Privacy Policy

Who We Are

Homali is a restaurant based in Wallasey, Wirral, United Kingdom. We operate the website homali.uk for online food ordering, delivery, and collection.

Trading address: Six Seven St Paul's Road, Wallasey, Wirral, CH44 7AJ, United Kingdom.

For all data protection queries, please contact us at the details listed at the end of this policy.

What Information We Collect

Information you give us

When you place an order, we collect:

• Your name (first name required, last name optional)
• Your phone number
• Your email address
• Your delivery address (only for delivery orders)
• Any special instructions you add to your order
• Your payment information (processed securely by Stripe or PayPal — we never see or store your card details)

Information collected automatically

• A small cookie that remembers your delivery preference for 7 days, so you don't have to enter it every time
• Standard server logs (IP address, browser type, pages visited) for security and troubleshooting

Why We Use It

We use your information for the following purposes:

To fulfil your order

• Prepare and deliver your food
• Send you order confirmations and updates
• Contact you if there's an issue with your order
• Process your payment

To meet our legal obligations

• Keep tax records for HMRC (we are required to retain these for 6 years)
• Respond to lawful requests from authorities

For marketing — only with your consent

If you tick the marketing box during checkout, we may occasionally send you offers, news about our menu, and event invitations. You can unsubscribe at any time. We will never share your details with other companies for marketing.

Our lawful basis under UK GDPR is "Performance of a Contract" for order-related processing, "Legal Obligation" for tax records, and "Consent" for marketing.

Who We Share It With

We share your information only with the parties needed to deliver your order:

• Stripe — to process card and Apple Pay / Google Pay payments
• PayPal — to process PayPal payments
• Google Maps — for delivery address verification and distance calculation
• Our hosting provider — to keep the website running
• HMRC — for tax compliance (legal obligation)

We do not sell, rent, or trade your personal information with anyone for any reason.

How Long We Keep It

• Order records: 6 years from the date of the order, as required by HMRC
• Marketing data: until you unsubscribe
• Cookies: 7 days, then automatically expire
• Server logs: 90 days

After these periods, your data is securely deleted unless we are required by law to keep it longer.

Your Rights

Under UK GDPR, you have the right to:

• Access — request a copy of the personal data we hold about you
• Rectification — ask us to correct inaccurate or incomplete information
• Erasure — ask us to delete your data (subject to legal retention obligations)
• Restriction — ask us to limit how we use your data
• Portability — request your data in a portable format
• Object — object to processing for marketing purposes at any time
• Withdraw consent — for any processing based on consent

To exercise any of these rights, contact us using the details below. We will respond within 30 days.

How We Keep It Safe

We take the security of your information seriously and use industry-standard measures:

• HTTPS encryption across our entire website
• Secure password storage and access controls
• Regular software updates and security patches
• Payments handled exclusively by PCI-DSS certified providers
• Restricted staff access — only authorised personnel can view order details

No system is 100% secure, but we work continuously to protect your information. If a data breach affecting your personal information occurs, we will notify you and the ICO within 72 hours, as required by law.

Cookies

We use a small number of cookies to make our website work properly. We do not use tracking or advertising cookies.

Functional cookies (always on)

• homali_order_preference — remembers your delivery or collection choice for 7 days
• WooCommerce session cookies — keep your cart contents while you shop

You can clear these cookies at any time through your browser settings.

Children's Privacy

Our website is not directed at children under 16. We do not knowingly collect personal information from children. If you believe we have inadvertently collected information from a child, please contact us and we will delete it immediately.

Changes to This Policy

We may update this policy from time to time. The "last updated" date at the top of this page will reflect any changes. For significant changes, we will notify you by email or a notice on our website.