AriyoPlusAfrican & Naija Food Store

Privacy Policy

Last updated: 8 October 2026

This policy explains what personal data we collect when you use our website or order from us, why we need it, who we share it with, how long we keep it, and your rights under the UK General Data Protection Regulation (UK GDPR) and the Data Protection Act 2018.

1. Who we are

AriyoPlus Limited (company number 14807248), 7 St. Lukes Terrace, Sunderland, SR4 6NQ, is the “controller” responsible for your personal data. For any privacy question or request, email ariyopluslimited@gmail.com or call 07424 796437.

2. What we collect

  • Account details — name, email address, phone number (optional) and your password, which we store only in scrambled (hashed) form that we can't read.
  • Order details — the items you buy, your contact name and phone number, email address, delivery address or collection choice, any note you add, and your order history.
  • Saved addresses — if you choose to save them in your account.
  • Reviews — the rating and text you write, shown publicly with the name on your account.
  • Payment — if you pay by card, Stripe collects your card details directly. We only receive confirmation that you've paid; we never see or store your full card number.
  • Messages — anything you send us by email, phone or WhatsApp.
  • Technical data — your IP address and basic request details, used to keep the site secure and to stop abuse such as repeated failed log-ins.

We collect this directly from you. We don't buy data about you, and we don't use advertising or analytics tracking.

3. How we use it, and our legal basis

PurposeLegal basis
Taking, preparing, delivering and taking payment for your orders, and sending order confirmations and updatesPerforming our contract with you
Running your account, including password resetsPerforming our contract with you
Answering your questions and complaintsOur legitimate interest in giving good customer service
Publishing reviews you choose to writeOur legitimate interest in helping customers choose products
Keeping the site secure, preventing fraud and limiting abuseOur legitimate interest in protecting our business and customers
Keeping sales and accounting recordsLegal obligation (tax and company law)

We don't send marketing emails. If we ever want to, we'll ask for your consent first. We don't make decisions about you using purely automated means.

You don't have to give us your details, but we can't process an order without your contact details, or a delivery without your address.

4. Who we share it with

We never sell your data. We share it only with the services that help us run the shop:

  • Stripe — card payment processing (Stripe privacy policy).
  • Vercel — hosts this website.
  • Prisma — hosts our customer and order database.
  • Resend — sends our order and password-reset emails.
  • WhatsApp (Meta) — only if you choose to contact us or send your order by WhatsApp.
  • Our accountants and professional advisers, and the police, HMRC or other authorities where the law requires it.

Some of these providers store or process data outside the UK, including in the United States and the European Economic Area. Where they do, your data is protected by UK adequacy regulations (including the UK–US “data bridge”) or by the ICO-approved International Data Transfer Agreement or Addendum.

5. How long we keep it

  • Order and payment records — 6 years from the end of the financial year the order was placed in, as UK tax and company law require.
  • Your account and saved addresses — until you ask us to delete your account. Order records are then kept only for the period above.
  • Reviews — until you delete them or your account is deleted.
  • Password-reset links — they expire after 1 hour.
  • Security and rate-limit records — usually less than a day.
  • Your basket — stored only in your own browser, never on our servers until you check out.

6. How we protect it

All connections to the site are encrypted (HTTPS). Passwords and reset links are stored only as one-way hashes, access to customer data is limited to staff who need it, and the site is protected against common attacks and automated abuse.

7. Your rights

You have the right to:

  • get a copy of the personal data we hold about you;
  • have inaccurate data corrected;
  • have your data deleted, where we don't need to keep it by law;
  • restrict or object to how we use your data;
  • receive your data in a portable format; and
  • withdraw any consent you've given, at any time.

To use any of these rights, contact us at ariyopluslimited@gmail.com. It's free, and we'll respond within one month. You can update your name, phone number, addresses and password yourself in your account.

8. Complaints

If you're unhappy with how we've handled your data, please tell us first and we'll look into it promptly. You also have the right to complain to the Information Commissioner's Office (ICO) at ico.org.uk/make-a-complaint or on 0303 123 1113.

9. Cookies

We only use cookies that are strictly necessary for the site to work, such as keeping you signed in. See our cookie policy for the full list.

10. Children

Our shop is intended for adults. We don't knowingly collect personal data from children.

11. Changes to this policy

We'll update this page if the way we use personal data changes. The date at the top shows when it was last changed.