Last updated 14 October 2026
Privacy policy
This explains what Shahzad Halal Butchers (“we”) collects about you when you use this website or our iPhone app, why, how long we keep it, who we share it with, and what you can ask us to do. The website and the app are one shop with one set of accounts, so everything here applies to both, except where it says otherwise. The data controller is Muhammad Shahzad, trading as Shahzad Halal Butchers. You can reach us at info@shahzadhalalbutchers.co.uk or by post at 593F Atlas Road, Wembley, London, HA9 0JH. We paid the Information Commissioner's Office's data protection fee on 24 September 2026 (reference C2041457); our registration number will be shown here when the ICO sends it.
What we collect, and why
| What | Why | Legal basis |
|---|---|---|
| Name, email address, password — or, if you sign in with Apple or Google instead, the name and email address they give us | To create and secure your account | Contract |
| If you sign in with Apple: a scrambled fingerprint of the Apple ID you used, made with a secret key of ours so it cannot be turned back into your Apple ID | To recognise the same Apple ID next time, even if you have since asked Apple to hide your email address from us, and before then to check with you by email that it is yours. A new Apple ID that hides its address cannot open your account until you confirm it from your own inbox | Contract |
| The name an order is for, and a phone number | To know who an order is for, and to ring you about it, whether it is delivered or collected | Contract |
| Delivery address | To deliver an order | Contract |
| A note for the rider, if you give one | To help the rider find you: a gate or door code, which entrance, a landmark. Only the shop sees it; it is never printed on the label on your bag or put in an email | Contract |
| A note for the butcher when you order, and a reason when you cancel, if you write either | The note is so we can cut and pack your order the way you asked; the reason is so we know why an order was called off. Only the shop sees them, besides you: we repeat your note in your order confirmation, and your reason in the email confirming the cancellation. Neither is printed on the label on your bag. Both are kept with the order | Contract (the note); legitimate interest (the reason) |
| Orders, weights, prices, invoices | To fulfil orders and keep the accounts the law requires | Contract; legal obligation |
| Payments recorded against an order or account: the amount, the date, how it was paid and any reference | To know an order or invoice is paid | Contract; legal obligation |
| Trade account details, credit limit, payment terms | To run an account for a business customer | Contract; legitimate interest |
| Server logs (IP address, browser, pages requested) | To keep the site secure and working | Legitimate interest |
| The postcode area you check for delivery | To decide where to deliver next. We keep the area (the first part and one digit, such as NW10 2), not the full postcode, and not who asked | Legitimate interest |
| If you tell us something was wrong with an order: what was wrong, how you told us, any photos or messages you send us, and what we decided. Photos and messages stay on the shop's phone and in its mailbox; this site keeps only a short note of what was wrong, and what we decided, with the order | To put it right, as the law and our terms require, and to answer your bank if you question the payment | Contract; legal obligation |
| A photo our rider may take of where your order was left, when it is delivered | To show that it was delivered, and where, if you tell us it never came or question the payment with your bank. Only the shop sees it | Legitimate interest (you can object: see below) |
| A count of the claims we have turned down for an account, and why | To notice when claims are made about meat that was not faulty. A person looks at it, never a computer on its own | Legitimate interest (you can object: see below) |
| A notification address for your phone, only if you turn notifications on | To tell you each time an order of yours is out for delivery (usually the moment it is scanned out). Your browser gives us an address at Google's, Apple's or Mozilla's notification service; we send an empty signal to it, so nothing about your order passes through them, and your phone then asks us what to show. Turn it off on your account page and we stop | Consent |
| A notification token for our iPhone app, only if you turn notifications on in the app | To tell you when your order is ready to collect, on its way, delivered, or cancelled by us. Apple's notification service carries a short line to your phone, such as “Your order is ready to collect”, with no order number, name, address or items; when you tap it, the app asks us which order it was about. Turn it off in the app or on your account page, or sign out of the app, and we stop | Consent |
We do not collect anything we do not need for one of these purposes. We do not buy data about you. We do not use analytics, advertising or tracking cookies.
To open an account you must give a name, an email address and a password, or sign in with Apple or Google instead. To place an order you must give the name it is for and a phone number, and for a delivery an address. Without them we cannot open the account or take the order. Anything the table marks “if you give one” or “if you write either” is up to you, and so are notifications.
How long we keep it
- Orders, invoices and payments: six years after the end of the tax year they fall in, because HMRC requires it.
- Problems reported with an order: our record of what was wrong and what we decided is kept with the order, for the same six years. Photos and messages you send us about it are deleted from the shop's phone and mailbox once the claim is settled, and in any case within 12 months.
- Photos taken at the door: deleted automatically 30 days after delivery.
- A note for the rider, if you give one: it is kept on your saved address until you change or remove it, and on a delivery order until 30 days after the order is delivered or cancelled. Deleting your account clears it.
- Your account: until you delete it, or after three years of no orders, when we will email you before closing it.
- If you sign in with Apple: the fingerprint of your Apple ID is kept as long as your account, and erased when you delete it. If you confirm an Apple ID but have no account with us and don’t go on to sign in, it is erased after a day. A link we email you to confirm an Apple sign-in works once, for 30 minutes, and our record of it is erased after 24 hours.
- Server logs: seven days at most, after which our host, Cloudflare, deletes them.
- Notifications: the address or app token for your phone is used only while notifications are on. When you turn them off or sign out of the app we stop using it, and keep it switched off as the record that you said no — so the app cannot switch itself back on — until you delete your account, when it is erased. What we sent is kept for as long as the order it was about.
When you delete your account, we remove your name, email address and phone number from it and erase the addresses you saved, and anything we kept to recognise your Apple ID. We also ask Google to delete your sign-in record at Firebase Authentication: your email address, your password if you set one, your name, and its link to any Apple or Google account you signed in with. That Apple or Google account itself is yours, and is not deleted. We ask straight away, and if Google does not accept it first time we keep asking automatically. If you sign in again with the same details before it has gone, that opens a new, empty account, and the sign-in record stays, as that new account's. Once it is deleted, Google clears it from its own systems, backups included, within 180 days. Your past orders and invoices stay for the six years HMRC requires, and each order still shows the name, phone number and address it was placed with, any note for the butcher or reason for cancelling, and any problem reported with it; any note for the rider is cleared.
Who we share it with
Only the companies that help us run the site, the app and the shop, and only what each needs. Neon, Google (for signing in), Cloudflare, Resend and Stripe work for us under data protection terms that are part of their standard contracts: they handle what we send them on our instructions, to provide their service to us, must keep it secure, and must tell us if it is ever lost or exposed. Their terms also let some of them use part of it for their own purposes, such as Cloudflare and Resend, to run and improve their own services (and Resend to prevent fraud and misuse), and Stripe, to prevent fraud, meet its legal duties and improve its service (see below). For the others we cannot point to terms like these, so we say below exactly what each is sent or holds: postcodes.io, PrintNode, the notification service your browser uses, Apple, WhatsApp, our email mailbox and our accountant.
- Neon hosts our database, in London.
- Google handles signing in, on the website and in the app, through Firebase Authentication, and holds your sign-in record: your email address, your name, your password in a scrambled form we cannot read if you set one, and, if you choose “Sign in with Apple” or “Continue with Google”, the Apple or Google account you used — with, for Google, the link to your Google profile photo. In the app, and when you use the Apple or Google button on the website, your phone or browser talks to Google directly, so Google also sees its internet address and which browser or app it is, and keeps the address for a few weeks to protect against misuse. Signing in tells Google nothing about your orders. If you choose “Continue with Google”, Google also knows, as the provider of your Google Account, that you signed in to us, and that part is covered by Google's own privacy policy. When you delete your account, we ask Google to delete this record (see above). When our sign-in and sign-up pages offer Apple or Google, on Safari and on phones they also load Google's sign-in code as they open, so that the window can open the moment you press the button; Google sees that your browser asked for it. Google holds your sign-in record in the United States, under the safeguards the UK government permits for transfers there.
- Cloudflare runs and delivers the site, keeps its server logs, stores the pictures of our products, and keeps any photo taken at the door, privately, for 30 days.
- Resend sends our emails, such as order confirmations.
- Our email provider holds our mailbox: the emails you send us, and anything attached to them, such as a photo of a problem with an order. It may hold them outside the United Kingdom.
- WhatsApp, owned by Meta, carries your messages and photos to us if you choose to message us there. What WhatsApp does with them is covered by its own terms and privacy policy, and it may handle them outside the United Kingdom.
- Stripe takes the card payment for every household order: on its own checkout page from our website, and in our app in its own payment sheet, or the same checkout page if the sheet cannot open (more below).
- postcodes.io, a free UK postcode service, is sent a postcode on its own — never your name or anything else — to check it is a real one and to find where it is, for planning deliveries.
- Apple confirms who you are if you choose Sign in with Apple, and tells us your name, the first time only, and your email address — or, if you ask Apple to hide it, a private address of Apple's that forwards our emails to you. Apple learns that you signed in to us, never what you order; what it does with your Apple Account is covered by its own privacy policy. Apple also carries notifications to our iPhone app, if you turn them on there: the app's token for your phone, and a short line such as “Your order is out for delivery” — never your order number, name, address or what you bought. Apple may handle this outside the United Kingdom.
- PrintNode passes the labels for your bags to the label printer in our shop. Each label carries the name and delivery address on the order, the phone number given for the delivery, and what is in the bag, its weight and price. A label waiting for the printer is dropped after an hour.
- Our accountant sees invoices, as the law requires.
Neon keeps our database in London. Google, Stripe, Cloudflare and Resend may handle what they are sent in the United States or elsewhere outside the United Kingdom; when they do, it is under the safeguards UK law requires, which are part of the terms named above: the UK–US data bridge, or the standard contractual clauses with the UK's addendum. Email us for a copy of them. The others may also handle what they hold outside the United Kingdom, under their own terms.
Your card details never reach us. You type them into Stripe's own payment form: its checkout page on our website, and in our app its payment sheet, or the same checkout page if the sheet cannot open. In the app, the payment sheet can also read them from the card with your phone's camera, if you choose to scan it. Stripe is the payment processor. We send Stripe the amount, the order reference and your email address and, when you pay on Stripe's own checkout page, what you are buying: each item, its weight and price, and any delivery charge. Stripe sends us back only whether the payment worked and a reference for it. When we refund you, we tell Stripe which payment, how much and the order reference — never what was wrong — and Stripe tells us when the refund has gone. While you pay, Stripe also collects some information for itself: details of the phone or browser you pay on, such as its model, system version, language, screen size and time zone, an identifier Stripe gives it, and how you use its payment form. Stripe uses them to run the payment, to prevent fraud and to improve its own service, and answers for that part itself, under its own privacy policy at stripe.com/privacy. Stripe states that what its software in our app collects is never used to track you or for advertising. We never see or store your card number. Every household order is paid this way; we do not take cash, at the door or at the counter. A trade account is invoiced for each delivery and pays by bank transfer, so Stripe is not involved at all.
We do not sell your data and we do not share it with anyone for them to market to you. We will hand it over if the law compels us to.
Your rights
You can ask us to show you what we hold, correct it, delete it, give you a copy, or stop using it in a particular way. Email info@shahzadhalalbutchers.co.uk and we will reply within one month. You can delete your own account at any time from your account page on the website, or under Account in the app. Where we rely on your consent, such as for notifications, you can withdraw it at any time; that does not affect what we did before.
Your right to object
Where the table above says we use your information because of our legitimate interests, you can object at any time. Email info@shahzadhalalbutchers.co.uk and tell us why. We will stop, unless we have a strong reason to carry on that outweighs yours, or we need the information to make or answer a legal claim.
Complaints
If you think we have got something wrong with your information, tell us first: email info@shahzadhalalbutchers.co.uk, write to us at 593F Atlas Road, Wembley, London, HA9 0JH, or tell us at the counter and we will write it down for you. We will confirm we have your complaint within 30 days, look into it, and tell you what we found and what we have done about it. You can also complain to the Information Commissioner's Office at ico.org.uk at any time.
Children
Accounts are for people aged 18 or over. We do not knowingly collect data about children, and nothing on this site or in our app is aimed at them.
Cookies
We set one cookie, which keeps you signed in. It is strictly necessary and we do not need your consent for it. See the cookie policy.
Changes
If we change this policy in a way that matters, we will email account holders before it takes effect and show the date at the top of this page.