1. Who we are
PomoPizza is operated by Pomo Farm Limited, a company registered in England and Wales (company number 16676469), with its registered office at 3 Charleville Road, London W14 9JL. In this policy "we", "us", and "our" refer to Pomo Farm Limited. We are the data controller for the personal data described below. You can contact us at support@pomopizza.uk or by post at the address above.
2. What we collect
- Account details: your email address, name, and phone number.
- Delivery details: your street address and postcode.
- Order history: the items you order, totals, and timestamps.
- Payment data is handled directly by Stripe. We never see or store your full card number — we only receive the last four digits and a Stripe-issued reference for our records.
- Technical identifiers: a unique account ID and basic app activity (for example, items added to your cart and orders placed) so the app can function and remember your session.
- Local storage: we keep a sign-in token in your browser or app so you do not have to log in every visit. This is essential for the service to work and is not used for tracking or advertising.
- Technical information: our service providers (listed in Section 4) automatically receive your IP address and basic device information when you use the app, which they use for security and to deliver the service.
3. Why we use it, and our legal basis
- To create your account and let you sign in. (Legal basis: performance of a contract with you.)
- To process, prepare, and deliver your orders. (Legal basis: performance of a contract.)
- To send order confirmations, verification and password-reset emails. (Legal basis: performance of a contract.)
- To check that your delivery address is within our delivery radius — for this we send your address to Google Maps to calculate driving distance. (Legal basis: performance of a contract.)
- To keep order receipts for tax purposes. (Legal basis: compliance with a legal obligation under UK tax law.)
- To prevent fraud, abuse, and to keep the service secure. (Legal basis: our legitimate interests in protecting our business and our customers.)
We do not use your data for automated decision-making or profiling that has a legal or similarly significant effect on you, and we do not send marketing emails. If we ever introduce marketing communications, we will ask for your consent first.
4. Who we share it with
We use the following service providers to run the app. They process your data on our instructions under written agreements. We do not sell your data, and we do not share it for advertising.
- Stripe — payment processing.
- Google Maps Platform — address lookup and delivery distance.
- Twilio SendGrid — sending transactional emails (receipts, verification, password resets).
- Google Firebase — hosting, account authentication, and database storage of your account and order data.
Some of these providers (notably Stripe, SendGrid, and Google) may process your data on servers outside the United Kingdom, including in the United States. Where this happens, the transfer is protected by the UK International Data Transfer Agreement (IDTA) or the equivalent EU Standard Contractual Clauses with the UK Addendum, as required by UK GDPR.
We may also disclose data where we are required to do so by law, by a court order, or by a regulator (for example HMRC), or to protect our rights or the safety of our customers and staff.
4a. How we protect it
All data is transmitted over encrypted connections (HTTPS/TLS). Account passwords are hashed and never stored or visible to us. Access to your account and order data is restricted to authorised staff and the service providers listed above.
5. How long we keep it
Account data is kept for as long as your account exists. Order receipts may be kept for up to 7 years to meet UK tax record-keeping requirements; if you delete your account, these receipts are anonymised so they can no longer be linked to you.
6. Your rights
Under UK GDPR you have the right to:
- Access the personal data we hold about you.
- Correct data that is inaccurate or incomplete.
- Delete your account and associated data.
- Restrict or object to certain processing.
- Portability — receive a copy of your data in a common machine-readable format.
- Withdraw consent at any time, where we rely on consent.
You can view and edit your profile from the "My Account" screen in the app, and permanently delete your account from the same screen — this removes your profile and saved details. If you no longer have the app installed, or you can't sign in, you can request deletion from pomopizza.uk/delete-account instead. For any other request, email support@pomopizza.uk and we will respond within one month.
If you are unhappy with how we handle your data, you can complain to the UK Information Commissioner's Office (ICO) at ico.org.uk.
7. Children
PomoPizza is intended for users aged 18 and over. We do not knowingly collect personal data from anyone under 18. If you believe a child has provided us with personal data, please contact us and we will delete it.
8. Changes to this policy
If we change this policy we will update the date at the top of this page. Material changes will be notified by email or in the app.