Effective Date: 05 March 2026 | Version 1.1
This Privacy Policy explains how StoreNova Ltd ("we," "us," or "the Platform") handles your personal data. As the Merchant of Record (MoR), we manage payment processing and order administration. For data protection purposes, StoreNova acts as the Data Controller for your customer account information, order data, and operational data processed through the Platform. Stripe may act as an independent data controller for certain payment and identity verification processing.
By using the Platform, you agree to the practices described in this policy and our Terms of Use.
StoreNova is committed to protecting your personal data. We operate in strict accordance with the UK GDPR, the Data Protection Act 2018, Privacy and Electronic Communications Regulations (PECR) and all applicable data privacy regulations across the United Kingdom.
We collect only the information necessary to operate the Platform, fulfil your orders, and comply with UK law.
Identity & Contact: Name, email, phone number, and delivery address.
Transaction Data: Order details, items purchased, payment value, refunds issued, and order history.
Payment Data: Processed securely via Stripe Connect. StoreNova does not store or access full card numbers.
Technical & Usage Data: IP address, device information, browser type, error logs, and app usage analytics.
Location Data: With your permission, we collect GPS data to show you local vendors and provide real- time delivery tracking.
Communications & Support Data: Messages, attachments (including photos supplied for disputes), and customer support interactions.
We process your data under the lawful bases set out in UK GDPR:
Contractual Necessity: To process your order, including but not limited to creating your account, payment processing through Stripe Connect, sending order updates, providing delivery tracking.
Legal Obligation: Including but not limited to maintaining tax and transactional records (HMRC), food safety reporting obligations, responding to lawful requests from enforcement bodies.
Legitimate Interests: Including but not limited to fraud detection, platform security, preventing abuse of promotions, soft- opt- in marketing for similar StoreNova products.
Platform Analytics, Improvement & Debugging: To analyse performance, monitor errors, optimise the Platform, improve user experience, and develop new features.
Marketing (where permitted by law): To send you marketing communications about similar products or services under the PECR soft opt- in rule, and to send third- party marketing where you have given explicit consent.
Consent: For precise GPS tracking, third- party marketing and non- essential cookies. You may withdraw consent at any time.
We do not sell or rent your data. We share it only with:
The Vendor: Your name, order contents, and allergen notes are shared with Vendors to prepare your order.
Delivery Partners: Your address and phone number are shared with independent couriers. We reserve the right to change our delivery partners from time to time at our sole discretion.
Payment Processors: Stripe is a separate data controller for card and identity verification processing. We share transaction metadata required for settlements, refunds, and fraud checks.
Regulatory Bodies: Disclosure to regulatory bodies such as the FSA, HMRC, or law enforcement, when legally required.
Service Providers: Cloud hosting, data storage, analytics, and customer support tools. StoreNova may transfer limited personal data outside the UK where required by our service providers (e.g., AWS, Google, Stripe). All transfers occur under UK Addendum to the EU SCCs and UK International Data Transfer Agreement (IDTA).
We retain your data only for as long as is necessary to fulfill the purposes for which it was collected:
Account Data: Retained for the duration of your active relationship with StoreNova.
Financial & Tax Records: Retained for 6 years following the date of the transaction to comply with UK statutory tax requirements.
Delivery & GPS Logs: Sensitive location data is anonymised or deleted within 90 days of order completion to protect your movement history.
Marketing Data: Retained until you withdraw consent or for 12 months from your last interaction with the Platform.
Dispute Evidence: Retained until the dispute is fully resolved, and for a reasonable audit period thereafter to meet legal, operational, and fraud- prevention requirements.
StoreNova maintains a formal Data Retention Schedule available upon request.
We use automated systems to detect fraud, prevent abuse, and flag suspicious orders. If an automated decision significantly affects you (e.g., a blocked payment), you have the right to request a manual human review, contest the decision and or express your views. Please contact our support team to contest an automated decision.
9.1 Where you have previously purchased from StoreNova, we may send you marketing about similar products or services using the lawful "soft opt- in".
9.2 You may unsubscribe at any time by clicking "unsubscribe" in emails or adjusting your app settings. You have an absolute right to stop direct marketing.
9.3 We will only send third- party marketing with your explicit consent.
The Platform is not intended for individuals under 16 years of age. We do not knowingly collect personal data relating to children. If we become aware that a child under 16 has provided personal data, we will delete it and may close the account. Parents and guardians may contact us to request removal of such data.
Our Platform uses cookies to distinguish you from other users and analyse traffic patterns. In compliance with 2026 standards, non- essential cookies are disabled by default. You may select "Reject All" or "Accept All" via our consent banner. Essential cookies used for security and login purposes do not require consent but can be managed via your browser settings.
Under the UK GDPR, you have the following rights regarding your personal data:
Right to be Informed: You have the right to be told exactly how we collect and use your data, how long we keep it, and who we share it with. Providing this Privacy Policy is the primary way we fulfill this obligation to you. We provide this policy and "Just- in- Time" notices at the point of data collection to ensure you are always aware of how your data is used.
Right of Access: You can request a copy of all personal data we hold about you (a "Subject Access Request"). We must provide this electronically and free of charge.
Right to Rectification: If your data is inaccurate or incomplete (e.g., a wrong delivery address), you have the right to have it corrected immediately.
Right to Erasure ("Right to be Forgotten"): You can ask us to delete your data. Note: We will comply unless we have a legal obligation to keep it (e.g., HMRC tax records).
Right to Restrict Processing: You can ask us to freeze your data. This means we keep the data stored but stop using it while we investigate a dispute or verify its accuracy.
Right to Data Portability: You can request your data in a structured, commonly used, and machine-readable format to move it to another service provider.
Right to Object: You have an absolute right to stop us from using your data for direct marketing. You can also object to processing based on our "Legitimate Interests."
Right Related to Automated Decision-Making: Since we use automated systems for fraud detection and identity verification, you have the right to contest an automated "block" and require a manual review by a StoreNova employee.
Right to Withdraw Consent: Where we rely on consent (e.g., GPS tracking or non-essential cookies), you may withdraw it at any time through your device or app settings.
You must first raise concerns with us via our Electronic Complaint Form. We will acknowledge your complaint within 30 days and provide a full response without undue delay. If you are unsatisfied with our response to a privacy request, you have the right to lodge a complaint with the Information Commissioner's Office (ICO).
We implement robust technical and organisational measures to protect your data. Access to personal data is strictly limited to authorised personnel who require it to perform their duties.
For all data- related inquiries or to exercise your rights, please contact our Data Compliance Officer: Mr Tunde Olaoye
Email: tunde@storenova.org
Postal Address: StoreNova Ltd, Wharncliffe road, Shipley, Bradford, UK.
This Policy is reviewed every 12 months, or sooner if regulatory or operational changes require it.
Version Control: Version 1.1 | Date: 05 March 2026