Privacy
What we collect, and why.
What we collect
- To take an order or a quote: your name, email, phone, delivery address and postcode, company name (Buraq Table), the people you are ordering for (names for box labels), what you ordered, and any dietary notes you give us.
- To run the site safely: your IP address and basic request logs, used for rate limiting and fraud prevention. Mr Flash questions are logged so Hooria can see requests; please don’t put personal details in them.
- Only if you opt in: your mobile number for WhatsApp order updates and the weekly menu, and your email for the occasional menu note. Reply STOP or use the unsubscribe link at any time.
Why (and the legal basis)
| Cooking, labelling and delivering your order; sending one-time sign-in codes and order emails; issuing invoices | Performance of a contract |
| Allergen and dietary notes you give us | Your explicit consent, and our food-safety duties |
| Rate limits, fraud checks, keeping records for tax | Legitimate interests and legal obligations |
| WhatsApp updates and menu messages | Consent (opt-in), withdrawable at any time |
Who processes it for us
- Cloudflare — hosts the sites, the app and the API; stores orders, offices and enquiries in Cloudflare databases and key-value storage.
- Resend — sends sign-in codes, order confirmations and enquiry acknowledgements by email.
- SumUp — takes card, Apple Pay and Google Pay payments. Card details go straight to SumUp; we never see your full card number.
- Google Workspace — our mailboxes (hello@, welcome@, admin@).
- Meta (WhatsApp Business) — only if you opt in to WhatsApp messages.
We do not sell personal data and do not use advertising trackers. The site uses no tracking cookies; the app keeps a sign-in token in your browser, and a scanned QR code’s source tag (for example “t1”) is kept for the session so we can count scans.
How long we keep it
- Orders, invoices and payment records: six years, as HMRC requires.
- Quote enquiries: up to twelve months after our last contact, then deleted.
- Sign-in codes: stored hashed and expire within minutes.
- Request logs and Mr Flash logs: up to 30 days.
- Marketing opt-ins: until you opt out.
Your rights
You can ask for a copy of your data, have it corrected or deleted, object to or restrict how we use it, and take it elsewhere. Email admin@buraqhospitality.co.uk and we will reply within one month. If you are not happy with our answer you can complain to the Information Commissioner’s Office at ico.org.uk.
Changes
We will update this page if what we collect or who processes it changes, and show the version date at the top.