Privacy Notice for Online Hot Food Orders

Last updated 12 October 2026

This notice explains how we use your personal information when you order hot food for collection on order.fojo.food. It doesn't cover orders made in our shop, through Deliveroo or on our meal prep website fojomealprep.co.uk.

Who We Are

Fojo Fresh Asian Food is a trading name of GLUK Ltd, a company registered in Northern Ireland, company number NI676619. GLUK Ltd decides how your information is used, which makes us the controller under UK data protection law.

You can contact us about anything in this notice:

• by email at privacy@fojo.food
• by post at Fojo Fresh Asian Food, 31 Castlereagh Road, Belfast BT5 5FP

What We Collect

When you place an order, we collect:

• your name, phone number and email address
• your order, which is the dishes and choices you pick, your collection date and time, the price and your order reference
• a record of your payment from Square, such as the amount, the time and whether it went through or was refunded

We never see or store your card details, as you pay on Square's own payment page.

When you use the checkout, we also collect:

• a random code, kept in a cookie in your browser, which links your checkout to you
• a coded version of your device's network address (your IP address), made with a secret key, so we don't store the address itself

Our website host and our database host also handle your network address to deliver the website and block abusive traffic, and keep it in their logs for a short time.

When you contact us, we keep what you send us.

We need your name, phone number and email address to take an order, so we can't take one without them.

How We Use It and Why We're Allowed To

• Taking your order. We use your details to make your order, have it ready at your collection time, send you your confirmation and order link, and contact you if something changes. We're allowed to as it's needed to carry out our agreement with you.
• Taking payment. We pass your order, name, email address and phone number to Square to take your payment, refund you if needed, and sort out a payment that went through without an order being placed. This is also needed to carry out our agreement with you.
• Keeping the checkout fair and secure. We use the cookie code and the coded network address to stop one person holding many collection times at once, and to protect the website. We do this in our legitimate interests, as it keeps collection times free for real customers.
• Keeping accounting records. We keep records of orders and payments, as UK tax law requires us to. This is a legal obligation.
• Dealing with questions, complaints and legal claims. We use what we hold to answer you and to defend or bring a legal claim, in our legitimate interests.

We don't send marketing emails, and we don't sell or rent your information.

Who We Share It With

• Square, which takes your payment. Square uses your payment details for its own purposes too, such as preventing fraud, under its own privacy notice - https://squareup.com/gb/en/legal/general/privacy-no-account
• Square also creates a customer record in our Square account with your name, email address and, if Square has it, your phone number. Square holds it for us. It's created automatically and we don't use it.
• Supabase, which hosts our order database in London.
• Vercel, which hosts our website. The parts of the website that handle your order run in London.
• Resend, which sends our emails.
• Our email providers, which hold the emails our staff receive about orders and the emails you send us.
• Our staff, who see your name, phone number, email address and order so they can make it and hand it over.

We only share your information with anyone else when the law requires us to, for example with HMRC or the police.

Where It's Stored

Our order database is in London, and the parts of our website that handle your order run there too. Some of our providers are US companies and store or can access your information in the US, for example Resend keeps its copies of our emails there. Some of our team work outside the UK, including in Switzerland, which UK law recognizes as protecting personal information properly. Transfers to the US are protected either by the UK's approval of transfers to certified US companies or by contract terms approved by the UK. You can ask us for details at privacy@fojo.food.

How Long We Keep It

• Your name, phone number and email address are removed from our order system about 30 days after your collection time. If a payment went through without an order, they're removed about 30 days after we've sorted it out.
• If you start a checkout and don't pay, your details are deleted about a day after your held collection time runs out, once we've checked that no payment came in.
• Our database backups keep removed details for up to 7 more days.
• The customer record Square creates in our Square account is deleted within two months of your order.
• The coded network address is deleted after 15 minutes.
• Resend deletes its copies of our emails after 30 days.
• The order emails our staff receive are kept for as long as we need them to run the shop and answer questions about orders.
• Your order and payment records are kept as our accounting records for at least six years, as UK tax law requires. After the first 30 days they no longer include your name, phone number or email address, though the order and payment in our Square account still do, as Square doesn't let us delete them. We also keep a coded version of your cookie code and a coded record of your checkout with them. Neither shows your details, though someone who already knew your details could match them to these records.
• Emails you send us are kept for as long as we need them to deal with your message.

Cookies and Storage on Your Device

Everything we store on your device is needed for the ordering you ask for, so the law doesn't require us to ask for your consent. We don't use advertising or analytics cookies. We store:

• a cookie called __Host-fojo_checkout, which holds a random code linking your checkout to your browser, so one person can't hold many collection times at once, and so we can show you your order when you come back from paying. It normally ends when you close your browser.
• your basket, saved in your browser so it's still there if you leave and come back. It's deleted when you empty it, when you come back to our website after paying, or the next time you visit after its collection date has passed.
• your checkout details, saved in your browser tab while you pay, so they're not lost when you come back from Square. They're deleted when your order is confirmed on our website, when your held collection time runs out, or when you close the tab.

Square's payment page sets its own cookies, which Square's privacy notice explains.

Your Rights

You have the right to:

• ask for a copy of your information
• ask us to correct it
• ask us to delete it
• ask us to limit how we use it
• ask for the information you gave us in a format you can reuse

You can also object at any time to us using your information where we rely on our legitimate interests, which is for keeping the checkout fair and secure and for dealing with questions, complaints and legal claims. We'll stop unless we have strong reasons to continue that outweigh yours, or need it for a legal claim.

To use any of these rights, email privacy@fojo.food. We'll reply within one month. Some rights have limits, for example we have to keep accounting records even if you ask us to delete them.

Complaints

If you're unhappy with how we've used your information, email privacy@fojo.food. We'll confirm we've received your complaint within 30 days, look into it without undue delay, keep you updated and tell you the outcome.

If you're still not happy, you can complain to the Information Commission, known as the ICO, at https://ico.org.uk/make-a-complaint/ or by calling 0303 123 1113.

Automated Decisions

No decision about you that has a legal effect, or a similarly serious one, is made by a computer alone. The checkout does automatically turn away a checkout when too many come from one device or network in a short time. That only stops that checkout, and you can try again later or contact us.

Changes to This Notice

When we change how we use your information, we'll update this notice and the date at the top.