Privacy Policy

How we use and protect personal information

Effective date: 11 August 2026

Last updated: 13 August 2026

1. Who we are

Barrels & Basket Limited is the controller of personal information described in this Privacy Policy when you visit our website, contact us, place an order, create an account, join our mailing list or otherwise interact with us.

Barrels & Basket Limited
Company No. 17249800 | Registered in England and Wales
Registered Office: 9 Lansdowne Road, Wolverhampton, England, WV1 4AL
Email: info@barrelsandbasket.co.uk
Phone/WhatsApp: +44 7359 136074

2. Personal information we collect

When you contact us or place an order, we may collect identity and contact information such as your name, email address, telephone number and delivery or billing address. We also keep information connected with your purchases, including products ordered, order history, delivery or collection details, refunds and customer-service records. Payment-related information may include transaction and payment confirmation details, although full card details are normally handled by the payment provider rather than stored by us.

If you create an account, we may hold your login details and preferences. We may also hold your marketing preferences and information about how you joined or interacted with our marketing. When you use the website, technical and usage information such as your IP address, browser or device information, cookie identifiers, pages viewed and checkout interactions may be generated. We also retain communications sent to us by email, contact form, telephone, WhatsApp or social media. If you voluntarily provide allergy or health-related dietary information for a prepared-food order, we may process that information as special category personal data.

3. How and why we use personal information

Purpose: Process orders, take payment, deliver/arrange collection and send order updates
Lawful basis: Performance of a contract

Purpose: Provide customer service, manage returns and resolve order complaints
Lawful basis: Contract and/or legitimate interests in operating our customer service

Purpose: Prevent fraud, secure our website and protect our business/customers
Lawful basis: Legitimate interests and, where applicable, legal obligations

Purpose: Keep accounting, tax and business records
Lawful basis: Legal obligation

Purpose: Send marketing emails/messages
Lawful basis: Consent or another lawful basis permitted by electronic-marketing law; you can opt out at any time

Purpose: Use optional analytics/advertising technologies
Lawful basis: Consent where required; where a statutory cookie exemption applies, we follow the applicable conditions

Purpose: Handle allergy/health-related dietary information supplied for an order
Lawful basis: Normally your explicit consent for the relevant safe-order handling purpose, alongside the lawful basis for the order itself

Purpose: Establish, exercise or defend legal claims
Lawful basis: Legitimate interests and/or legal obligation, as applicable

4. Allergy and dietary information

If you voluntarily tell us about an allergy, intolerance or health-related dietary requirement, we will use that information only as necessary to deal with the relevant order, customer-service issue or food-safety matter. Because this information may reveal health information, we treat it with additional care. Where we rely on explicit consent, you may withdraw that consent; however, if the information is necessary to assess or safely fulfil a prepared-food request, withdrawal may mean we cannot fulfil that request.

5. Where we obtain information

We collect information directly from you, from your use of our website and, where necessary, from service providers involved in your transaction (for example, ecommerce, payment, fraud-prevention and delivery providers).

6. Service providers and sharing

We share personal information only where it is necessary and appropriate. This may include Shopify and other ecommerce or website service providers; payment providers offered at checkout, which may include Stripe, Shopify Payments or other providers displayed at the time of payment; couriers, delivery partners and collection providers; and email, customer-service, analytics or marketing providers where we use those services. We may also share information with professional advisers such as accountants, insurers or legal advisers, and with regulators, courts, law-enforcement bodies or public authorities where disclosure is required or permitted by law.

We do not sell personal information.

7. International transfers

Some service providers may process personal information outside the United Kingdom. Where UK data protection law requires safeguards for an international transfer, we rely on an applicable adequacy regulation or appropriate contractual/other safeguards permitted by law.

8. How long we keep information

Order, transaction, tax and accounting records are normally kept for up to six years after the end of the relevant financial year, or longer where the law, a tax enquiry or a legal claim requires it. Customer-service and complaint records are kept for as long as necessary to resolve the matter and then for an appropriate period for legal, quality and record-keeping purposes.

Marketing records are kept until you opt out or we no longer need them, although we may retain a minimal suppression record so that we can respect your opt-out. Allergy or dietary information is kept only for as long as reasonably necessary for the relevant order, safety investigation, complaint or legal record, subject to any applicable retention requirement. Cookie and technical data are kept according to the lifetime of the relevant technology and our cookie settings, as explained in the Cookie Policy.

9. Your data protection rights

Depending on the circumstances and the lawful basis on which we use your information, you may have the right to access your personal information, have inaccurate information corrected, request erasure in appropriate circumstances, request restriction of processing, object to processing based on legitimate interests, and object at any time to direct marketing. You may also have the right to receive certain information in a portable format and to withdraw consent where processing is based on consent, without affecting the lawfulness of processing carried out before withdrawal.

Rights are not absolute in every case. We may need to verify your identity and may retain information where law requires us to do so.

10. Data protection complaints

You can complain to us about how we have handled your personal information by emailing info@barrelsandbasket.co.uk and marking the message "Data Protection Complaint". We will provide a clear route for complaints, acknowledge a data protection complaint within 30 days of receipt, take appropriate steps to investigate it without undue delay, keep you informed as appropriate and communicate the outcome without undue delay.

You also have the right to complain to the UK Information Commissioner's Office (ICO). We encourage you to contact us first so that we have an opportunity to address the issue, but this does not affect your right to contact the ICO.

11. Security

We use reasonable technical and organisational measures designed to protect personal information against unauthorised access, loss, misuse, alteration or disclosure. No internet-based system is completely risk-free, so we also limit access to personal information to people and service providers who need it for legitimate purposes.

12. Marketing

You can unsubscribe from marketing at any time by using an unsubscribe option in the message or contacting us. Opting out of marketing does not stop essential service communications about an order or account.

13. Cookies

Please read our Cookie Policy for details of cookies and similar technologies and how to manage your choices.

14. Changes and contact

We may update this Privacy Policy when our services, providers or legal obligations change. The current version will be published on the website with its updated date.