Privacy policy

Who we are. Slurpped Ramen Ltd, registered in England and Wales, company number 17149671. Registered office: 80B High Street, Hanham, Bristol BS15 3DS. VAT number GB518076193. We are the data controller for the personal information described here. Questions about your information: hello@slurpped.co.uk. We are registered with the Information Commissioner's Office, registration number ZC226086.

The short version. We collect what we need to cook your food, get it to your door, and stay in touch if you've asked us to. We don't sell your information to anybody, ever. You can ask us what we hold and ask us to delete it, and we'll sort it.

What we collect and why

When you order. Your name, delivery address, email, phone number, what you bought, your delivery day, and your order history. We need this to make and deliver your food. The legal basis is performance of our contract with you.

Your payment details. We never see or store your card number. Payment happens on Shopify's checkout, which is certified to PCI DSS Level 1. All we receive back is the last four digits and the card type, so we can match a payment to an order. Subscription renewals work the same way: the card is held securely by Shopify's payment system, not by us.

When you subscribe. Your chosen kit, frequency, standing delivery day, and renewal dates, so we know what to cook and when. The legal basis is performance of our contract with you.

When you check your postcode. Your postcode is checked in your own browser against the areas we can reach. It is stored only for that browsing session and is not sent to us or saved to your account.

When you create an account. Your email address and order history, so you can manage your subscription yourself. The legal basis is performance of our contract with you.

When you email us or use the contact form. Your name, email, message and order number if you give one, so we can answer you. The legal basis is our legitimate interest in answering customer questions.

If you tell us about an allergy or a medical condition. Information about your health is treated more carefully by law than an address is. If you email us about an allergy, we use it only to answer your question, and we delete it once that's done. We do not copy it into your customer record or use it to decide what to send you. The legal basis is your explicit consent, given by choosing to tell us. Always check the label on the box before cooking, because recipes change.

When you sign up for emails. Your email address, and which form you used, so we know how you found us. The legal basis is your consent, which you can withdraw at any time.

When you leave a review. Your name or chosen display name, your rating and your words, plus any photo you upload. Reviews are published on our site. The legal basis is your consent, and you can ask us to remove a review at any time.

When you browse. Cookies and similar storage, covered in its own section below.

Marketing, and how to stop it

If you signed up. You gave us your email through our website, so we'll send you news about the rotating special, new bowls and occasional offers. You consented, and you can withdraw that consent at any time.

If you've bought from us. We may email you about our own ramen kits and extras, which is allowed under the direct marketing rules because you bought something similar from us and we gave you the chance to say no when we took your details. We only ever use this for our own food and kit, never for anybody else's products.

Stopping it is always one click. Every marketing email has an unsubscribe link at the bottom, and it works immediately. You can also email hello@slurpped.co.uk and we'll take you off. When you unsubscribe we keep your address on a suppression list, because that's the only way to be certain we don't accidentally email you again.

We never sell or rent your details to another company for their own marketing. Not now, not later.

Who else touches your information

We use a small number of trusted companies to run the shop. Each one only gets what it needs, each is bound by a contract to protect it, and none of them may use it for their own purposes.

Shopify runs our website, checkout and payments. Gets order, account and payment processing data.
Seal Subscriptions manages subscriptions and renewals. Gets name, email, address and subscription details.
Omnisend sends our marketing emails. Gets email address, name, purchase and browsing activity.
Judge.me collects and publishes reviews. Gets name or display name, email and review content.
Our delivery courier delivers your box. Gets name, address, phone number and delivery instructions.
Our accountant keeps our books straight. Gets transaction records.

Meta, for our adverts. We advertise on Facebook and Instagram, and to do that we share some information with Meta. Meta's pixel on our site tells Meta which pages you look at and what you add to your basket. If you buy, we also pass on the order value and a scrambled (hashed) version of your email, phone number, name and address, so Meta can match the sale to an advert it showed you. We use this to show our adverts to people who might like ramen and to see whether they are working. Meta is not on the list above because it also uses what it receives for its own purposes, under its own privacy policy. None of it is shared unless you accept marketing cookies in our banner, and you can change your mind at any time using the cookie preferences link in the footer. The legal basis is your consent.

We will also share information where the law requires it, for example with HMRC, or to establish or defend a legal claim.

Cookies and browser storage

Some of these are needed to make the site work at all. The rest only run if you agree to them in our cookie banner, and you can change your mind at any time using the cookie preferences link in the footer.

Strictly necessary, always on. These make the shop function and cannot be switched off.

Shopify's own cart, checkout and security cookies, which remember what's in your basket and keep the checkout safe.
A short-lived note that your postcode passed our delivery check, cleared when you close the browser.
Small preferences that remember whether you dismissed our sign-up card or opened a menu, so we don't ask you the same thing twice.

Marketing and analytics, only with your consent. These help us understand what people look at and send relevant emails.

Omnisend, which recognises you between visits so our emails make sense and we can email you about a basket you left behind.
Judge.me, which relates to displaying reviews.
Meta's advertising pixel, which tells Facebook and Instagram that you visited, so we can show you our adverts and see whether they work.
Shopify's own analytics, which tells us how the shop is performing.

If you decline, these are not set, and declining does not stop you buying anything.

Where your information goes

Some of our suppliers are based outside the UK, including in the United States and the European Union. Where information leaves the UK, it is protected by the safeguards the law requires, which means either an adequacy decision covering that country or standard contractual terms approved for UK transfers. You can ask us for details of the safeguards that apply.

How long we keep it

Orders, invoices and payment records: 7 years after the end of the relevant tax year, because HMRC and company law require it.
Your customer account: while your account is open, then 3 years after your last order.
Subscription records: same as orders.
Marketing contacts: until you unsubscribe. We review inactive addresses after 2 years.
Unsubscribe suppression list: indefinitely, because it is the only way to honour your unsubscribe.
Contact form messages and support emails: 12 months, or 7 years where it relates to an order or a refund.
Emails mentioning an allergy or health: deleted once we've answered you.
Reviews: published until you ask us to remove yours.

Your rights

Under UK data protection law you can ask us to:

Show you what we hold about you, and give you a copy.
Correct anything that's wrong.
Delete your information, where we don't have a legal reason to keep it. Order records we have to keep for tax, but we can remove you from everything else.
Stop or limit what we do with it, including stopping marketing entirely.
Hand it over to you or another company in a portable format.
Object to processing we do on the basis of legitimate interests.
Withdraw consent at any time, where consent is what we relied on.

Email hello@slurpped.co.uk and we'll deal with it. We'll come back to you within one month, and it costs you nothing. We may ask you to confirm who you are first, so we don't hand your information to somebody else.

If you think we've got it wrong, please tell us first and we'll try to put it right. You also have the right to complain to the Information Commissioner's Office at ico.org.uk, or on 0303 123 1113.

Keeping it safe

Access to customer information is limited to the people who need it, protected by two-factor authentication, and our suppliers are chosen for their security as much as anything else. If something ever does go wrong and it puts you at risk, we will tell you, and we will tell the Information Commissioner's Office within 72 hours as the law requires.