Privacy Policy

1. Who we are

DoorCart Holt (“we”, “us”, “our”) is a local delivery service operating in Holt, Norfolk. We are the data controller for the personal information collected through this website.

If you have any questions about this policy or how we handle your data, please contact us at [email protected].

2. What data we collect

When you place an order, we collect:

• Your name and phone number
• Your delivery address
• Your email address (used for order confirmation and required by our payment processor, Stripe)
• Payment card details (processed directly by Stripe — we never store these)

If you join the DoorCart Regulars waitlist, we also collect your email address, postcode, preferred delivery day and time, the items you’d like, and optionally your name and mobile number.

We also collect anonymised analytics data about how visitors use our website (see Section 4).

3. How we use your data

We use the information you provide solely to:

• Process and fulfil your order
• Contact you about your delivery if needed
• Send an order confirmation
• Notify you if account credit is added to your account (e.g. a goodwill gesture, competition prize, or loyalty reward) — account holders only
• Tell you when DoorCart Regulars opens for your area, and plan where and when we run deliveries — waitlist members only
• Send you DoorCart news by email or text — only if you ticked the box to agree

Our legal basis for processing this data is the performance of a contract (Article 6(1)(b) UK GDPR) — we need it to deliver your order — and, for account credit notifications, our legitimate interest in keeping your account accurate and up to date (Article 6(1)(f) UK GDPR). For the Regulars waitlist, we rely on taking steps you asked for before entering a contract (Article 6(1)(b) UK GDPR), and for optional marketing emails and texts, your consent (Article 6(1)(a) UK GDPR), which you can withdraw at any time.

4. Google Analytics

We use Google Analytics 4 (GA4), a web analytics service provided by Google LLC, to understand how visitors interact with our website. GA4 collects anonymised data including:

• Pages visited and products viewed
• How long you spend on each page
• Which products are added to your cart and purchased
• General geographic location (country / region level only)
• Device type and browser

This data is collected using cookies and is sent to Google’s servers. We do not use it to identify you personally. Our legal basis for this processing is our legitimate interest in understanding and improving our service (Article 6(1)(f) UK GDPR).

Google Analytics data is retained for 14 months. You can learn more about how Google uses this data at policies.google.com/privacy.

Opt out: You can prevent Google Analytics from collecting data about you by installing the Google Analytics Opt-out Browser Add-on, or by adjusting your browser’s cookie settings.

5. Stripe Payments

Payments on this site are processed by Stripe (Stripe Payments Europe, Ltd.). When you enter your card details, they are submitted directly and securely to Stripe’s servers using their Payment Element. We never see, transmit, or store your full card number or CVC.

Stripe is a PCI DSS Level 1 certified payment processor. The information Stripe collects to process your payment — including your card number, billing details, and IP address — is governed by Stripe’s own privacy policy, available at stripe.com/gb/privacy.

We receive confirmation that a payment was successful, along with the order total and a payment reference. We do not receive or retain full card details.

6. Cookies

We use the following cookies on this site:

7. Data sharing

We do not sell, rent, or trade your personal information. We share data only with:

• Stripe — to process your payment (see Section 5)
• Google — anonymised analytics data (see Section 4)

Both processors are subject to appropriate data processing agreements and provide adequate data protection safeguards for transfers outside the UK.

8. Data retention

Order details (name, delivery address, phone number) are retained for up to 7 years to comply with our legal and tax obligations. After this period, records are securely deleted.

9. Your rights

Under UK GDPR you have the right to:

• Access the personal data we hold about you
• Request correction of inaccurate data
• Request erasure of your data (where no legal obligation requires us to retain it)
• Object to processing based on legitimate interests
• Lodge a complaint with the ICO

To exercise any of these rights, email us at [email protected].

10. Changes to this policy

We may update this policy from time to time. The “Last updated” date at the top of this page will reflect any changes. Continued use of the site after an update constitutes acceptance of the revised policy.