Privacy Policy

Last updated: 1 January 2026

FreshMart ("we", "our", "us") is committed to protecting your personal data and respecting your privacy. This policy explains how we collect, use, and safeguard your information in compliance with the UK General Data Protection Regulation (UK GDPR) and the Data Protection Act 2018.

1. Data Controller

FreshMart Ltd is the data controller for the personal data we process. Our registered address is 42 Highbury Park, London N5 2AB. For data protection queries, contact our Data Protection Officer at privacy@freshmart.co.uk.

2. What Data We Collect

We may collect and process the following personal data:

• Identity data: name, date of birth (for age-restricted purchases)
• Contact data: email address, phone number, delivery address
• Account data: username, password (encrypted), account preferences
• Transaction data: order history, payment details (processed by Stripe — we do not store full card numbers)
• Technical data: IP address, browser type, device information, cookies
• Usage data: browsing behaviour, product views, search queries
• Marketing data: communication preferences, marketing opt-in status

3. Lawful Basis for Processing

We process your personal data on the following bases:

• Contract: to fulfil orders and provide our services to you
• Legitimate interest: to improve our services, prevent fraud, and ensure security
• Consent: for marketing communications (which you can withdraw at any time)
• Legal obligation: to comply with tax, accounting, and regulatory requirements

4. How We Use Your Data

We use your data to: process and deliver orders; manage your account and loyalty programme; send order updates and service communications; send marketing emails (with your consent) and abandoned-basket reminders (see section 6); improve our website and services; detect and prevent fraud; and comply with legal obligations.

5. Data Sharing

We may share your data with: delivery partners (to fulfil orders); payment processors (Stripe); analytics providers; and law enforcement (when legally required). We do not sell your personal data to third parties.

6. Data Retention

We retain your personal data for as long as necessary to provide our services and comply with legal obligations. Order data is retained for 7 years for tax purposes. You may request deletion of your account at any time.

Abandoned baskets. If you are signed in and leave items in your basket without checking out, we record that this happened: a reference to your account and to the basket, how many items it held, what they were worth, and when you last changed it. We do not keep a copy of what was in the basket. We use that record to remind you about the basket, and to understand how often baskets are left unfinished. We only send a reminder if you have opted in to marketing, which you can withdraw at any time in your account settings. Reminders are only ever about groceries like the ones you left behind, and every one carries an unsubscribe link that works in a single click, without signing in. We delete these records after 90 days, and immediately if you delete your account.

7. Your Rights

Under the UK GDPR, you have the right to:

• Access your personal data (Subject Access Request)
• Rectify inaccurate data
• Erase your data ("right to be forgotten")
• Restrict processing
• Data portability
• Object to processing
• Withdraw consent at any time

To exercise these rights, email privacy@freshmart.co.uk. We will respond within 30 days.

8. Cookies

We use only strictly necessary cookies. They keep you signed in, hold your basket while you shop, protect the site against cross-site request forgery, and remember which FreshMart store serves your postcode. We do not use cookies for advertising, tracking or profiling, and we store nothing else on your device.

Because none of them is optional, there is nothing here for you to accept or decline, so we do not show a consent banner. Our Cookie Notice lists every cookie we set, what each one is for and how long it lasts, and explains how to control cookies in your browser. If we ever introduce a cookie that is not essential, we will ask for your consent before setting it.

9. Security

We implement appropriate technical and organisational measures to protect your personal data, including encryption, access controls, and regular security assessments.

10. Complaints

If you are unhappy with how we handle your data, you have the right to lodge a complaint with the Information Commissioner's Office (ICO) at ico.org.uk.