Privacy Policy

Alfu Limited (“Alfu International”, “we”, “us”, “our”) is the data controller responsible for your personal data. We are registered in England and Wales under company number 11778211.

Our contact address is 707a Fishponds Road, Fishponds, Bristol. For privacy queries, please email us at info@alfu.co.uk.

This policy is governed by the UK General Data Protection Regulation (UK GDPR) and the Data Protection Act 2018.

When you use our website or place an order, we may collect the following personal data:

• Identity data: Full name
• Contact data: Email address, phone number
• Address data: Delivery address, postcode
• Order data: Products ordered, order value, order history, delivery preferences
• Payment data: We do not store full card numbers. Payment details are processed and held by Stripe. We retain only confirmation of payment (e.g. payment intent ID and transaction status).
• Account data: Email address and hashed password (if you create an account)
• Technical data: Session cookies, browser type, IP address (collected automatically during normal web server operation)

We use your personal data for the following purposes:

• Processing and fulfilling your orders, including coordinating delivery or collection
• Sending order confirmation and status update emails
• Responding to customer support enquiries and resolving disputes
• Managing your customer account (if you create one)
• Complying with legal obligations, including tax and accounting records
• Detecting and preventing fraud or unauthorised access

We will not use your data for automated decision-making or profiling that produces legal or similarly significant effects.

We do not send marketing emails or newsletters without your explicit consent. If we ever introduce marketing communications, you will be able to opt out at any time.

We process your personal data on the following lawful bases:

• Contract: Processing is necessary to fulfil orders and deliver products you have purchased.
• Legal obligation: Retaining financial records to comply with HMRC requirements.
• Legitimate interests: Operating and improving our website, preventing fraud, and protecting our business.

We do not sell your personal data to any third party.

We share your data only with the third-party service providers listed below, and only to the extent necessary to operate our service:

• Stripe — payment processing. Your card details are collected and stored directly by Stripe and never pass through our servers. See Stripe's Privacy Policy.
• Resend — transactional email delivery (order confirmations). See Resend's Privacy Policy.
• Supabase — cloud database hosting. Your order data, account data, and delivery addresses are stored in our Supabase database. See Supabase's Privacy Policy.

All third-party processors are bound by data processing agreements and are required to protect your data in accordance with UK GDPR.

• Order records: We retain order data for 7 years from the date of the order, as required by HMRC for tax and accounting purposes.
• Customer accounts: Account data is retained until you request deletion of your account.
• Guest orders: Personal data associated with guest orders is retained for 7 years for legal compliance purposes.
• Session data: Session cookies expire at the end of your browser session or after 30 days, whichever comes first.

Under UK GDPR, you have the following rights regarding your personal data:

• Right of access: You can request a copy of the personal data we hold about you.
• Right to rectification: You can ask us to correct inaccurate or incomplete data.
• Right to erasure: You can request deletion of your personal data, subject to our legal retention obligations.
• Right to portability: You can request your data in a structured, machine-readable format.
• Right to restrict processing: You can ask us to limit how we use your data in certain circumstances.
• Right to object: You can object to processing based on legitimate interests.

To exercise any of these rights, please email us at info@alfu.co.uk. We will respond within one calendar month.

If you are not satisfied with our response, you have the right to lodge a complaint with the Information Commissioner's Office (ICO).

We use only essential cookies. We do not use tracking, advertising, or analytics cookies.

• Session cookie: Used to keep you logged in during your visit. Set by NextAuth and expires at the end of your session or after 30 days.
• Basket storage: Your basket is stored in your browser's localStorage, not a cookie. It is cleared at midnight each day.
• Cookie consent: We store your consent to our cookie notice in localStorage so we do not show the banner again.

Because we use only essential cookies, no consent is legally required. However, we display a cookie notice as a transparency measure.

We take reasonable technical and organisational measures to protect your personal data against unauthorised access, loss, or disclosure. These include:

• HTTPS encryption for all data in transit
• Passwords stored as one-way bcrypt hashes (never in plain text)
• Database access restricted to authenticated application services only

No method of internet transmission or electronic storage is 100% secure. While we strive to protect your data, we cannot guarantee absolute security.

We may update this privacy policy from time to time. When we do, we will update the date at the top of this page. Significant changes will be notified by email where we hold a valid email address for you.

Continued use of our service after a policy change constitutes acceptance of the updated policy.