9jafoods Ltd is the data controller responsible for your personal data. We are registered in England and Wales. Our registered address and contact details are:

If you have any questions about how we handle your data, you can contact our Data Protection contact at the address above.

We collect and process the following categories of personal data:

We do not collect any Special Category data (e.g. health, religious beliefs, biometric data) unless you voluntarily disclose it in free-text fields such as dietary preferences. Where you do so, you give explicit consent to our processing it for the purpose of personalising your experience.

• Directly from you — when you register, place an order, submit a review, contact support, or fill in any form on the Platform.
• Automated technologies — cookies, web beacons, server logs, and analytics tools collect Technical and Usage Data as you browse.
• Third parties — Google (authentication and Search Console), Stripe (payment processing), and delivery couriers may share information with us to fulfil your order or verify your account.

Under the UK GDPR and the Data Protection Act 2018, we process your personal data on the following legal bases:

• Contract performance — to fulfil orders, process payments, manage subscriptions, and provide vendor/driver services.
• Legitimate interests — to improve the Platform, prevent fraud, personalise content, send service-related communications, and maintain security. We have balanced these interests against your rights.
• Legal obligation — to comply with applicable laws (e.g. tax, anti-money-laundering, consumer rights).
• Consent — for marketing emails and SMS, and for processing any Special Category data you voluntarily provide. You may withdraw consent at any time.

• Create and manage your account and profile.
• Process and fulfil orders, subscriptions, and refund requests.
• Process payments securely through Stripe.
• Send order confirmations, delivery updates, and support responses.
• Enable vendor onboarding, payouts, and performance analytics.
• Facilitate driver onboarding, route assignment, and location tracking (with your consent, only while actively delivering).
• Personalise product recommendations, meal plans, and deal suggestions using AI tools.
• Send marketing emails and promotions (only with your consent; you can unsubscribe at any time).
• Detect fraud, abuse, and security threats.
• Monitor and improve website performance via Google Search Console and analytics.
• Comply with our legal and regulatory obligations.

Our Android app requests access to your device's camera (android.permission.CAMERA). This permission is used solely for the following purposes:

• Proof of delivery photos — delivery drivers may use the camera to photograph delivered parcels as confirmation of delivery.
• Product review images — customers may use the camera to take and upload photos when submitting a product review.
• Vendor document uploads — vendors may use the camera to photograph and upload required business verification documents during onboarding.
• Product and store images — vendors may use the camera to photograph and upload product or store images.

Camera access is requested only when you actively use a feature that requires it. We do not access your camera in the background, and no images are captured or transmitted without your explicit action. Photos you upload are stored securely and used only for the stated purpose.

You can revoke camera permission at any time via your device's Settings → Apps → 9jafoods → Permissions. Revoking this permission will disable camera-dependent features but will not affect other app functionality.

We use cookies and similar technologies to distinguish you from other users and to improve your browsing experience. The cookies we use include:

• Strictly necessary cookies — required for the Platform to function (e.g. session management, shopping cart).
• Analytical/performance cookies — allow us to recognise and count visitors and see how visitors move around (e.g. Google Analytics).
• Functionality cookies — used to remember your preferences (e.g. language, currency).
• Targeting cookies — may be set to build a profile of your interests and show you relevant adverts on other sites.

You can manage or disable cookies through your browser settings. Disabling strictly necessary cookies may affect Platform functionality.

We share personal data only where necessary:

• Vendors — we share your name, order details, and delivery address with the vendor fulfilling your order.
• Delivery drivers — name, delivery address, and contact number to complete your delivery.
• Stripe — payment data is processed by Stripe Inc. under their own privacy policy and PCI-DSS compliance framework.
• Google — for authentication (Google Sign-In) and Search Console analytics.
• Email service provider — to send transactional and marketing emails on our behalf.
• Law enforcement / regulators — where required by applicable law or court order.

We do not sell your personal data to third parties for their own marketing purposes.

Some of our third-party service providers are based outside the UK. Where we transfer personal data internationally, we ensure appropriate safeguards are in place, such as standard contractual clauses approved by the UK Information Commissioner's Office (ICO), or we rely on an adequacy decision. You may contact us to obtain a copy of the relevant safeguards.

We retain your personal data only for as long as necessary for the purposes set out in this policy:

• Account data — held for the duration of your account plus 3 years after closure (for legal/audit purposes).
• Transaction and financial records — 7 years to comply with HMRC requirements.
• Marketing consent records — until you withdraw consent plus 3 years.
• Support ticket data — 2 years after resolution.
• Driver location data — 30 days after each delivery session.

Once the retention period expires, data is securely deleted or anonymised.

You have the following rights regarding your personal data:

• Right of access — request a copy of the personal data we hold about you (Subject Access Request).
• Right to rectification — ask us to correct inaccurate or incomplete data.
• Right to erasure ("right to be forgotten") — request deletion of your data where there is no lawful reason for continued processing.
• Right to restrict processing — ask us to suspend processing in certain circumstances.
• Right to data portability — receive your data in a structured, commonly used, machine-readable format.
• Right to object — object to processing based on legitimate interests or for direct marketing purposes.
• Rights related to automated decision-making — not to be subject to solely automated decisions that significantly affect you.
• Right to withdraw consent — at any time, where processing is based on consent.

To exercise any of these rights, please email info@9jafoods.co.uk. We will respond within 30 days. There is no fee for making a request unless it is manifestly unfounded or excessive.

We implement appropriate technical and organisational measures to protect your personal data against unauthorised access, loss, alteration, or disclosure. These measures include:

• SSL/TLS encryption for all data in transit.
• Payment data tokenised and handled exclusively by Stripe (PCI-DSS Level 1 compliant).
• Role-based access controls — only authorised personnel can access personal data.
• Regular security reviews of our systems and code.

In the event of a personal data breach that is likely to result in a high risk to your rights and freedoms, we will notify you and the ICO without undue delay, in accordance with our legal obligations.

The Platform is not directed at children under the age of 13. We do not knowingly collect personal data from children under 13. If you believe we have inadvertently collected data from a child, please contact us immediately at info@9jafoods.co.uk and we will delete it promptly.

Our Platform may contain links to third-party websites (e.g. vendor storefronts, social media). We are not responsible for the privacy practices of those sites and encourage you to read their privacy policies. This Privacy Policy applies solely to information collected by 9jafoods.

We may update this Privacy Policy from time to time to reflect changes in our practices or applicable law. We will notify you of material changes by posting a notice on the Platform or by email. The "Last updated" date at the top of this page indicates when the policy was last revised. Your continued use of the Platform after any changes constitutes your acceptance of the updated policy.

If you are unhappy with how we have handled your personal data, please contact us first at info@9jafoods.co.uk so we can try to resolve the issue.

You also have the right to lodge a complaint with the Information Commissioner's Office (ICO), the UK supervisory authority for data protection: