Privacy policy

What we collect

When you order

• Your name, and your mobile number or email address. We need at least one of them to reach you about your order. The welcome offer also needs your mobile number.
• What you order, your pickup time, the price, and whether you paid or got a refund.

When you join

• Your name, email address and password. We store the password in a form that can’t be read back.
• Your stamps, rewards and orders.
• When you sign in, and the internet (IP) address and browser you used.

If you choose to

• Tick “Email me news and offers”. We record the words you agreed to and when you ticked the box.
• Rate an order from 1 to 5, and add a comment.

From others

• Google, if you sign in with Google: your name, email address, profile picture, Google account ID, and whether Google has confirmed your email address. We use them to create your account and sign you in.
• Stripe, which takes our card payments: whether your payment worked. For the welcome offer, Stripe also gives us a code for your card. We never see your card number.
• Our staff, who may add a note to your order, for example about a change you asked for.

How we use it

• To make your order and keep you up to date with it.
• To look after you: answer questions, fix problems, give refunds, keep your stamps and rewards, and show your past orders when you sign in.
• To improve our menu and service. We look at what sells and when we’re busy. We keep guest orders with the same email address or mobile number together, so we know what our regulars like. We never link orders by name.
• To keep the welcome offer to one per person, and to keep accounts secure.
• To email you news and offers, if you asked for them.
• To keep the records tax law requires.

If you ordered as a guest before you joined, you can add those orders to your account. We find them by your email address, after we email you a code to check it’s yours. If you sign in with Google, Google has already checked it.

News and offers

We email you news and offers only if you tick “Email me news and offers”. We never tick it for you. Every email has an unsubscribe link, and we stop within 5 working days. Unsubscribing doesn’t affect your orders, account or rewards.

Who sees it

• Our team sees your name and order, so they can make it and hand it over. Only the owner can see your mobile number and email address.
• When your order is ready, a screen at our counter may show your first name and order number. If you’d rather it didn’t, give a nickname when you order.
• Our service providers: Cloudflare stores our database and runs our website, Stripe takes card payments, and Google signs you in if you choose. They keep information overseas, including in the United States. Stripe also uses payment details for its own purposes, such as preventing fraud, under Stripe’s privacy policy.
• We don’t sell your information or give it to anyone for their own marketing.

How long we keep it

We keep your details until you ask us to delete them. Then we remove your name, contact details, rating comments and the kitchen’s notes from your orders, and close your account if you have one. Three things stay:

• What you bought and paid, for at least 7 years, because tax law requires it. We keep it without your name or contact details.
• Codes made from your email address, mobile number and card, which can’t be turned back into them. We use them only to keep the welcome offer to one per person.
• A record of when you agreed to news and offers, to show we had your permission.

Copies can stay in our backups for a time. If we ever restore one, we delete your details again before we use it.

See, correct or delete your information

Ask us at the counter, or write to us at 97 Stuart Street, Dunedin. Tell us the email address or mobile number you used, so we can find your orders. It’s free. We check that the request comes from you, for example by replying to the email address or calling the number we have for you. We reply within 20 working days.

If we don’t agree that something needs correcting, we add your view to your information. If an order or refund is still under way, or your account holds a reward you haven’t used, we ask you to wait, or to use the reward first.

Cookies

Our own cookies only keep you signed in, for up to 7 days. At the payment step, Stripe’s payment form sets Stripe’s cookies to help prevent fraud. We count visits with Cloudflare Web Analytics, which uses no cookies. Your browser keeps your bag, and your checkout details until you place your order.

Keeping it safe

Only the people who need your information can see it. It’s encrypted on its way to and from our website, and where it’s stored. If a privacy breach is likely to cause you serious harm, we tell you and the Privacy Commissioner.

Questions and complaints

Tell us first, and we’ll try to put it right. You can also complain to the Privacy Commissioner at privacy.org.nz.

Changes

We post any change here with a new date. We won’t use information you’ve already given us for something new without asking you first.