Privacy notice
What we collect when you order, why we need it, and how long we keep it.
Last updated: 8 August 2026
Draft for owner and solicitor review before launch. This notice describes what the website actually does today, but it has not been reviewed by a legal professional and is not legal advice.
Who we are
Carlow Tropical Foods, Carlow, Ireland, is the data controller for the personal data described here. For any question about your data, email carlowtropical@gmail.com.
What we collect
When you place an order we collect only what is needed to prepare and hand it over:
- Your name — so we know whose order it is at the counter.
- Your phone number — so we can reach you about the order.
- Your email address (optional) — to send your order confirmation.
- A WhatsApp number (optional) — if you would rather we message you there.
- Any note you add to the order — whatever you choose to tell us.
- Your order details — items, quantities and the amount paid.
If you create an account, we also store your email address and name against that account so your order history is available when you sign in.
We do not collect a delivery address, because orders are collected in store.
Card details
We never see or store your card details. Payments are taken on a page hosted by our payment provider, SumUp. Your card number never reaches our website or our database. We receive only the outcome of the payment and a reference for it.
Why we are allowed to use it
- To perform our contract with you — taking payment, preparing your order, and sending the confirmation email. Without this data we cannot fulfil an order.
- Our legitimate interests — keeping records that let us detect fraud, resolve disputes, and keep the website working.
- Legal obligation — keeping sales and payment records for the period Irish tax law requires.
We do not send marketing email, so we do not ask for marketing consent. If that ever changes we will ask you separately, and transactional and marketing email will stay separate.
Who else handles your data
We use a small number of service providers, each of which processes data on our instructions:
- Supabase — hosts our database and accounts.
- Vercel — hosts the website itself.
- SumUp — takes card payments.
- Brevo — sends order confirmation emails.
We do not sell your data, and we do not share it for anyone else's advertising.
Cookies
We use only what is strictly necessary to make the site work: a cookie that keeps you signed in if you have an account, and your basket, which is stored in your own browser. We do not run advertising or analytics trackers, which is why you are not being asked to accept cookies.
How long we keep it
Order and payment records are kept for at least six years, as required for tax records. Account details are kept while your account is open. Where we no longer need to identify you but must keep the financial record, we remove your contact details from it.
Your rights
You can ask us for a copy of your data, ask us to correct it, ask us to delete it, or object to how we use it. Email carlowtropical@gmail.com and we will respond within one month. Some records we are legally required to keep, and we will tell you if that applies.
If you are unhappy with how we have handled your data you can complain to the Irish Data Protection Commission at dataprotection.ie.