email, replying "STOP" to a marketing text, updating your preferences in "My Account", or contacting us at [privacy@nanafoods.co.uk].
- Opting out of marketing will not stop us sending you essential service messages relating to an order you have placed, such as delivery updates or refund confirmations.
- We do not sell your personal data to third parties for their own marketing purposes.
7. Automated Decision-Making and Profiling
We may use limited automated processing to detect potentially fraudulent orders or payments, and to show you more relevant products or offers based on your past purchases (for example, recommending items you buy regularly). We do not use fully automated decision-making that produces a legal or similarly significant effect on you without human review. If an automated fraud check ever results in an order being declined or held, you can ask a member of our team to review this decision manually by contacting us.
8. Who We Share Your Data With
We share the minimum personal data necessary with the following categories of recipient, to enable us to operate the Site and fulfil your order. We do not sell personal data.
| Recipient Category | Named Example(s) | Why We Share |
|---|---|---|
| Payment processors | Dojo | To securely process your card or online payment; they receive card data directly and we do not store full card numbers |
| Delivery and courier partners | Our own delivery drivers | To deliver your order to the address you provide, including your name, address and phone number |
| E-commerce and IT hosting providers | [Magento, cloud hosting provider] | To host the Site, store order data, and keep systems secure |
| Email/SMS marketing platform | [e.g. Mailchimp/Klaviyo — name your actual provider] | To send order confirmations, delivery updates and, where you've consented, marketing messages |
| Accounting and bookkeeping providers | [e.g. Xero/QuickBooks/your accountant] | To meet our legal tax and financial record-keeping obligations |
| Analytics providers | [e.g. Google Analytics — name your actual provider] | To understand how visitors use the Site so we can improve it (subject to cookie consent — see Section 9) |
| Regulators and authorities | HMRC, the Food Standards Agency, local Environmental Health, the ICO, law enforcement | Where we are legally required to, or to protect our legal rights |
| Professional advisers | Our solicitors, accountants and insurers | Where reasonably necessary to obtain advice or in connection with a legal claim |
| Business transfer | A buyer and their advisers, in the event of a sale, merger or restructuring of our business | To allow the transaction to proceed; you would be notified in advance if this affected your data |
9. Cookies and Similar Technologies
We use cookies and similar technologies (such as pixels and local storage) on the Site. Under the Privacy and Electronic Communications Regulations (PECR), as updated by the Data (Use and Access) Act 2025, cookies that are strictly necessary to provide a service you've asked for (e.g. keeping items in your basket, remembering you're logged in) do not require consent. Non-essential cookies — such as analytics, personalisation and advertising cookies — do require your consent, which you give or refuse through our cookie banner when you first visit the Site.
| Cookie Type | Purpose | Consent Required? |
|---|---|---|
| Strictly necessary | Basket, checkout, login sessions, load balancing, security | No — essential to the service you've requested |
| Functional/preference | Remembering your delivery postcode, language or display preferences | Yes, unless limited to a session and strictly necessary for a feature you've requested |
| Analytics | Understanding site usage and improving performance (e.g. Google Analytics) | Yes |
| Marketing/advertising | Showing you relevant ads on other sites and measuring campaign performance | Yes |
- You can change or withdraw your cookie consent at any time via the "Cookie Settings" link in the footer of the Site.
- Refusing non-essential cookies will not stop you browsing or ordering from the Site, but may mean some personalised features are unavailable.
- For full details of the specific cookies we use, their duration and their providers, please see our separate Cookie Policy at [www.nanafoods.co.uk/privacy-policy].
10. International Data Transfers
We store personal data primarily on servers located in the UK/European Economic Area (EEA). Where we use a supplier that stores or accesses data outside the UK/EEA — for example, [name provider and country, e.g. a cloud hosting or email marketing provider based in the United States] — we ensure an appropriate safeguard is in place before the transfer takes place, such as:
- a UK Government "adequacy regulation" confirming the destination country offers an equivalent standard of protection; or
- the UK International Data Transfer Agreement (IDTA) or the UK Addendum to the EU Standard Contractual Clauses; or
- another safeguard recognised under UK GDPR.
You can request a copy of the relevant safeguard by contacting us using the details in Section 15.
11. How Long We Keep Your Data
| Data | Typical Retention Period |
|---|---|
| Account data | For as long as your account is active, plus [X years] after closure in case you return, then deleted or anonymized |
| Order and transaction records | [6 years] from the end of the relevant tax year, to meet HMRC and accounting obligations |
| Customer service and complaints records | [3 years] from resolution, to handle any follow-up queries or claims |
| Marketing consent and preference records | Until you withdraw consent or opt out, plus a suppression record kept indefinitely to ensure we don't contact you again |
| CCTV (if applicable at our collection point/premises) | [30 days], unless needed for an investigation |
| Website analytics/cookie data | As set out in our Cookie Policy, typically [14–26 months] |
These are typical periods; we may retain data for longer where necessary to comply with a legal obligation, resolve a dispute, or enforce our agreements, and we securely delete or anonymise data once it is no longer needed.
12. How We Protect Your Data
- We use industry-standard technical measures to protect your data, including encrypted (HTTPS/TLS) connections, secure hosting, access controls limiting staff access to personal data on a need-to-know basis, and regular software updates and security patching.
- Card payments are processed through PCI-DSS compliant payment providers; we do not store your full card number or security code on our systems.
- We have procedures to detect, investigate and, where required, report personal data breaches to the ICO within 72 hours and to affected individuals where there is a high risk to their rights and freedoms.
- While we take appropriate steps to protect your data, no method of transmission over the internet is 100% secure, and we cannot guarantee absolute security.
13. Your Rights
Under UK GDPR, you have the following rights in relation to your personal data:
| Right | What It Means |
|---|---|
| Access | Ask us for a copy of the personal data we hold about you |
| Rectification | Ask us to correct inaccurate or incomplete data |
| Erasure | Ask us to delete your data in certain circumstances ("right to be forgotten") |
| Restriction | Ask us to limit how we use your data while a query is resolved |
| Portability | Ask us to provide your data in a portable, machine-readable format, or transfer it to another provider |
| Objection | Object to processing based on legitimate interests, or to direct marketing at any time |
| Withdraw consent | Withdraw consent at any time where we rely on consent (this won't affect processing already carried out) |
| Not be subject to solely automated decisions | Request human review of a decision made solely by automated means with legal or similarly significant effect |
To exercise any of these rights, contact us using the details in Section 15. We will normally respond within one month, free of charge. We may need to verify your identity before actioning a request, and may extend the response time by a further two months for complex requests, in which case we'll explain why.
14. Children's Privacy
Our Site and services are intended for adults. We do not knowingly collect personal data from children under 13, and accounts and orders must be placed by someone aged 18 or over. If you believe a child has provided us with personal data, please contact us so we can delete it.
15. Contact Us and Complaints
| Channel | Details |
|---|---|
| Data protection queries | [privacy@nanafoods.co.uk] |
| Customer service | [support@nanafoods.co.uk] / +447777713454 |
| Registered address | 50 Tanfield Ln, Broughton, Milton Keynes MK10 9NY |
If you're unhappy with how we've handled your personal data, please contact us first so we can try to resolve it. You also have the right to lodge a complaint with the UK's independent supervisory authority:
Website: ico.org.uk/make-a-complaint
16. Changes to This Policy
We may update this Privacy Policy from time to time to reflect changes in our practices or the law. Where changes are significant, we will notify you by email or via a prominent notice on the Site before they take effect. The "last updated" date at the top of this page shows when it was last revised.