Privacy Policy

1. Introduction

Grocery Marketplace respects your privacy and is committed to protecting your personal information. This Privacy Policy explains how we collect, use, store, share and protect your personal information when you visit our website, create an account, place an order, register as a vendor, contact us or otherwise use our services.

This Privacy Policy applies to our customers, visitors, vendors, prospective vendors and other people who interact with Grocery Marketplace.

We process personal information in accordance with applicable UK data protection and privacy laws, including the UK General Data Protection Regulation, the Data Protection Act 2018 and the Privacy and Electronic Communications Regulations 2003.

2. Who We Are

Grocery Marketplace is an online multi-vendor grocery marketplace that connects customers with local grocery stores, supermarkets and independent retailers.

Grocery Marketplace is responsible for personal information processed for the operation and administration of the marketplace platform.

Individual vendors may act as independent data controllers for personal information they receive and use to accept, prepare, fulfil, deliver, refund or provide support for an order. Vendors are responsible for complying with applicable data protection laws when using customer information.

For privacy questions, requests or complaints, contact: hello@grocerymarketplace.co.uk.

3. Scope of This Privacy Policy

This Privacy Policy applies to information collected through:

• Our website and online marketplace;
• Customer and vendor accounts;
• Orders, payments, refunds and deliveries;
• Vendor applications and verification;
• Customer service enquiries and complaints;
• Reviews, ratings and feedback;
• Marketing subscriptions and promotions;
• Cookies and similar technologies; and
• Other communications with Grocery Marketplace.

This Privacy Policy does not apply to websites or services operated independently by third parties. Those organisations process information according to their own privacy policies.

4. Personal Information We Collect

4.1 Customer account information

When you create or use a customer account, we may collect:

• Your full name;
• Email address;
• Telephone number;
• Username and encrypted password;
• Account preferences;
• Billing and delivery addresses; and
• Account registration and login information.

4.2 Order and transaction information

When you place or manage an order, we may collect:

• Products purchased or added to your basket;
• Order number, date, value and status;
• The vendor or store selected;
• Billing and delivery information;
• Delivery instructions and preferred delivery time;
• Discounts, vouchers and promotional codes;
• Payment method and payment status;
• Refunds, cancellations, substitutions and disputes; and
• Your previous orders and transaction history.

4.3 Payment information

Payments may be processed by third-party payment service providers. We may receive limited payment information, such as:

• Payment status;
• Transaction reference;
• Payment method;
• Card type; and
• The final digits of a payment card.

Grocery Marketplace does not normally receive or store your complete debit or credit card number, card security code or online banking credentials.

4.4 Delivery and location information

To arrange and manage deliveries, we may collect:

• Delivery address and postcode;
• Delivery instructions;
• Location information where you choose to provide it;
• Delivery status and tracking information;
• Communications relating to your delivery; and
• Proof of delivery, which may include a timestamp, signature, photograph or delivery confirmation.

4.5 Vendor and business information

If you apply to sell through Grocery Marketplace, we may collect:

• Your name and business contact details;
• Business or store name;
• Business type and description;
• Registered, trading or store location;
• Company registration number, where applicable;
• VAT number, where applicable;
• Food business registration details;
• Food hygiene information;
• Store opening hours;
• Delivery areas and delivery settings;
• Identity, business or verification documents;
• Bank account or payout information;
• Product, pricing, stock and order information;
• Vendor performance, ratings and complaint history; and
• Communications with Grocery Marketplace and customers.

4.6 Communications and support information

When you contact us or use our support services, we may collect:

• Emails, messages and support requests;
• Feedback and survey responses;
• Complaint and dispute information;
• Order information included in your enquiry; and
• Information provided when communicating with a vendor or delivery provider.

4.7 Reviews and user-generated content

We may collect reviews, ratings, photographs, comments, questions and other content you submit. Reviews and ratings may be displayed publicly with your chosen display name.

Please do not include sensitive personal information, payment details or another person’s private information in a public review.

4.8 Technical and website usage information

When you use our website, we may automatically collect:

• Internet Protocol address;
• Browser type and version;
• Device type and operating system;
• Language and time-zone settings;
• Login records;
• Pages viewed, links selected and searches performed;
• Referring website and session information;
• Cookie and advertising identifiers;
• Error reports and security logs; and
• Approximate location derived from your IP address.

4.9 Marketing information

We may collect:

• Your marketing preferences;
• Your newsletter subscription status;
• Promotional emails you open or select; and
• Your preferred communication channels.

5. Special Category Information

We do not normally ask you to provide sensitive personal information, also known as special category information. This includes information about health, religion, ethnicity, political opinions or sexual orientation.

Some grocery purchases or delivery instructions may indirectly suggest sensitive information. For example, a product choice may indicate an allergy, health condition, religious belief or dietary requirement.

Please provide only information that is necessary to complete your order. Where special category information must be processed, we will rely on an appropriate lawful basis and additional legal condition.

6. How We Collect Personal Information

We may collect personal information:

• Directly from you when you register, order, apply as a vendor or contact us;
• Automatically when you use our website;
• From registered vendors when they update or fulfil an order;
• From payment providers when a payment or refund is processed;
• From delivery providers when an order is collected or delivered;
• From identity, fraud-prevention or business-verification providers;
• From publicly available business or food hygiene records;
• From analytics or advertising providers, subject to your consent; and
• From another person who places an order on your behalf.

If you provide personal information about another person, you must have permission to provide it and should make that person aware of this Privacy Policy.

7. How and Why We Use Personal Information

7.1 Providing the marketplace and fulfilling orders

We use personal information to:

• Create and manage customer and vendor accounts;
• Display stores and products available in your location;
• Process, confirm and manage orders;
• Share necessary order information with the selected vendor;
• Arrange collection, delivery and order tracking;
• Process payments, marketplace commissions, vendor payouts and refunds;
• Provide order updates and service communications;
• Manage cancellations, substitutions, returns and complaints; and
• Provide customer and vendor support.

Lawful basis: Performance of a contract or taking steps at your request before entering into a contract.

7.2 Vendor onboarding and marketplace management

We use vendor information to:

• Review vendor applications;
• Verify identity, store and business information;
• Approve, reject, restrict or suspend vendor accounts;
• Manage marketplace fees, commissions and payouts;
• Monitor vendor service and marketplace standards;
• Investigate complaints and order disputes; and
• Protect customers and maintain trust in the marketplace.

Lawful basis: Performance of a contract, compliance with legal obligations and our legitimate interests in operating a safe and reliable marketplace.

7.3 Payments, accounting and legal compliance

We use information to:

• Process and reconcile payments and refunds;
• Issue invoices and maintain transaction records;
• Calculate marketplace fees and vendor payments;
• Meet tax, accounting and regulatory requirements;
• Respond to lawful requests from authorities; and
• Establish, exercise or defend legal claims.

Lawful basis: Performance of a contract, compliance with legal obligations and legitimate interests.

7.4 Security and fraud prevention

We may use personal information to:

• Confirm account ownership and verify email addresses;
• Detect suspicious orders, payments or account activity;
• Prevent fraud, misuse and unauthorised access;
• Enforce our terms and marketplace policies;
• Protect customers, vendors, delivery providers and our platform; and
• Investigate security incidents.

Lawful basis: Legitimate interests, compliance with legal obligations and, where relevant, performance of a contract.

7.5 Improving our website and services

We may use information to:

• Understand how people use the marketplace;
• Improve website navigation, search, product listings and checkout;
• Identify website errors and performance issues;
• Develop new features and services;
• Measure marketplace and vendor performance; and
• Conduct internal analysis and reporting.

Lawful basis: Our legitimate interests in improving our services. Where non-essential cookies or similar technologies are involved, we rely on consent.

7.6 Marketing

Where permitted, we may use your information to:

• Send newsletters, offers and promotional emails;
• Tell you about new stores, products or services;
• Personalise promotions based on your interests; and
• Measure the effectiveness of marketing campaigns.

Lawful basis: Consent where required. In limited circumstances, we may rely on legitimate interests where permitted by law.

You can unsubscribe at any time by using the unsubscribe link in a marketing email, updating your account preferences or emailing hello@grocerymarketplace.co.uk.

8. Lawful Bases for Processing

Depending on the purpose, we rely on one or more of the following lawful bases:

• Contract: Processing is needed to provide our services, manage your account or fulfil an order.
• Legal obligation: Processing is required to comply with tax, accounting, regulatory or other legal obligations.
• Legitimate interests: Processing is needed for our legitimate business interests, provided your rights do not override those interests.
• Consent: You have given clear permission for a particular use, such as marketing or non-essential cookies.
• Legal claims: Processing is necessary to establish, exercise or defend a legal claim.

Our legitimate interests may include operating and improving the marketplace, providing customer support, preventing fraud, securing our systems, managing vendors and protecting our business.

9. Who We Share Personal Information With

We may share personal information with the following recipients where necessary.

9.1 Marketplace vendors

We share the customer’s name, contact details, order information, delivery location and delivery instructions with the vendor responsible for preparing and fulfilling the order.

9.2 Delivery and logistics providers

We may share necessary contact, delivery, order-reference and tracking information with drivers, couriers and delivery-management providers.

9.3 Payment and financial service providers

Payment processors, banks, payout providers and fraud-prevention providers may process information required to complete payments, refunds, vendor payouts and security checks.

9.4 Technology and professional service providers

We may use providers that support:

• Website hosting and data storage;
• WooCommerce and multi-vendor marketplace functionality;
• Email verification and transactional notifications;
• Customer support;
• Analytics and website performance;
• Cybersecurity, backups and fraud prevention;
• Accounting, legal and insurance services; and
• Marketing, subject to applicable consent requirements.

9.5 Authorities and lawful recipients

We may disclose information:

• When required by law, court order or regulatory request;
• To law enforcement, tax authorities or regulators;
• To investigate fraud, crime or misuse of the marketplace;
• To protect the rights and safety of customers, vendors or others; or
• In connection with a business sale, merger or restructuring.

We do not sell your personal information.

10. Vendors’ Use of Customer Information

Vendors may access customer information only where necessary to manage and fulfil orders, provide support, handle refunds or comply with legal obligations.

Vendors must not:

• Use customer information for unrelated purposes;
• Send independent marketing without valid permission;
• Sell or disclose customer information to unauthorised parties; or
• Keep customer information longer than necessary.

Questions about a vendor’s independent use of information may need to be directed to that vendor. You may also email hello@grocerymarketplace.co.uk, and we will assist where reasonably possible.

11. Cookies and Similar Technologies

Our website uses cookies and similar technologies. Cookies are small files placed on your device or information accessed from your device when you visit a website.

We may use the following categories of cookies:

• Strictly necessary cookies: Required for security, account login, shopping baskets, checkout and other essential website functions.
• Preference cookies: Remember choices such as language, location and store preferences.
• Analytics cookies: Help us understand website use, traffic and performance.
• Marketing cookies: Help measure advertising and provide relevant promotions.

Strictly necessary cookies may be used without consent where legally permitted. We request consent before placing non-essential analytics, preference or marketing cookies.

You can accept, reject or manage non-essential cookies through our cookie-consent tool. You may also manage cookies through your browser settings. Disabling certain cookies may affect website functionality.

More information about the cookies used on our website is provided in our separate Cookie Policy.

12. Direct Marketing

We may send marketing emails only where we have an appropriate lawful basis and comply with applicable electronic marketing rules.

Marketing consent is optional. Refusing marketing does not prevent you from creating an account or placing an order.

Service messages, including email verification codes, password-reset messages, order confirmations, delivery updates, security alerts and important policy updates, are not marketing communications.

13. International Transfers

Some of our service providers may process or store personal information outside the United Kingdom.

Where personal information is transferred internationally, we will use appropriate safeguards required under applicable data protection law. These may include:

• A UK adequacy regulation;
• The UK International Data Transfer Agreement;
• The UK Addendum to approved standard contractual clauses;
• Appropriate contractual and technical safeguards; or
• Another legally permitted transfer mechanism.

For information about safeguards used for relevant international transfers, email hello@grocerymarketplace.co.uk.

14. How Long We Keep Personal Information

We keep personal information only for as long as reasonably necessary for the purpose for which it was collected, including legal, tax, accounting, security, fraud-prevention and dispute-resolution purposes.

Expected retention periods may include:

• Customer account information: For as long as the account remains active and for a reasonable period afterwards.
• Orders, payments, invoices and accounting records: Normally for up to six years after the end of the relevant financial period, or longer where legally required.
• Vendor records: For the duration of the vendor relationship and normally for up to six years afterwards.
• Customer enquiries and complaints: For as long as needed to investigate the matter, communicate the outcome, manage disputes and meet legal requirements.
• Marketing information: Until consent is withdrawn, you object or the information is no longer required.
• Cookie and analytics information: According to the duration of the relevant cookie or analytics setting.
• Security logs: For a reasonable period needed to detect, investigate and prevent security incidents.
• Unsuccessful vendor applications: For a limited period needed to document the decision, manage complaints and prevent fraud.

Retention periods may be extended where information is required for an investigation, legal claim, regulatory requirement or unresolved dispute.

When personal information is no longer required, we will delete, anonymise or securely dispose of it.

15. Data Security

We use appropriate technical and organisational measures intended to protect personal information from loss, misuse, unauthorised access, alteration or disclosure.

Security measures may include:

• SSL/TLS encryption;
• Password hashing and account access controls;
• Email verification and authentication measures;
• Secure hosting and backups;
• Firewalls and malware protection;
• Security monitoring;
• Software updates and vulnerability management;
• Restricted access based on business need;
• Service-provider security controls; and
• Incident response and recovery processes.

No internet transmission or storage system can be guaranteed to be completely secure. You are responsible for keeping your password confidential.

If you suspect unauthorised use of your account, email hello@grocerymarketplace.co.uk as soon as possible.

16. Personal Data Breaches

If a personal data breach occurs, we will investigate it and take appropriate steps to reduce the risk. Where legally required, we will notify the Information Commissioner’s Office and affected individuals within the applicable period.

17. Automated Decision-Making and Profiling

We may use automated tools to identify potentially fraudulent activity, recommend products, organise search results, assess security risks or personalise parts of the marketplace.

We do not intend to make decisions based solely on automated processing that produce legal or similarly significant effects without providing the safeguards required by law.

Where this type of processing is introduced, we will provide appropriate information about how it works, its expected effect and your applicable rights.

18. Your Data Protection Rights

Depending on the circumstances, you may have the right to:

• Be informed: Receive clear information about how your personal information is used.
• Access: Request a copy of the personal information we hold about you.
• Rectification: Ask us to correct inaccurate or incomplete information.
• Erasure: Ask us to delete personal information in certain circumstances.
• Restriction: Ask us to restrict processing in certain circumstances.
• Object: Object to certain processing based on legitimate interests and object to direct marketing at any time.
• Data portability: Receive certain information in a structured, commonly used and machine-readable format where applicable.
• Withdraw consent: Withdraw consent at any time where processing is based on consent.
• Challenge automated decisions: Request human review where applicable.
• Complain: Make a complaint to us or the Information Commissioner’s Office.

These rights are not absolute and may be subject to legal limitations. We may need to verify your identity before responding to a request.

We normally respond to valid data protection requests within one month. Where permitted by law, this period may be extended if a request is complex or multiple requests have been made.

We do not normally charge a fee. However, we may charge a reasonable fee or refuse a request where it is manifestly unfounded or excessive, as permitted by law.

To exercise a data protection right, email hello@grocerymarketplace.co.uk.

19. Closing Your Account

You may request closure of your customer or vendor account by emailing hello@grocerymarketplace.co.uk.

Closing an account does not necessarily mean that all associated information will be deleted immediately. We may retain order, payment, tax, complaint, security and legal records where required or permitted by law.

20. Children’s Privacy

Grocery Marketplace is intended for people who are legally able to enter into a purchase contract. Our services are not directed at children.

Children should not create an account or place an order without the involvement of a parent or legal guardian.

We do not knowingly collect personal information directly from children where parental permission is legally required.

If you believe a child has provided personal information without appropriate permission, email hello@grocerymarketplace.co.uk.

21. Third-Party Links and Services

Our website may contain links to vendor websites, payment providers, mapping services, social-media platforms or other third-party services.

We are not responsible for the privacy practices of independently operated third parties. You should read their privacy policies before providing personal information.

22. Changes to This Privacy Policy

We may update this Privacy Policy to reflect changes to our services, technology, legal requirements or business practices.

The updated policy will be published on this page with a revised “Last updated” date. Where a change is significant, we may provide an additional notice by email, through your account or on the website.

23. How to Contact Us

For questions, requests or concerns about this Privacy Policy or our use of personal information, contact us by email:

Email: hello@grocerymarketplace.co.uk

Please provide enough information for us to understand and respond to your request. We may ask you to confirm your identity before providing personal information or completing a data protection request.

24. Data Protection Complaints

If you believe that Grocery Marketplace has not handled your personal information correctly, you can make a data protection complaint by emailing:

Complaints email: hello@grocerymarketplace.co.uk

Please include your name, your account email, any relevant order number and a clear description of your concern.

We will acknowledge receipt of your data protection complaint within 30 days. We will take appropriate steps to investigate your complaint, keep you informed where necessary and communicate the outcome without undue delay.

25. Complaints to the Information Commissioner’s Office

We encourage you to contact us first so that we have an opportunity to investigate and resolve your concern.

You also have the right to complain to the UK Information Commissioner’s Office, the independent regulator responsible for data protection.

You can submit a complaint through the official ICO website: Make a complaint to the ICO .