Privacy policy
[PLACEHOLDER — to be confirmed] The trading entity's registered name, address and company number, and our ICO registration number, are still to be added below. Everything else on this page is final.
Who we are and how to contact us
This privacy notice tells you what to expect us to do with your personal information.
fonëì sells Naga meat pickles online and runs the fonëì Supper Club. We are based in Manchester, United Kingdom.
[PLACEHOLDER — to be confirmed] Registered name, trading address, company number if registered, and ICO registration number.
Email: hello@flavoursofnortheastindia.com
What information we collect, use, and why
To provide goods and services, including delivery:
- Names and contact details
- Addresses
- Purchase or account history
- Account information
For the operation of customer accounts and guarantees:
- Names and contact details
- Addresses
- Purchase history
- Account information, including registration details
- Information used for security purposes
- Marketing preferences
For service updates or marketing:
- Names and contact details
- Marketing preferences
- Purchase or viewing history
- IP addresses
- Website user journey information
- Records of consent, where appropriate
- Messages you choose to send us when registering interest in a Supper Club event, including the number of guests you are asking about
To comply with legal requirements:
- Name
- Contact information
- Financial transaction information
For dealing with queries, complaints or claims:
- Names and contact details
- Addresses
- Account information
- Purchase or service history
- Customer accounts and records
- Financial transaction information
- Correspondence
- Photographs, where you send us one to support a claim — for example a jar damaged in the post
We do not collect or store your card details. Payment is taken by Stripe on its own secure checkout page, and we never see or hold your card number.
Our lawful bases for using your information
Under UK data protection law we must have a lawful basis for collecting and using your personal information. You can read more about lawful bases and about your rights on the ICO's website.
To provide goods and services, and to operate customer accounts and guarantees, our lawful basis is contract — we need the information to enter into or carry out a contract with you.
For service updates and marketing, our lawful basis is consent — you have given us permission, and you can withdraw it at any time.
To comply with legal requirements, our lawful basis is legal obligation.
For dealing with queries, complaints or claims, we rely on contract, legal obligation, and legitimate interests.
Our legitimate interests for handling queries, complaints and claims:
We publish a contact form and an email address so anyone can ask us a question about our products, ingredients, allergens or delivery. Where the person is already a customer, we handle their query as part of our contract with them. Where they are not — for example, someone asking whether a product contains a particular allergen before deciding whether to buy — there is no contract in place, so we rely on legitimate interests.
The interest is simple: we cannot answer a question without knowing who asked it and how to reply. We collect only a name, an email address, and whatever the person chooses to write to us. We do not require an account, we do not ask for anything beyond what we need in order to respond, and we do not use these details for marketing. Enquiries are stored separately from our mailing list, which people join only by opting in themselves.
Most of the benefit runs to the person asking. They receive an answer about a food product — often about allergens or ingredients — which they may need in order to decide whether it is safe for them to buy. It also benefits us, because answering questions properly leads to better-informed customers and fewer complaints.
The impact on the individual is minimal. They chose to contact us and gave us their details for that purpose, so this use is exactly what they would expect. Their message is seen only by the small number of people who run the business, is kept only as long as we need it to deal with the query and any follow-up, and is deleted on request. Anyone can object to this use at any time by emailing us, and we will stop unless we have a separate reason to keep the record, such as a completed order.
Your data protection rights
Depending on the lawful basis we rely on, you have the right to:
- Ask us for copies of your personal information (right of access)
- Ask us to correct information you think is inaccurate or incomplete (rectification)
- Ask us to delete your personal information (erasure)
- Ask us to limit how we use your information (restriction of processing)
- Object to us processing your information
- Ask us to transfer your information to you or another organisation (portability)
- Withdraw your consent at any time, where consent is our lawful basis
If you make a request we will respond without undue delay, and within one month at the latest. To make a request, email us at hello@flavoursofnortheastindia.com.
Where we get personal information from
Directly from you.
How long we keep information
- Orders and related records — six years from the end of the tax year they relate to, because HM Revenue & Customs requires us to keep business and tax records for that long.
- Reviews — for as long as they are published on the site. We delete them on request.
- Reviews we do not publish — three months.
- Contact form messages and emails — 12 months. If a message relates to an order, it is kept with that order instead.
- Supper Club enquiries — until six months after the event, or 12 months if no event takes place.
- Newsletter subscriptions — until you unsubscribe.
- Website analytics — 14 months, and only where you have accepted analytics cookies.
Closing your account removes your sign-in details, your newsletter subscription and any reviews you have left. We must still keep records of completed orders for six years in order to meet our tax obligations, so we cannot delete those on request.
Cookies and analytics
We store two small items in your browser: one to remember what is in your basket, and one to remember your cookie choice. Neither is used for tracking, and neither is sent to us or to anyone else.
Analytics cookies are only set if you accept them. If you decline, or have not yet made a choice, no analytics scripts are loaded at all — nothing is requested from Google and no analytics cookie is set.
Who we share information with
We use the following data processors, who handle personal information on our behalf as part of the service they provide to us:
- Stripe — processes payments for our shop. You enter your card details on Stripe's own secure checkout page; we never see or store them. Stripe passes your name, email address and delivery address back to us so we can fulfil your order, and handles any refunds we issue.
- Supabase — provides the database behind our website. It stores our order records, stock levels, reviews awaiting moderation, newsletter subscriptions, contact form messages and Supper Club enquiries. It also manages sign-in for our own staff.
- Resend — sends our automated email, including order confirmations to customers and notifications to us when someone completes a form.
- Vercel — hosts our website and runs the code behind it. Anything you submit passes through Vercel's infrastructure, and its server logs may briefly hold technical information such as IP addresses.
- Sanity — the content management system holding the words and images on our website. The only personal information it holds is the names, roles and photographs of our own team, and any testimonials we publish with permission.
- Google — provides our website analytics. It only runs if you accept analytics cookies.
We also share personal information with:
- Delivery companies, so that your order can be posted to you. They receive your name and delivery address.
- Our professional and legal advisors, such as our accountant.
- Relevant regulatory authorities, including HM Revenue & Customs and food safety authorities, where the law requires it.
- Publicly on our website — if you leave a review and we publish it, the name you gave is shown alongside it. Your email address is never published; we use it only to check whether the review came from a verified purchase.
Sharing information outside the UK
Our database is hosted in London, so your order records, name and delivery address are stored in the United Kingdom.
Some of our other providers are based outside the UK. Where we transfer personal information abroad we comply with the UK GDPR and make sure appropriate safeguards are in place.
- Stripe — payment processing — Ireland and the United States — Addendum to the EU Standard Contractual Clauses
- Resend — email delivery — United States — Addendum to the EU Standard Contractual Clauses
- Google — website analytics — United States — Addendum to the EU Standard Contractual Clauses
- Vercel — website hosting — United States — International Data Transfer Agreement (IDTA)
- Sanity — content management — Norway and the United States — Addendum to the EU Standard Contractual Clauses
- Supabase — database hosting — data is stored in the United Kingdom; support access from the United States is covered by the Addendum to the EU Standard Contractual Clauses
How to complain
If you have any concerns about our use of your personal information, please contact us first at hello@flavoursofnortheastindia.com.
If you remain unhappy after raising a complaint with us, you can complain to the Information Commissioner's Office.
Information Commissioner's Office, Wycliffe House, Water Lane, Wilmslow, Cheshire, SK9 5AF. Helpline: 0303 123 1113.