Privacy notice

Last updated 6 November 2026

Who is responsible for your data

Jummie's Bukka Limited (company number 15154307), 29 Broadview, Stevenage, SG1 3TS, is the data controller. For anything about your data, email customerservice@jummiesbukka.co.uk.

What we collect

• Your name, email address and, if you give it, your phone number.
• Your delivery address and postcode.
• What you ordered, when, and the status of your order.
• Anything you tell us when you report a problem or contact us, including any allergy you mention.
• Whether you've agreed to receive offers.
• If you create an account: your password, stored only in a scrambled form we can't read, your saved delivery addresses and when you last signed in.

We never see or store your full card details. Our payment provider handles those on its own secure page.

Why we use it

• To fulfil your order, including delivery, order updates and refunds. This is needed for our contract with you.
• To run your account, if you choose to create one, so you can see your orders and reuse your addresses. This is also part of our contract with you.
• To meet legal duties, such as keeping tax and accounting records.
• To run the business safely, such as preventing fraud, keeping the site secure and handling complaints. These are our legitimate interests.
• To send you offers, only if you tick the box at checkout. You can withdraw this at any time from your tracking page or by emailing us, and it won't affect your order updates.

If you tell us about an allergy, we use it only to prepare your food safely and handle your order.

Who we share it with

• Our drivers see your name, address, phone number and items for the deliveries assigned to them. They may use a maps app to find your address.
• Microsoft Azure hosts our website and database in UK data centres.
• Stripe, our payment provider, takes your payment.
• Our postcode lookup provider receives your postcode at checkout to find your address.
• Our email hosting provider handles the emails we send you and any you send us.
• Professional advisers and authorities, such as our accountant or HMRC, where needed or required by law.

We don't sell your data.

Data outside the UK

Our email is hosted on servers in South Africa, so your name, email address and order details in our emails are processed there. Where we send data outside the UK to a country without UK-approved protections, we use the safeguards UK data protection law requires. Contact us for more details.

How long we keep it

• Your contact details: removed 24 months after your last order or account sign-in, whichever is later. This covers your name, email, phone number, address and the end of your postcode, including on your past orders, plus your password and saved addresses.
• Order and payment records: 7 years, because the law requires us to keep them for 6 years after the end of the financial year they belong to. After your contact details are removed, these records no longer identify you.
• Tracking links: stop working 14 days after your delivery or collection date.
• Copies of messages we've sent: 90 days.
• Problem reports: 12 months after they're resolved.
• Your marketing choice: as long as we hold your details, so we can respect it.

We remove this data automatically. If an order, a problem report or a refund is still open, we wait until it's finished.

Your rights

If you have an account, you can delete it yourself at any time from your account page.

You can ask for a copy of your data, ask us to correct or delete it, object to or restrict how we use it, and ask to move it to another provider. You can withdraw consent to offers at any time. Some records must be kept by law, so we may not be able to delete everything. We'll reply within one month.

If you're unhappy with how we've handled your data, please tell us first. You can also complain to the Information Commissioner's Office.

If you apply to drive for us

We collect your name, email, phone number, home postcode, vehicle details, availability and what you confirm about your right to work, licence and insurance. We also ask you to upload an ID document, proof of address, a DBS certificate and, for a motor vehicle, your driving licence. Your DBS certificate contains criminal record information, which the law protects more strongly. We use all of this to decide on your application and, if you're approved, to manage your work with us. We have a legitimate interest in doing this, and it's needed before we can work together.

Your uploaded documents are encrypted, only our managers can open them, and we delete them as soon as we've made a decision. If you're approved, we keep the DBS certificate number and issue date as a record of our check. An application we never decide is removed after 6 months. If we reject your application, we remove it after 6 months. If you're approved, we keep it while you drive for us and remove it about 6 months after your driver account is closed.

Postcode data

We check delivery postcodes against the ONS Postcode Directory. Contains OS data © Crown copyright and database right 2026. Contains Royal Mail data © Royal Mail copyright and database right 2026. Source: Office for National Statistics licensed under the Open Government Licence v.3.0.

Cookies and your browser

We don't use advertising or tracking cookies. Your basket and most recent order are saved in your own browser so that they're still there when you return. This is needed for the site to work. Customers and staff who sign in use a cookie to stay signed in.