SriMart — Privacy Policy

1. UK GDPR Compliance

SriMart is committed to protecting your personal data in accordance with the UK General Data Protection Regulation (UK GDPR) and the Privacy and Electronic Communications Regulations (PECR).

2. Information We Collect

We collect personal information necessary to process your orders, including your name, email address, delivery address, phone number, and transaction history.

3. How We Use Your Data

Your data is used solely to process payments (via Stripe), fulfil and deliver your orders, and send order confirmations and updates. We do not sell your personal data to third parties.

5. How Long We Keep Your Data

We keep records of completed orders for six years, which is the retention period UK tax law requires for proof of sale. Your account details, saved addresses, reviews, feedback, basket and loyalty points are kept for as long as you have an account with us, and are removed when you ask us to erase your data.

Feedback you leave about the shop. If you send us feedback, a member of our team reads it before it appears anywhere. If we publish it, we show your first name, the initial of your surname and your star rating alongside what you wrote — never your full name, your email address or anything about your orders. You can change or replace your feedback at any time, and erasing your data removes it entirely. We also keep a scrambled (hashed) form of your network address with your feedback, used only to investigate abuse, and it is removed with your feedback.

The help assistant. If a store offers a help assistant and you use it, we record the topic you chose and whether it was answered or passed to the store on WhatsApp, together with a scrambled (hashed) form of your network address so the assistant cannot be flooded. This record is not linked to your name or your account. It becomes due for deletion after 90 days and is removed by routine clean-up after that.

Searches. When you search the shop, we record what you searched for and how many results it found, together with a scrambled (hashed) form of your network address, so the shop can see what shoppers look for and cannot find. This record is not linked to your name or your account. It becomes due for deletion after 90 days and is removed by routine clean-up after that.

Records that protect the shop from abuse. When you sign in, create an account or reset a password, look up an order, enter a discount code we do not recognise, send feedback, or paste a shopping list for the shop to match, we briefly record that it happened, together with a scrambled (hashed) form of your network address, so that repeated attempts can be slowed down. These records are not linked to your name or your account. Each becomes due for deletion after one hour and is removed by routine clean-up after that.

6. Your Data Rights

Under UK GDPR you have the right to access, rectify and request deletion of your personal data. If you have an account with us, you can exercise all three yourself from your data in your account — download everything we hold about you, correct your name, or erase your data without needing to contact anyone.

What erasure does. We remove your name, contact details, addresses, reviews, any feedback you left about the shop, basket and loyalty points. We keep your past orders, because we are required to retain proof of sale — but we strip your name and address from them first, so the records that remain no longer identify you. If you do not shop with any of our other stores, your sign-in is deleted too.

If you checked out as a guest. You do not need an account to exercise these rights. Look your order up at track your order using the order number and the email address you gave at checkout — that shows you everything we hold about the order, and lets you erase the personal details on it. We ask for both the order number and the email because either one on its own is not proof the order is yours; households often share a mailbox.

Guest erasure covers one order per request. If you placed several orders as a guest, look each one up and erase it the same way. As above, the order itself is kept as an anonymised financial record with your name, address and phone number removed.

Each of our stores holds its own records, so erasing your data here does not affect an account you hold with another store on this platform. Payments are processed by Stripe, which keeps its own transaction records under its own privacy policy; erasing your data here does not remove them.