Privacy Policy

Who we are

Tim Kerr, a sole trader trading as Hungry Expats, is the controller responsible for your personal information. Hungry Expats is a family-run business based in Northern Ireland. Contact us about privacy or your order using these details:

Information you provide

• Customer and recipient names, email addresses, telephone numbers, billing addresses and delivery addresses entered at checkout.
• Products, quantities, agreed prices, delivery selections, order numbers, payment references, refunds and dispatch/tracking information associated with your order.
• Your contact details, destination and requested items when a custom delivery quote is prepared, plus the quote acceptance and order association.
• Information you include in emails to us. Please do not send payment passwords or card details.

If an order is a gift, recipient information comes from the buyer. Please make the recipient aware of this policy. Required checkout contact and address fields are needed to process payment, communicate about the order and arrange delivery.

How we use information

We use customer information to prepare quotes and fulfil orders, provide confirmations, arrange delivery, answer enquiries and manage refunds. Processing your purchase or requested quote is necessary for our contract with you or steps you ask us to take before a contract.

We retain information needed for accounting and applicable legal obligations. Protecting the website, investigating suspected misuse and maintaining operational records serves our legitimate interests in a secure, reliable business. Recipient delivery data and staff authentication data are used on that basis where the individual is not the contracting customer.

We do not currently run a marketing mailing list or use website behaviour for advertising profiling. Delivery prices are calculated automatically from your order and destination; this is not a credit or eligibility assessment.

Payments and transactional email

PayPal processes payments under its own privacy terms. Hungry Expats records payment amounts, currency, status and transaction references needed to verify and reconcile the purchase, not your full card details or PayPal password. See PayPal's privacy statement.

Resend delivers order confirmations, dispatch messages, refund messages and internal new-order notifications. These contain the information needed for the message, such as order details and relevant customer or recipient contact details. Delivery attempts and provider message references are recorded so failed messages can be retried safely.

Hosting, delivery and security

Firebase App Hosting and Google Cloud run the website. Firestore holds orders, quotes and operational records; Firebase Storage serves product images; Firebase Auth authenticates administrators. Google Cloud Logging records request and operational/security information, which can include IP addresses, request metadata and timing. Secret Manager protects server credentials rather than serving as a customer database.

Authorised staff access information for their duties. Delivery information is shared with the selected carrier, including DHL, to fulfil the delivery. Information may also be provided where required by law or needed to resolve a legal claim.

We use HTTPS, restricted administrative access and protected access links for receipts and quotes. Browser security/recovery identifiers and server-side access records help prevent unauthorised access and duplicate processing. No system can guarantee absolute security; keep access links private, especially on shared devices.

How long we keep information

Order and accounting records are retained for applicable tax and legal requirements. For our sole-trader tax records, HMRC normally requires at least five years after the 31 January filing deadline for the relevant tax year. Records may need to be kept longer for a late return, enquiry or unresolved legal matter. This is a legal retention requirement, not an automatic website deletion timer.

Enquiries, recipient details, private quotes, payment-recovery records and notification/audit records are kept only as long as needed for their purpose, including fulfilment, support, refunds, disputes, fraud prevention and legal obligations. We review whether information is still needed when dealing with retention or rights requests. We do not claim that an automatic deletion schedule already removes all these categories.

Logs and backup copies follow the applicable configured service retention and restore lifecycle. Browser storage durations are described in our Cookie Policy. Expiry of an access link does not delete the underlying order; deleting browser data does not delete accounting records. Ask us about retention for your information.

International processing and safeguards

Our current Firestore database is hosted in London and staging App Hosting is in the Netherlands. Those regional choices do not mean all provider processing stays in the UK or Europe: authentication, support, email, payments and provider subprocessors can involve other countries.

Google's Firebase processing terms and applicable Google Cloud processing terms describe its location commitments and international-transfer safeguards, including recognised transfer frameworks and contractual clauses where applicable. Firebase's subprocessor information identifies additional processing locations.

Resend stores email data in the United States. Its Data Processing Addendum incorporates standard contractual clauses and the UK Addendum for relevant UK transfers; a sending-region choice does not move its stored email data to Europe.

PayPal is an independent payment provider and describes processing in the United States and other countries in its privacy statement. Its stated safeguards include contractual arrangements; its binding corporate rules refer to specified intra-group EU transfers, not a blanket guarantee for every UK transfer.

Contact sales@hungryexpats.com to ask about the safeguards applicable to your information or request a copy. We do not promise exclusive UK processing or claim a separately negotiated transfer agreement that has not been verified.

Your rights and complaints

You can ask to access or correct your personal information, and where applicable request deletion, restriction or a portable copy. These rights depend on the processing and legal obligations; we may need to retain certain transaction records or verify your identity.

You can object to processing based on legitimate interests. Email sales@hungryexpats.com to exercise your rights or raise a concern. Where processing relies on consent, you can withdraw that consent without affecting earlier lawful processing.

You may complain to the Information Commissioner's Office. We would appreciate the opportunity to address your concern, but you do not have to contact us first to complain to the ICO.

Cookies and updates

Our Cookie Policy explains basket, checkout, payment, security and administrator storage. We will update these policies when our practices change; the review date will be shown on this page.