Privacy Policy — Dollops Ice Cream

1. Who we are

Dollops Ice Cream ("we", "us", "our") is the data controller responsible for your personal information.

Address: 8 Woodside Gardens, Westhill, Inverness IV2 5TF
Email: ross@dollopsicecream.uk

2. What information we collect

We collect and store the following personal information:

Name — provided when placing an order or creating an account
Email address — used to process your order, send order confirmations and allow you to log in to your account
Phone number — provided optionally when placing an order
Delivery address — provided when placing an order requiring delivery
Order history — a record of the products you have ordered and their prices

We do not collect payment card details. Payments are processed securely by Square and we never see or store your card information.

3. How we use your information

We use your personal information for the following purposes:

Fulfilling your order — processing, preparing and delivering your ice cream
Order communications — sending you confirmation emails and updates about your order
Your account — allowing you to log in to view your order history
Review requests — we may send a single follow-up email after your order inviting you to leave a review
Legal obligations — keeping records as required by law

Our lawful basis for processing is contract performance (processing your order) and legitimate interests (review requests and account functionality). We do not use your data for automated decision-making or profiling.

4. Who we share your data with

We share your data only with the following third-party service providers, solely to operate our website and fulfil your orders:

Supabase — our database provider, which stores your account and order information securely
Resend — our email delivery provider, used to send order confirmations and login codes
Square — our payment processor (they process your payment; we do not receive your card details)
Vercel — our website hosting provider, which also provides anonymous website analytics. Vercel Analytics does not use cookies and does not track individual users across sessions

We do not sell your personal data to any third party.

5. Cookies

We use the following cookies on this website:

customer_session — a strictly necessary cookie that keeps you logged in to your account for up to 30 days. No personal data is stored in the cookie itself; it contains only a random session token.

We do not use advertising cookies or third-party tracking cookies. Vercel Analytics collects anonymous, aggregated visitor data without cookies.

6. How long we keep your data

We retain your personal information for as long as you have an account with us. If you request that we delete your account and personal data, we will do so promptly. Order records may be retained in anonymised form to satisfy our legal and accounting obligations.

7. Your rights

Under UK GDPR you have the following rights regarding your personal data:

Right of access — you can request a copy of the personal data we hold about you
Right to rectification — you can ask us to correct inaccurate data
Right to erasure — you can ask us to delete your personal data
Right to restriction — you can ask us to limit how we use your data
Right to object — you can object to us processing your data on the basis of legitimate interests
Right to data portability — you can ask for your data in a commonly used format

To exercise any of these rights, please email us at ross@dollopsicecream.uk. We will respond within one month.

8. Security

We take reasonable technical measures to protect your personal data, including encrypted connections (HTTPS), secure database storage and httpOnly session cookies. No method of transmission over the internet is completely secure, but we work hard to protect your information.

9. Complaints

If you are unhappy with how we handle your personal data, you have the right to lodge a complaint with the UK Information Commissioner's Office (ICO):

ICO website: ico.org.uk
ICO helpline: 0303 123 1113

We would, however, appreciate the opportunity to address your concerns before you contact the ICO.

10. Changes to this policy

We may update this privacy policy from time to time. Any changes will be posted on this page with an updated date at the top. We encourage you to check back periodically.