privacy policy.

This policy explains how Rowda Group Ltd, trading as Chaiiwala, looks after personal data collected through this site, our catering and franchise enquiry forms, our newsletter, and any other channel we offer. It is written to align with the UK GDPR and the Data Protection Act 2018.

who we are

Rowda Group Ltd, trading as Chaiiwala, is the data controller for the data described here. Chaiiwala is a registered trademark of Rowda Group Ltd. Registered office: 90 Freemens Common Road, Leicester, England, LE2 7SQ. For anything on this page, email franchise@chaiiwala.co.uk.

what we collect

• Enquiry data: name, email, phone, message body and any extra fields on our contact, catering, franchise and press forms.
• Newsletter: email address, optionally a name, and any preferences you tell us about.
• Order data: when you place an order on this site we collect your name, email, phone number and delivery address, and store them so we can fulfil and deliver the order. To check we can deliver to you, your address is sent to the US Census Bureau’s public geocoder (and, if it cannot find it, OpenStreetMap’s) to find its location.
• Payment data: card payments are taken by Rowda Group Ltd and processed by Ryft Pay Limited. You enter your card details into Ryft’s secure form; they go straight to Ryft and never reach our servers. With your order we keep Ryft’s payment reference, the payment’s status, the currency and amount charged, when it was paid and, if a card is declined, the reason Ryft gives (for example “insufficient funds”). We never see or keep your card number or security code.
• Analytics: anonymised usage data so we can understand which pages, products and stores you’re looking at.
• Technical logs: IP address, user agent and request timing, kept short-term to keep the site healthy and secure. With an order we also keep a one-way, keyed hash of the IP address it came from — not the address itself — so we can limit how many orders one connection can start and stop abuse of checkout.

why we collect it

We rely on the following lawful bases:

• Contract: to answer enquiries you send us and fulfil orders you place.
• Legitimate interests: to keep the site secure, improve it, and respond to general business correspondence.
• Consent: for the newsletter and for analytics / marketing cookies. You can withdraw consent at any time without affecting what you’ve already received.
• Legal obligation: when we have to retain or disclose data to meet a regulatory or statutory duty.

how long we keep it

• Enquiry data: 24 months after the last meaningful contact.
• Newsletter list: until you unsubscribe.
• Catering & events: 7 years from the date of the event, to meet our tax and audit obligations.
• Analytics: 26 months in aggregate form.
• Server logs: 30 days.

who we share it with

We use trusted processors to run the business. They only get the data they need, only do what we’ve agreed they can do, and are bound by data-processing agreements that meet UK GDPR standards:

• Hosting & database: Vercel Inc., Supabase Inc.
• Payments: Ryft Pay Limited (FCA-authorised), which receives your card details directly, and your email address and order amount from us, to take payment for delivery orders.
• Merchandise: Shopify, which runs the store your merch order is completed on and handles its payment under its own terms.
• Email: transactional email provider for form acknowledgements and newsletter delivery.
• Analytics: Vercel Web Analytics and (with your consent) Google Analytics 4.

To check an address is within our delivery area, we send the street address and ZIP you enter — never your name or contact details — to the US Census Bureau’s public geocoder and, if it cannot find it, OpenStreetMap’s Nominatim service. These are public lookup services, not processors we have agreements with, which is why they receive nothing but the address.

We do not sell your data, ever. We do not transfer your data outside the UK / EEA unless the destination has an adequacy decision or appropriate safeguards (Standard Contractual Clauses) are in place.

your rights

Under UK GDPR you can:

• Access a copy of the data we hold about you.
• Correct anything that’s wrong.
• Ask us to delete it (right to be forgotten).
• Restrict or object to a particular use.
• Receive a portable copy.
• Withdraw consent for newsletter or marketing without affecting earlier processing.
• Complain to the Information Commissioner’s Office (ICO), ico.org.uk, though we’d appreciate the chance to fix it first.

Email franchise@chaiiwala.co.uk to exercise any of these. We respond within one month.

cookies

This site sets the cookies it needs to work — keeping your basket between pages, and keeping an administrator signed in. Analytics cookies are only set with your consent, and you can clear or block any of them in your browser settings.

changes

If we update this policy we’ll change the “last updated” date at the top. Material changes are flagged in the newsletter or via a banner on the site.