Privacy Policy

1. Who We Are

Turkish Sweet Centre ("we", "us", "our") is a confectionery business operating from Bradford, West Yorkshire, UK. We sell authentic Turkish and Ottoman sweets online and in-store. This Privacy Policy explains how we handle the personal data of individuals who visit our website or place orders with us.

2. What Data We Collect

When you place an order or contact us, we may collect the following personal data:

• Name — first and last name, used to personalise and confirm your order
• Email address — used to send order confirmations and updates
• Phone number — used to contact you about your order if needed
• Delivery address — used to deliver your order (street, city, postcode)
• Order details — items purchased, quantities, and any special requests
• Payment information — processed securely by Stripe; we do not store card details

Website Usage Data

Our website may collect technical data such as your IP address, browser type, and pages visited. This is used for site security and performance monitoring only.

3. How We Use Your Data

We use your personal data only for the following purposes:

• Order fulfilment — to process, prepare, and deliver your order
• Order communications — to confirm your order and provide updates
• Customer support — to respond to questions or complaints
• Legal compliance — to meet financial, tax, and legal obligations
• Fraud prevention — to protect against fraudulent transactions

We do not use your data for marketing unless you have explicitly opted in. We do not sell your data to third parties.

4. Legal Basis for Processing

Under UK GDPR, we process your data based on:

• Contractual necessity — to fulfil your order (Article 6(1)(b))
• Legal obligation — to comply with tax and financial regulations (Article 6(1)(c))
• Legitimate interests — for fraud prevention and site security (Article 6(1)(f))

5. How Long We Keep Your Data

• Order records — kept for 7 years to meet HMRC tax obligations
• Customer support messages — kept for 12 months after resolution
• Website technical logs — kept for 90 days

After these periods, data is securely deleted or anonymised.

6. Who We Share Your Data With

We only share your data with trusted third-party service providers necessary to process your order:

• Stripe — secure payment processing (Stripe Inc., privacy policy at stripe.com)
• Twilio / WhatsApp — order notifications (if you contact us via WhatsApp)
• Amazon Web Services (AWS) — our website and database hosting infrastructure

All processors are contractually required to handle your data in compliance with UK GDPR.

7. Your Rights Under UK GDPR

You have the following rights regarding your personal data:

• Right of access — request a copy of the data we hold about you
• Right to rectification — request correction of inaccurate data
• Right to erasure — request deletion of your data ("right to be forgotten")
• Right to restrict processing — request we limit how we use your data
• Right to data portability — receive your data in a portable format
• Right to object — object to processing based on legitimate interests

To exercise any of these rights, email us at info@turkishsweetcentre.co.uk. We will respond within 30 days.

You also have the right to lodge a complaint with the Information Commissioner's Office (ICO) at ico.org.uk or by calling 0303 123 1113.

8. Cookies

Our website uses the following types of cookies:

• Essential cookies — required for the site to function (cart, session)
• Preference cookies — to remember your cookie consent choice

We do not use advertising or third-party tracking cookies. You can manage cookie preferences through the banner shown on your first visit.

9. Data Security

We take security seriously. Your data is protected by:

• SSL/TLS encryption for all data in transit (via AWS CloudFront)
• Encrypted storage of sensitive data at rest
• Regular automated backups with 15-day retention
• Access controls limiting who can view order data
• Stripe's PCI-DSS compliant payment processing

10. Children's Privacy

Our website is not directed at children under 16. We do not knowingly collect personal data from children. If you believe a child has provided us with personal data, please contact us immediately.

11. Changes to This Policy

We may update this Privacy Policy from time to time. We will notify you of significant changes by posting a notice on our website. The "Last Updated" date below will always reflect the most recent revision.

12. Contact Us

For any privacy-related questions or to exercise your rights, contact us:

Last updated: March 2026 · This policy is compliant with UK GDPR and the Data Protection Act 2018.