Privacy and cookies
What we know about you, and why.
1. Who is responsible
Lalitha Traders Ltd, a company registered in England and Wales, company number 16334998, trading as Indy's, decides how and why your personal information is used. In data protection law that makes us the controller. Our registered office is on the public record at Companies House. Write to us at hello@indys.uk about anything on this page.
2. What we collect
When you buy from us:
- Your name, email address and phone number.
- Your delivery address, including any note about where to leave the bag.
- What you ordered, when, and what you paid.
- Your calorie level, how many meals you chose, and which days you want them.
- Any ingredients or allergens you tell us to keep out of your meals.
- Your card payment, which is handled by Viva Wallet. We do not see or store your full card number.
When you use the website: which pages you looked at and for how long, roughly where you were, worked out from your IP address, your device and browser, and how you got to us: the tags an advert adds to a link when you click it, and the campaign tags in the address.
3. Why we use it, and what allows us to
| What we do | Why | What allows us to |
|---|---|---|
| Take your order, cook it, deliver it, take payment | To give you what you bought | Performing our contract with you |
| Record what you have told us you react to | To advise you honestly before you order | Your explicit consent, see section 4 |
| Email you about your order, your delivery and your account | To run the service | Performing our contract with you |
| Keep accounting and food safety records | The law requires it | Legal obligation |
| Keep the site working and stop fraud | To protect you and us | Our legitimate interests |
| Send you marketing email about offers and new dishes | To sell more | Your consent, or the soft opt-in rule for existing customers. You can stop it at any time. |
4. Information about your health
If you tell us that you cannot eat nuts, milk, gluten or anything else, that tells us something about your health. UK GDPR treats health information as special category data and protects it more strictly than the rest.
We ask for it only so that your meals are put together without those ingredients, and we use it for nothing else. We ask for your explicit consent when you enter it, and you can withdraw that consent by removing the exclusion in your account or by emailing us. If you withdraw it, we can no longer keep those ingredients out of your meals, so we would have to stop delivering to you.
5. Who else sees your information
| Who | What they get | What for |
|---|---|---|
| Viva Wallet | Your payment details and the amount | To take the payment |
| Flambia | Website and advertising measurement data | Runs our shop technology and our advertising, see section 6 |
| The company that hosts and maintains our ordering system | Everything in the system, as our supplier | Hosting and technical support |
| Our accountant, and HMRC if they ask | Order and payment records | Tax and accounts |
We do not sell your information to anybody.
6. Flambia's role
Flambia built and runs the technology behind our shop, and it also runs our advertising and decides how our measurement works. Because Flambia decides part of how and why advertising data is used, rather than only carrying out our instructions, Flambia and Lalitha Traders Ltd are likely to be joint controllers for that advertising data under Article 26 of the UK GDPR. Whichever of us you contact, you can exercise all of your rights against either of us.
7. Sending information outside the UK
Some of our suppliers may store or process your information outside the United Kingdom, including in the United States. When that happens we rely on the protections the law allows, such as the UK extension to the EU to US Data Privacy Framework, or the UK's international data transfer agreement.
8. How long we keep it
| What | How long |
|---|---|
| Your account | While you are a customer, and for two years after your last order, then deleted |
| Orders, payments and accounting records | Six years from the end of the financial year they fall in |
| Food safety and traceability records | As long as food law requires |
| Marketing email records | Until you unsubscribe, and then a record that you unsubscribed |
9. Cookies
A cookie is a small file a website puts on your phone or computer so it can recognise it later. Other things work the same way, such as small pieces of data kept in your browser's storage, and everything here applies to them too.
What this site sets today. Nothing that needs your permission. This page and the rest of indys.uk carry no analytics and no advertising cookies at the moment.
What the shop sets. When you order at orders.indys.uk and use your account at panel.indys.uk, the shop sets cookies that are strictly necessary: one that keeps you logged in and holds your basket, and one that stops other websites submitting forms as you. The law lets us set those without asking, because without them the thing you asked for does not work.
What is coming, and what we will do about it. We intend to measure our advertising with Google Analytics, the Meta pixel and Microsoft Clarity. Those need your consent, because they set a lasting identifier and their results feed advertising, which puts them outside the statistics exception in Regulation 6 of the Privacy and Electronic Communications Regulations 2003. We will ask before we switch any of them on, saying no will be as easy as saying yes, and this page will list every cookie each one sets before it appears on the site.
10. Your rights
You can ask us to show you the information we hold about you, correct it if it is wrong, delete it where we do not have to keep it for tax or food safety, stop or limit what we do with it, hand it over to you or to somebody else in a machine-readable form, or stop using it for our legitimate interests or for marketing, which we will always do.
Where we rely on your consent, you can withdraw it at any time, and it is as easy to withdraw as it was to give. Withdrawing it does not undo anything we did before you withdrew it.
Email hello@indys.uk. We answer within one month. It is free.
11. Complaining
If you think we have got something wrong, tell us first and we will try to fix it. You can also complain to the Information Commissioner's Office, which regulates data protection in the UK: ico.org.uk, helpline 0303 123 1113, or Information Commissioner's Office, Wycliffe House, Water Lane, Wilmslow, Cheshire, SK9 5AF.
12. Decisions made by computer
Our system puts your weekly menu together automatically, working from your calorie level, whether you chose the meat-free menu and how dishes have been rated. A person does not check each menu. This decides what food you are offered. It does not decide anything with a legal effect on you, and it does not decide whether you can buy from us.
13. Changes to this policy
If we change anything important we will tell you by email before the change takes effect.