Privacy Notice

This notice explains how Around collects and uses personal information when you order food, sell on Around, join our waitlist or contact us, and the rights you have under UK data protection law (the UK GDPR and the Data Protection Act 2018).

Who we are

Around is a trading name of Made Responsively Ltd, company number 14933187, 1 St Mary's St, Town Centre, Ross-on-Wye, Herefordshire, HR9 5HT, UK. We are the controller of the personal information described in this notice. Our ICO registration number is [ICO registration number].

Questions or requests about your data: support@around.co.uk.

Sellers are separate controllers

When you order from a seller, the seller also receives your order details and becomes a separate controller of that information. They use it to make and hand over your order, contact you about it and, if you agreed, send you marketing. Their own privacy practices apply to how they use it. Each seller's contact details are on their storefront.

Information we collect

If you order food (customers)

• Contact details: first name, last name, email address and phone number.
• Order details: what you ordered, the drop, collection time and place, notes and special instructions you add, discount codes, gift cards and loyalty points used, the total and service fee, and payment status.
• Payment information: handled by Stripe. We receive limited details such as the card brand, last four digits and whether the payment succeeded. We never see your full card number.
• Account and preferences: if you sign in to your account, a session cookie and sign-in links sent to your email; whether you've agreed to marketing from a seller, and alerts you've asked for (for example "tell me when this drop opens").
• Messages and reviews: questions you send to a seller, and reviews you leave.
• Safety reports: if you report a food safety concern, the details you give us and, optionally, your email address.

If you sell on Around (sellers and their team)

• Account details: name, email, phone number, login details (or your Google or Apple sign-in), two-step verification settings and your team's roles and permissions.
• Business details: business and legal name, storefront details, collection locations, your kitchen address (kept private, only your town or area is shown publicly), food business registration details, hygiene rating information from the Food Standards Agency, Companies House details, and any evidence you upload for our checks.
• Payment details: your connected Stripe account identifier, payouts and transaction records. Stripe collects identity and bank information directly under its own privacy policy.
• Tax details: for HMRC reporting, your National Insurance number or UTR, date of birth, address and company number.
• Content: photos, descriptions, menus and messages you add.
• Usage and security records: sign-in activity, actions taken in the portal and audit logs.

If you join the waitlist or contact us

• Waitlist: your phone number (verified by SMS code) and your answers about what you sell and how.
• Contact form: your name, email address, location, subject and message.

Collected automatically

• Technical information such as IP address, browser type and the pages you request, used for security, rate-limiting and keeping the service working.
• On our marketing pages only, and only if you accept analytics cookies, information about how you use those pages through Google Tag Manager and Google Analytics. See our Cookie Policy.

How we use it and our lawful basis

• To take and manage orders between you and sellers, process payments and refunds, and send order emails: contract (performing our contract with you), and legitimate interests in running a marketplace.
• To run seller accounts, storefronts, payouts and reporting: contract.
• To check sellers (food business registration, hygiene ratings, Companies House): legitimate interests in keeping customers safe and the platform trustworthy, and legal obligation where we must.
• To report seller income to HMRC under the digital platform reporting rules: legal obligation.
• To send marketing on a seller's behalf, drop alerts and back-in-stock emails: consent. You can unsubscribe at any time using the link in each email.
• To send service messages, such as changes to our terms: legitimate interests or contract.
• To keep Around secure, prevent fraud and abuse, and investigate safety concerns: legitimate interests, and legal obligation where authorities require it.
• To answer enquiries and run the waitlist: legitimate interests, and consent for the waitlist.
• For analytics on our marketing pages: consent.
• To keep financial records and meet legal requirements: legal obligation.

We don't sell your personal information and we don't make decisions about you based solely on automated processing that have legal or similarly significant effects.

Who we share it with

• Sellers you order from (your order and contact details) and, for sellers, your customers (your public business details).
• Service providers who process data for us under contract:
  • Vercel (website hosting)
  • Supabase (database, authentication and file storage)
  • Stripe (payments and payouts; Stripe is also an independent controller for its own regulatory purposes)
  • Resend (sending email)
  • Upstash (rate-limiting to prevent abuse)
  • Google (Maps and address geocoding for sellers; Firebase and reCAPTCHA for the waitlist; Tag Manager and Analytics with your consent; Google and Apple sign-in if you use them)
  • Postio (UK postcode and address lookup for sellers)
• Public bodies: the Food Standards Agency and Companies House (to check seller details), HMRC (seller income reports), local councils and other authorities where the law requires or to deal with food safety concerns, and the police or courts where we are legally required.
• Professional advisers and, if our business is sold or reorganised, the buyer, under confidentiality.

International transfers

Some of our providers are based in, or access data from, the United States or other countries outside the UK. Where they do, we rely on UK adequacy regulations (including the UK–US data bridge for certified companies) or the UK International Data Transfer Agreement or Addendum to protect your information. [CONFIRM: hosting regions for Supabase and Vercel.]

How long we keep it

• Orders, payments, refunds and payouts: kept as financial records for 7 years after the end of the relevant financial year, then deleted. If a customer deletes their account, their order records are reduced to their name and email.
• HMRC reporting records: 5 years after the end of the reporting period.
• Seller accounts: while the account is open. When a seller closes their account, drops, listings, reviews, messages, alerts and team logins are deleted straight away; financial and verification records are kept for the periods above.
• Unpaid checkouts: 7 days. Expired payment links, sent alerts and processed payment notifications: 90 days.
• Data exports you download: 7 days.
• Security and audit logs: as long as needed to protect the service and meet our legal obligations.
• Waitlist and contact enquiries: until we launch in your area or no longer need them, and no longer than 2 years. [CONFIRM]

Your rights

You have the right to:

• access the personal information we hold about you;
• correct information that is wrong;
• delete your information (subject to what we must keep by law);
• restrict or object to how we use it, including objecting to any processing based on legitimate interests;
• data portability: receive your information in a reusable format;
• withdraw consent at any time, for example by unsubscribing from emails or changing your cookie settings.

Customers can download their data and delete their account from around.co.uk/account. Sellers can export their data and close their account from the portal. For anything else, email support@around.co.uk. We'll respond within one month.

If you're unhappy with how we've handled your information, please tell us first. You also have the right to complain to the Information Commissioner's Office at ico.org.uk or on 0303 123 1113.

Children

Around is not intended for children under 18, and we don't knowingly collect their information.

Security

We protect your information with access controls, encryption in transit, two-step verification for staff, separation of each seller's data, and logging of sensitive actions. No system is completely secure, so please keep your login details safe and tell us if you think your account has been misused.

Changes to this notice

We'll update this notice when our practices change. The date at the top shows when it last changed. If we make a significant change to how we use your information, we'll tell you directly where we can.