Privacy Policy

Introduction

OCHO OCHO Asian Foods ("we", "us", "our") is committed to protecting and respecting your privacy. This Privacy Policy explains how we collect, use, store, and protect your personal data when you visit our website, use our mobile application, or place an order with us. We are a data controller within the meaning of the UK General Data Protection Regulation (UK GDPR) and the Data Protection Act 2018. This policy should be read alongside our Terms & Conditions.

Data Controller

OCHO OCHO Asian Foods is the data controller responsible for your personal data. We are responsible for ensuring your personal data is processed lawfully, fairly, and transparently.

Personal Data We Collect

We may collect and process the following categories of personal data:

• Identity data: name, title, date of birth (where relevant for age-restricted Products)
• Contact data: email address, phone number, delivery address, billing address
• Account data: username, password (encrypted), order history, saved addresses, preferences
• Payment data: payment is processed by our payment provider; we do not store full card numbers on our systems
• Technical data: IP address, browser type, device information, cookies, usage data
• Marketing data: newsletter subscription preferences, quiz and flavour profile responses, communication preferences
• Location data: approximate location for store and delivery service availability checks

How We Collect Your Data

We collect personal data that you provide directly to us when you register an account, place an order, subscribe to our newsletter, participate in a quiz or promotion, or contact our customer service team.

We also collect data automatically through cookies and similar technologies when you visit our website. See our Cookies section below for details.

We may receive data from third parties such as payment providers, delivery partners, and referral partners (the OCHO OCHO Partner Programme) where you have engaged with those services.

How We Use Your Data

We process your personal data for the following purposes:

• To process and fulfil your orders, including delivery and customer service
• To manage your account and provide personalised shopping experiences
• To process payments securely and prevent fraud
• To send you order confirmations, delivery updates, and service notifications
• To send marketing communications where you have given consent or have a legitimate interest
• To improve our Service, Products, and website through analytics and feedback
• To comply with legal, tax, and regulatory obligations
• To manage the Partner Programme, including commission tracking and payouts

Legal Basis for Processing

Under the UK GDPR we rely on the following legal bases to process your personal data:

• Performance of a contract — processing necessary to fulfil your order and provide our Service
• Consent — where you have opted into marketing, newsletters, quizzes, or non-essential cookies
• Legal obligation — where we are required to retain data for tax, accounting, or regulatory purposes
• Legitimate interests — for fraud prevention, service improvement, and business analytics that do not override your rights
• Vital interests — where processing is necessary to protect your health and safety

Sharing Your Data

We do not sell your personal data. We may share it with the following categories of recipients where necessary:

• Payment providers to process your transactions securely
• Delivery and courier partners to fulfil Local Delivery and Nationwide Post orders
• Cloud hosting and software providers who support our Service infrastructure
• Accounting and tax advisors for financial compliance
• Regulatory or law enforcement bodies where required by law

All third parties are required to keep your data confidential and use it only for the purpose for which it was shared.

International Data Transfers

Your personal data is primarily stored and processed within the United Kingdom and European Economic Area. Where any data is transferred outside these areas, we ensure appropriate safeguards such as Standard Contractual Clauses are in place to protect your data in accordance with UK GDPR requirements.

Cookies

We use cookies and similar technologies to operate our website, remember your preferences, analyse traffic, and improve your experience. Cookies are small files stored on your device.

Types of cookies we use:

• Essential cookies — required for the website to function (e.g. shopping cart, authentication)
• Analytics cookies — help us understand how visitors use our website
• Marketing cookies — used to deliver relevant advertising and track campaign effectiveness
• Preference cookies — remember your settings and personalise your experience

You can manage or disable cookies through your browser settings. Disabling essential cookies may affect website functionality.

Data Retention

We retain your personal data only for as long as necessary to fulfil the purposes for which it was collected, including legal, accounting, or reporting requirements. Order and financial records are retained for up to seven years for tax and accounting compliance. Marketing data is retained until you withdraw consent or request deletion. Account data is retained while your account is active and for a reasonable period after deletion.

Your Rights Under UK GDPR

You have the following rights regarding your personal data:

• Right of access — request a copy of the personal data we hold about you
• Right to rectification — correct inaccurate or incomplete data
• Right to erasure — request deletion of your personal data (subject to legal exceptions)
• Right to restrict processing — limit how we use your data in certain circumstances
• Right to data portability — receive your data in a structured, machine-readable format
• Right to object — object to processing based on legitimate interests or for direct marketing
• Right to withdraw consent — withdraw consent for marketing or non-essential processing at any time
• Rights in relation to automated decision-making and profiling

To exercise any of these rights, contact us using the details at the bottom of this page.

Marketing Communications

We will only send you marketing communications if you have consented or have an existing customer relationship and have not opted out. You can unsubscribe at any time by clicking the unsubscribe link in any marketing email, updating your account preferences, or contacting us directly.

Data Security

We take appropriate technical and organisational measures to protect your personal data against unauthorised access, alteration, disclosure, or destruction. These include encryption, secure servers, access controls, and regular security reviews. However, no method of transmission over the internet is completely secure and we cannot guarantee absolute security.

Children’s Privacy

Our Service is not directed at children under 18. We do not knowingly collect personal data from anyone under 18. If you believe we have collected data from a minor, please contact us and we will delete it promptly.

Changes to This Policy

We may update this Privacy Policy from time to time. Any changes will be posted on this page with an updated revision date. We encourage you to review this page periodically.

Contact Us

If you have any questions about this Privacy Policy or wish to exercise your data protection rights, please contact us through our stores in Cheltenham or Cinderford or via the Contact Us section of our website. We aim to respond to all data protection requests within 30 days.