Privacy Policy

1. Who we are

KORI FOOD LTD (trading as Kori Snack) is the data controller for the personal data described in this policy.

KORI FOOD LTD · Registered in England & Wales, company no. 17437440 · Registered office: 71–75 Shelton Street, Covent Garden, London WC2H 9JQ.

Data protection enquiries: privacy@korisnack.com. We aim to respond within 2 working days and, for formal rights requests, within one month as required by the UK GDPR.

2. Whose data we hold

We hold different things about each, for different reasons.

• Customer contacts, the office manager, People team or finance contact who orders and pays.
• Enquirers, anyone who submits the quote or contact form.

3. Customer contacts

What we collect

• Name, work email address, company name, and delivery address.
• Phone number, if you choose to give one.
• Order, subscription and delivery history, including dietary preferences you set for your office.
• Billing records. We never see or store your full card number. Card payments are processed by Stripe; we receive only the last four digits, card brand and outcome.

Why, and on what lawful basis

• To perform our contract with you, taking and fulfilling orders, arranging delivery, handling payment, invoicing and support.
• Legal obligation, keeping accounting and tax records, and food traceability records.
• Legitimate interests, service emails about your deliveries, fraud prevention, and improving our range. You can object to processing based on legitimate interests at any time.
• Consent, marketing emails that are not about an order you have placed. Every one has an unsubscribe link, and withdrawing consent is as easy as giving it.

4. How long we keep things

• Accounting and tax records (invoices, payments): 6 years from the end of the financial year they relate to, as required by UK tax law.
• Customer account and order history: for the life of the account, then 24 months after your last delivery, then deleted or anonymised.
• Quote and contact form submissions that do not become customers: 12 months.
• Marketing consent records: until you unsubscribe, plus 24 months so we can evidence that you had opted in.
• Food safety and traceability records: as required by food law, currently a minimum of 5 years.

5. Who we share data with

We do not sell personal data, and we do not share it for anyone else's marketing.

• Stripe Payments Europe, payment processing and subscription billing.
• Supabase, the database and authentication behind your account.
• Delivery partners, the delivery contact name, address and phone number needed to complete a delivery, and nothing else.
• Our email provider, to send order confirmations and account emails.
• Our accountants, and regulators or authorities where we are legally required to disclose.

Where a provider processes data outside the UK, that transfer is covered by UK adequacy regulations or the International Data Transfer Addendum to the EU Standard Contractual Clauses.

6. Cookies and analytics

We use cookies and local storage that are strictly necessary to run the site, keeping you signed in, remembering your basket, and completing checkout securely. These do not require consent.

If we later add analytics or advertising cookies, we will ask for your consent first and update this policy before switching them on.

7. Your rights

Under the UK GDPR you have the right to access your data, to have inaccurate data corrected, to have data erased, to restrict or object to processing, to data portability, and to withdraw consent. To exercise any of them, email privacy@korisnack.com. We will not charge you, and we will respond within one month.

If you are unhappy with how we have handled your data you can complain to the Information Commissioner's Office at ico.org.uk or on 0303 123 1113. We would rather you told us first so we can put it right.

8. Security

Data is encrypted in transit and at rest. Access to customer data is limited to the people who need it to run deliveries and support, and is protected by multi-factor authentication. Card data never reaches our systems.

9. Changes

If we change this policy we will update the date at the top of this page, and for material changes we will email account holders before the change takes effect.