PRIVACY Policy

At Homali, we respect your privacy and are committed to protecting your personal data. This policy explains what we collect, why we collect it, and how we keep it safe.

— 01 — Who We Are

Homali is a restaurant based in Wallasey, Wirral, United Kingdom. We operate the website homali.uk for online food ordering, delivery, and collection.

Trading address: 67 St Paul's Road, Wallasey, Wirral, CH44 7AJ, United Kingdom. For all data protection queries, please contact us at the details listed at the end of this policy.

— 02 — What Information We Collect

Information you give us

When you place an order, we collect:

• Your name
• Your phone number
• Your email address (optional)
• Your delivery address (only for delivery orders)
• Any special instructions you add to your order
• Your payment information (processed securely by Stripe — we never see or store your card details)

Information collected automatically

• A small saved preference that remembers your delivery or collection choice, so you don't have to enter it every time
• Standard server logs (IP address, browser type, pages visited) for security and troubleshooting

We do not store your payment card numbers. All payments are handled by Stripe, who are PCI-DSS compliant and meet the highest security standards.

— 03 — Why We Use It

To fulfil your order

• Prepare and deliver your food
• Send you order confirmations and updates
• Contact you if there's an issue with your order
• Process your payment

To meet our legal obligations

• Keep tax records for HMRC (we are required to retain these for 6 years)
• Respond to lawful requests from authorities

For marketing — only with your consent

If you tick the marketing box during checkout, we may occasionally send you offers, news about our menu, and event invitations. You can unsubscribe at any time. We will never share your details with other companies for marketing.

Our lawful basis under UK GDPR is “Performance of a Contract” for order-related processing, “Legal Obligation” for tax records, and “Consent” for marketing.

— 04 — Who We Share It With

We share your information only with the parties needed to deliver your order:

• Stripe — to process card and Apple Pay / Google Pay payments
• Google Maps — for delivery address verification and distance calculation
• Our hosting provider — to keep the website running
• HMRC — for tax compliance (legal obligation)

We do not sell, rent, or trade your personal information with anyone for any reason.

— 05 — How Long We Keep It

• Order records: 6 years from the date of the order, as required by HMRC
• Marketing data: until you unsubscribe
• Saved preferences: kept on your own device, and you can clear them at any time
• Server logs: 90 days

After these periods, your data is securely deleted unless we are required by law to keep it longer.

— 06 — Your Rights

Under UK GDPR, you have the right to:

• Access — request a copy of the personal data we hold about you
• Rectification — ask us to correct inaccurate or incomplete information
• Erasure — ask us to delete your data (subject to legal retention obligations)
• Restriction — ask us to limit how we use your data
• Portability — request your data in a portable format
• Object — object to processing for marketing purposes at any time
• Withdraw consent — for any processing based on consent

To exercise any of these rights, contact us using the details below. We will respond within 30 days. If you are unhappy with how we handle your data, you have the right to complain to the Information Commissioner's Office (ICO) at ico.org.uk or by phone on 0303 123 1113.

— 07 — How We Keep It Safe

• HTTPS encryption across our entire website
• Secure password storage and access controls
• Regular software updates and security patches
• Payments handled exclusively by PCI-DSS certified providers
• Restricted staff access — only authorised personnel can view order details

No system is 100% secure, but we work continuously to protect your information. If a data breach affecting your personal information occurs, we will notify you and the ICO within 72 hours, as required by law.

— 08 — Cookies & Local Storage

We use a small number of cookies and browser storage to make our website work properly. We do not use advertising cookies, and we do not share browser storage with any third party — everything below stays with us.

• Order preference — remembers your delivery or collection choice
• Cart storage — keeps your order together while you browse the menu
• Invitation card — if you arrived by scanning the QR code on one of our printed cards, we store a random reference so we can tell how many people those cards reached and whether they led to an order. It contains no personal details and is used for nothing else. Clearing your browser storage removes it.

You can clear these at any time through your browser settings.

— 09 — Children's Privacy

Our website is not directed at children under 16. We do not knowingly collect personal information from children. If you believe we have inadvertently collected information from a child, please contact us and we will delete it immediately.

— 10 — Changes to This Policy

We may update this policy from time to time. The “last updated” date at the top of this page will reflect any changes. For significant changes, we will notify you by email or a notice on our website.

Get in Touch

Homali Restaurant
67 St Paul's Road
Wallasey, Wirral, CH44 7AJ
Email: hello@homali.uk
Phone: 0789 747 2364