Skip to main content

Privacy policy

ELECTRICPIZZASHOP is the data controller for the personal data described below. We handle your information under UK GDPR and the Data Protection Act 2018.

What we collect

  • Contact information - name, email, phone - when you sign up, place an order, or message us.
  • Marketing consent provenance - when, where and how you consented.
  • Engagement data - emails opened, links clicked, purchases made.
  • Order data - billing/shipping addresses, line items, payment status.
  • Downloads you ask for - if you give your email to download a file, we keep your email and a note of which file you asked for.
  • Device + location - IP address, browser type, approximate city (from IP). Optional, cookie-consent-gated.

    • Why we use it

  • To send you marketing communications you've opted in to (consent).
  • To fulfil orders, send receipts and respond to support enquiries (contract).
  • To prevent fraud and abuse (legitimate interest).
  • To know who has taken the files we share when you give your email for a download (legitimate interest). We only send you news emails if you ticked the box to get them (consent).
  • To comply with HMRC tax record obligations (legal obligation).
  • To measure how visitors use the site (consent - cookies).

    • How long we keep it

  • Marketing consent - while consent is valid. Dormant contacts (24 months no engagement) get a re-permission email; if no response within 30 days, marketing is suspended.
  • Orders and tax records - 6 years post-fulfilment (HMRC requirement).
  • Email/SMS engagement events - 180 days.
  • Download requests - the note of which file you asked for, 180 days. Your email stays in our contacts until you ask us to delete it.
  • WhatsApp / Instagram messages - 30 days.

    • Table bookings

    When you book a table we collect your name, your email address, your phone number if you give one, the date, time and size of your booking, and any note you add. Our staff may add to your booking what they need to look after you, such as an occasion you are celebrating. We use all of this to keep your table and to contact you about your booking, for example to confirm it, remind you about it or tell you about a change (contract). If you tell us about an allergy or an access need, in your note or to our staff, we record it with that booking and use it only to look after you on that visit. We hold your booking on SoundOps, the platform this site runs on, and our staff see it so they can look after you. We keep your name, email address and phone number for 24 months after the date of your booking, and your note and any allergy or access need for 90 days after that date. After that we keep only the date, the size and any payment of the booking, without your details. Your name, email address and phone number also stay in our contacts until you ask us to delete them. Booking a table does not sign you up to our news.

    Guest lists

    When you put your name on a guest list, on this site or through WhatsApp, we collect your name, how many people you are bringing, your email address or WhatsApp number, and when you arrive. We use them to confirm your place, to let you in on the night and to contact you about it (legitimate interest). We hold the list on SoundOps, and our door staff see it on the night. We delete the list 30 days after the event. Your name and your email address or number also stay in our contacts until you ask us to delete them. Joining a guest list does not sign you up to our news.

    Messages and enquiries

    When you send us a message through a contact form on this site, we collect your name, your email address, your phone number if you give one, your message and your answers to the form's questions. To stop spam we also keep a scrambled form of your IP address and the type of browser you used. We use them to reply to you and to deal with your enquiry (legitimate interest). We keep your message on SoundOps, and a copy is emailed to us. We delete it from SoundOps 365 days after you send it.

    Who we share it with

    We use the following data processors:

  • Square (Block, Inc.) - Till data, only for a venue that connects its own Square account: read-only access to closed bills, to record what a booked table spent (US + EU (Square's own infrastructure); EU Standard Contractual Clauses + UK Addendum)
  • Amazon Web Services - Object storage (S3), email sending (SES), SMS (Pinpoint), queues (SQS), event bus (EventBridge), DNS (Route53) (Ireland (eu-west-1); Within UK / EEA adequacy)
  • MongoDB Atlas - Database (one cluster, per-tenant databases) (Per-cluster (verify in Atlas console); EU Standard Contractual Clauses + UK Addendum)
  • Vercel - Hosting, edge compute, SSL termination (Global edge (default US, configurable EU regions); EU Standard Contractual Clauses + UK Addendum)
  • Stripe - Payment processing, subscription billing, Connect accounts (US + UK + Ireland; EU Standard Contractual Clauses + UK Addendum)
  • Meta Platforms (WhatsApp / Instagram / Facebook) - WhatsApp Cloud API messaging, Instagram Graph API, Conversions API (Ireland + US; EU Standard Contractual Clauses + UK Addendum)
  • Anthropic - Claude AI for AI Writer + support chatbot (US; EU Standard Contractual Clauses + UK Addendum)
  • Upstash - Redis cache (rate limiting, tenant resolution L2 cache) (Per-database (configurable); EU Standard Contractual Clauses + UK Addendum)
  • Cloudflare - Turnstile CAPTCHA (anti-abuse) (Global edge (US-headquartered); EU Standard Contractual Clauses + UK Addendum)
  • Sentry - Error tracking + performance monitoring (PII redacted via Pino) (US; EU Standard Contractual Clauses + UK Addendum)

    • For full details including data residency and transfer mechanisms see our sub-processor list.

    Your rights

    Under UK GDPR you have the right to:

  • Access your data (Article 15) - request a SAR via the preference centre link in any marketing email.
  • Rectification (Article 16) - correct anything that's wrong.
  • Erasure (Article 17) - ask us to delete your data.
  • Restriction (Article 18) - ask us to pause processing while a dispute is open.
  • Portability (Article 20) - receive a machine-readable copy of your data.
  • Objection (Article 21) - opt out of marketing or legitimate-interest processing.

    • To exercise any of these contact josh+eps@soundops.io. You can also complain to the UK Information Commissioner's Office at https://ico.org.uk/.

    Contact

    For any privacy questions, contact josh+eps@soundops.io.

    Last reviewed: 2026-10-18