Privacy Policy

1. Introduction

Welcome to Bamboo Inn Catering Ltd ("we," "our," or "us"). We are committed to protecting your privacy and ensuring the security of your personal information. This Privacy Policy explains how we collect, use, disclose, and safeguard your information when you visit our website or use our services.

By accessing or using our website, you agree to the terms of this Privacy Policy. If you do not agree with the terms, please do not access the site. This policy complies with the General Data Protection Regulation (GDPR) and the UK Data Protection Act 2018.

2. Information We Collect

2.1 Personal Information

We may collect personal information that you voluntarily provide to us when you:

• Fill out our contact form
• Place an order through our website or by phone
• Subscribe to our newsletter or promotional communications
• Contact us via email, phone, or social media
• Participate in promotions, surveys, or competitions
• Apply for employment with us

This information may include:

• Name and surname
• Email address
• Phone number
• Delivery or billing address
• Dietary requirements or allergies
• Payment information (processed securely by third-party providers)
• IP address and browser information

2.2 Automatically Collected Information

When you visit our website, we may automatically collect certain information about your device and usage, including:

• IP address and approximate location
• Browser type and version
• Operating system
• Pages visited and time spent on each page
• Referring website or search terms
• Device type and screen resolution

3. How We Use Your Information

We use the information we collect for the following purposes:

• To process and fulfill orders: Preparing your food, arranging delivery or collection, and processing payments
• To communicate with you: Responding to inquiries, sending order confirmations, delivery updates, and providing customer support
• To improve our services: Analyzing website usage patterns to enhance user experience and menu offerings
• To send marketing communications: With your explicit consent, we may send promotional offers, new menu updates, and special event information
• To comply with legal obligations: Meeting food safety regulations, tax requirements, and other statutory obligations
• To prevent fraud: Protecting our business and customers from fraudulent transactions

4. Legal Basis for Processing (GDPR)

Under the General Data Protection Regulation, we process your personal data based on the following legal grounds:

• Contractual necessity: Processing necessary to fulfill your food order or catering request
• Legitimate interests: Improving our services, preventing fraud, and ensuring website security
• Legal obligation: Compliance with food safety, tax, and health & safety regulations
• Consent: Marketing communications and optional cookies (you can withdraw consent at any time)

5. Data Sharing and Disclosure

We do not sell, trade, or rent your personal information to third parties. We may share your data with:

• Service providers: Delivery partners, payment processors (Stripe, PayPal), and IT service providers who assist in our operations
• Legal authorities: When required by law, court order, or to protect our legal rights
• Professional advisors: Accountants, auditors, and legal advisors in connection with our business operations
• Business transfers: In connection with a merger, acquisition, or sale of assets, with appropriate confidentiality protections

6. Data Security

We implement appropriate technical and organizational measures to protect your personal data against unauthorized access, alteration, disclosure, or destruction. These measures include:

• SSL/TLS encryption for all data transmission
• Secure server infrastructure with firewalls
• Regular security assessments and penetration testing
• Restricted access to personal data (authorized personnel only)
• Staff training on data protection and privacy
• Regular backup and disaster recovery procedures

7. Data Retention

We retain your personal information only for as long as necessary to fulfill the purposes outlined in this Privacy Policy, unless a longer retention period is required by law:

• Order and transaction records: 6 years (for tax and accounting purposes)
• Contact form submissions: 2 years
• Marketing preferences and consent records: Until you unsubscribe or withdraw consent
• Website analytics data: 26 months
• Employment applications: 1 year (if unsuccessful)

8. Your Rights Under GDPR

Under the General Data Protection Regulation, you have the following rights regarding your personal data:

• Right to access: Request a copy of the personal data we hold about you
• Right to rectification: Request correction of inaccurate or incomplete data
• Right to erasure: Request deletion of your personal data ("right to be forgotten")
• Right to restrict processing: Request limitation on how we use your data
• Right to data portability: Receive your data in a structured, machine-readable format
• Right to object: Object to processing based on legitimate interests or direct marketing
• Right to withdraw consent: Withdraw consent at any time (does not affect lawfulness of processing before withdrawal)

To exercise any of these rights, please contact us using the details provided below. We will respond to your request within one month.

9. Cookies and Tracking Technologies

Our website uses cookies and similar technologies to enhance your browsing experience:

• Essential cookies: Necessary for website functionality (e.g., shopping cart, user preferences)
• Analytics cookies: Help us understand how visitors interact with our site (Google Analytics)
• Marketing cookies: Used to deliver relevant advertisements and track campaign performance

You can manage your cookie preferences through your browser settings. For more information, please see our Cookie Policy.

10. Third-Party Links

Our website may contain links to third-party websites (e.g., social media platforms, review sites). We are not responsible for the privacy practices or content of these external sites. We encourage you to read their privacy policies before providing any personal information.

11. Children's Privacy

Our services are not directed to individuals under the age of 16. We do not knowingly collect personal information from children. If you believe we have inadvertently collected such data, please contact us immediately and we will delete the information.

12. International Data Transfers

We are based in the United Kingdom and primarily process data within the UK and European Economic Area (EEA). If we transfer your data outside the EEA, we ensure appropriate safeguards are in place, such as Standard Contractual Clauses or adequacy decisions.

13. Changes to This Policy

We may update this Privacy Policy from time to time to reflect changes in our practices or legal requirements. Changes will be posted on this page with an updated revision date. We encourage you to review this policy periodically. Significant changes will be notified via email or website banner.

14. Contact Us

If you have any questions, concerns, or requests regarding this Privacy Policy or our data practices, please contact our Data Protection Officer:

15. Complaints

If you are not satisfied with our response to your privacy concerns, you have the right to lodge a complaint with the Information Commissioner's Office (ICO), the UK supervisory authority for data protection issues:

Website: www.ico.org.uk
Phone: 0303 123 1113
Address: Wycliffe House, Water Lane, Wilmslow, Cheshire SK9 5AF, UK