Privacy policy

Last updated: 23 March 2026

This Privacy Policy describes how Thrift Taco ("we", "us", or "our") collects, uses and discloses your personal information when you visit, use our services, make a purchase from thrifttaco.com (the "Site"), attend our events, request catering, or otherwise interact with us (collectively, the "Services").

For the purposes of this Privacy Policy, "you" means any user of the Services, including customers, website visitors, event attendees, or individuals who contact us.

Please read this Privacy Policy carefully.

CHANGES TO THIS PRIVACY POLICY

We may update this Privacy Policy from time to time to reflect changes in our practices, technology, legal requirements or business operations. When we do so, we will update the "Last updated" date above and take any other steps required by applicable law.

HOW WE COLLECT YOUR PERSONAL INFORMATION

We collect personal information in several ways depending on how you interact with us.

We may collect information:

• directly from you
• automatically through your use of the Site
• from third-party service providers
• through event bookings, catering enquiries, or customer communications

We use this information to operate, improve and protect our Services.

PERSONAL INFORMATION WE COLLECT

Information you provide directly

This may include:

• Name
• Billing and shipping address
• Email address
• Phone number
• Payment confirmation details
• Account login details (if applicable)
• Customer service communications
• Event or catering enquiry information
• Dietary or allergy information (where voluntarily provided)

Dietary and allergy information may be treated as health-related data and is processed only where necessary to provide requested services.

Information collected automatically

We may collect information about your device and how you interact with the Site, including:

• IP address
• browser type
• device type
• pages viewed
• referral source
• usage patterns

This information is collected using cookies, pixels and similar technologies.

Information from third parties

We may receive information from:

• Shopify (website platform)
• payment processors
• analytics providers
• advertising partners (such as Meta or TikTok)
• delivery or fulfilment providers

These parties process data on our behalf or as independent controllers.

HOW WE USE YOUR PERSONAL INFORMATION

We process personal information under the following legal bases under UK GDPR:

• Performance of a contract
• Legitimate interests
• Legal obligations
• Consent (where required)

We use your information to:

• Process orders and payments
• Deliver products and services
• Provide customer support
• Manage events and catering services
• Improve our website and offerings
• Prevent fraud or misuse
• Comply with legal requirements
• Send marketing communications (where you have opted in)

MARKETING COMMUNICATIONS

We will send marketing communications only where:

• you have consented; or
• we are legally permitted to do so under applicable law

You may unsubscribe at any time using the link in our emails or by contacting us.

Transactional communications (such as order confirmations) may still be sent.

COOKIES AND TRACKING TECHNOLOGIES

We use cookies and similar technologies to:

• operate the Site
• analyse performance
• remember preferences
• deliver relevant advertising

Cookies may include:

• strictly necessary cookies
• analytics cookies
• marketing cookies

You can control cookies through your browser settings. Blocking cookies may affect Site functionality.

Advertising partners may use tracking technologies to show relevant ads across other platforms.

HOW WE DISCLOSE PERSONAL INFORMATION

We may share information with:

• service providers (payment, IT, hosting, analytics, fulfilment)
• advertising and marketing partners
• professional advisers
• authorities where legally required
• business partners involved in events or collaborations

We do not sell personal data.

THIRD-PARTY LINKS

Our Site may contain links to third-party websites. We are not responsible for their privacy practices.

CHILDREN’S DATA

Our Services are not intended for children under 13.
We do not knowingly collect personal information from children.

If you believe a child has provided information to us, please contact us.

SECURITY AND DATA RETENTION

We implement reasonable security measures to protect personal data.

We retain personal information only as long as necessary to:

• fulfil orders
• provide services
• comply with legal obligations
• resolve disputes

Typical retention periods:

• Order records: up to 6 years (legal requirement)
• Marketing data: until consent withdrawn
• Enquiry data: typically up to 24 months
• Event or dietary data: deleted after event unless legally required

YOUR RIGHTS

Under UK GDPR, you may have the right to:

• access your personal data
• request correction
• request deletion
• restrict processing
• object to processing
• request portability
• withdraw consent

You also have the right to lodge a complaint with the UK Information Commissioner’s Office (ICO): https://ico.org.uk/

INTERNATIONAL DATA TRANSFERS

Your personal data may be processed outside the UK.

Where this occurs, we rely on:

• UK adequacy regulations
• Standard Contractual Clauses
• UK International Data Transfer Agreement (IDTA)

CONTACT

If you have questions or wish to exercise your rights, contact:

Thrift Taco
Honestly Bad Ltd
Company number 15861012
124 City Road
London EC1V 2NX

Email: care@thrifttaco.com