Privacy policy

1. Who we are

2FUL Ltd is the controller of personal information collected through Spiceful. We are a company registered in England and Wales under company number 16256899, with registered office at 3 Parfrey Street, First Floor, London, England, W6 9EW. Until a dedicated privacy email is activated, privacy questions and complaints can be started through our Contact page.

2. Information we collect

Depending on how you use Spiceful, we may collect: your name and contact details; billing and delivery addresses; order, product and delivery information; payment status and transaction references (but not full card details); messages and customer-service records; community-submission content and permissions; account or preference information; device, security and diagnostic data; and records of privacy choices or consent.

3. Why we use it and our lawful bases

We use order and delivery information to take steps at your request and perform our sales contract. We use records required for tax, accounting, food safety, product traceability and regulatory duties to comply with legal obligations. We may use limited contact, fraud-prevention, service-improvement and security information for our legitimate interests, after considering your rights. We use consent where the law requires it, including certain marketing, community publication and non-essential tracking activities.

4. Contact-form privacy notice

If you contact us, we use your name, email address, enquiry category, message and related correspondence to answer you, manage customer service and keep an appropriate record. The lawful basis is steps connected with a contract where your message concerns an order or possible purchase, and our legitimate interests in responding to other genuine business enquiries. You do not have to provide this information, but without the required contact details and message we cannot reply.

The contact form in this mock-up is currently disabled and transmits no data. Before activation, the developer must connect a protected endpoint, identify the email and hosting processors, apply spam controls, and ensure this notice appears when the data is collected.

5. Orders and payments

When checkout is activated, we will use the information needed to accept payment, fulfil and deliver orders, provide confirmations, manage refunds or disputes and meet our accounting and product-traceability duties. Payment-card details should be entered directly into the selected payment provider’s secure service; Spiceful should receive only payment status and limited transaction references.

6. Who receives information

We may share only what is necessary with service providers supporting hosting, secure payments, order fulfilment, delivery, email, customer support, professional advice, fraud prevention and legal compliance. We may also disclose information where required by law, regulators, courts or to protect legal rights. Final providers must be documented here before their services are activated.

7. International transfers

Some future service providers may process information outside the UK. Before any such transfer, 2FUL Ltd must use a lawful UK transfer mechanism, such as UK adequacy regulations, the UK International Data Transfer Agreement or the UK Addendum, and complete any required transfer risk assessment. Details and copies of relevant safeguards will be available on request.

8. Retention

We keep information only as long as needed. Enquiries that do not lead to an order will normally be retained for up to 24 months after the last contact. Order, payment, tax and accounting records will normally be retained for six years after the end of the relevant financial year or longer where lawfully required. Product safety, recall and traceability records may be kept for the period required by food law and our documented safety procedures. Marketing records are kept until consent is withdrawn or the information is no longer required; suppression records may be retained to respect an opt-out. Security logs are retained for a limited period proportionate to the risk. These periods must be confirmed against the final operational systems.

9. Your rights

Subject to applicable conditions, you may request access, correction, erasure, restriction, objection or portability of your personal information. Where we rely on consent, you may withdraw it at any time without affecting earlier lawful use. You have an absolute right to object to direct marketing. We do not intend to make decisions producing legal or similarly significant effects solely by automated means.

10. Complaints

You may raise a data-protection complaint through our Contact page. We will acknowledge a complaint within 30 days and respond without undue delay. You may also complain to the Information Commissioner’s Office at ico.org.uk/make-a-complaint, telephone 0303 123 1113, or write to the ICO, Wycliffe House, Water Lane, Wilmslow, Cheshire SK9 5AF.

11. Security and changes

We use proportionate organisational and technical safeguards and require processors to protect personal information. No internet service is completely risk-free. We will update this notice when our products, providers or legal obligations change and publish the revised date at the top.