Privacy Policy
Last updated: 16 September 2026. This explains what personal data Jamjar collects when you order, create an account, join Rewards or contact us — and what we do with it.
This is a working draft prepared to describe what the Jamjar website and ordering system actually do today. It is not legal advice — please have it reviewed (a solicitor, or a reputable UK privacy-policy generator) before relying on it, and fill in the bracketed placeholders below with your actual business details.
1. Who we are
Jamjar, 418 Coventry Road, Birmingham, B10 0UF, United Kingdom ("Jamjar", "we", "us"). [Company registration number, if applicable — Jamjar is currently listed as a sole trader/partnership/limited company: please confirm]. You can contact us about privacy matters at hello@jamjardesserts.co.uk or by post at the address above.
2. What we collect
What we collect depends on how you use the site:
- Placing an order (collection or eat-in): your name, email address and mobile number, your order and any notes you add (including any allergy information you choose to tell us), and — for eat-in orders — your table number.
- Creating a Rewards account: your mobile number (used to log you in via a one-time text or WhatsApp code — we never store a password), your name, email address, and, if you provide them, your postcode and birthday (day and month only, never the year).
- Using Rewards: your points balance, tier, order history and any referral link you've shared or used.
- Marketing preferences: whether you've opted in to email, SMS or WhatsApp marketing, and when.
- Contacting us or joining the newsletter: your name, email address and the content of your message.
- Automatically: a single essential login cookie (see Section 6) and, briefly, your IP address when you request a login code, purely to prevent abuse of that system.
We never ask for or store your full card number — card payments are handled entirely by our payment provider, Teya (see Section 4).
3. How we use it, and why we're allowed to
- To fulfil your order — take payment, prepare it, and contact you if there's a problem with it. (Necessary to perform our contract with you.)
- To run your Rewards account — log you in, track points and tier, recognise you automatically by phone number if you order as a guest, and pay out referral rewards. (Necessary to perform our contract with you.)
- To send you marketing — new flavours, offers and Rewards news by email, SMS or WhatsApp — only if you've actively opted in, and only until you withdraw that consent. (Consent.)
- To keep the ordering and login system secure — rate-limiting login codes, spotting abuse. (Our legitimate interest in running a secure service.)
- To respond to you when you use the contact form. (Our legitimate interest in dealing with enquiries, or performing a contract if your enquiry relates to an order.)
4. Who we share it with
We use a small number of trusted providers to run the service — we don't sell your personal data to anyone, ever:
- Twilio — sends the one-time login codes by SMS/WhatsApp. Your phone number is shared with Twilio solely to deliver that code.
- Teya — processes card payments (including Apple Pay and Google Pay) via their own secure payment page. Your card details go directly to Teya and never reach Jamjar's own servers.
- Our website/database hosting provider — stores the data described above on our behalf, under contract, purely to run the site.
We may also disclose personal data where we're legally required to (for example, to a regulator or law enforcement).
5. How long we keep it
[To confirm and tighten up with your own retention policy — the placeholders below are a reasonable starting point:]
- Order records: kept for [6 years], in line with standard UK tax/accounting record-keeping requirements.
- Rewards account data: kept for as long as your account is active, or until you ask us to delete it.
- Marketing consent records: kept until you withdraw consent, plus a short period afterwards so we can demonstrate compliance if asked.
- Contact-form messages: kept for [12 months] unless a longer period is needed to resolve your enquiry.
6. Cookies
The site currently uses one cookie: a login/session cookie that keeps you signed in to your Rewards account between visits. It's strictly necessary for the account to work, so it doesn't require your consent under UK cookie law, and we don't currently use any advertising or analytics cookies. If that changes, we'll update this policy and ask for your consent where required.
7. Your rights
Under UK data protection law, you have the right to:
- ask what personal data we hold about you, and get a copy of it;
- ask us to correct anything that's inaccurate or incomplete;
- ask us to delete your data, or restrict how we use it, in certain circumstances;
- object to us using your data for direct marketing, at any time — every marketing message includes an unsubscribe/opt-out option, or you can email us;
- withdraw consent at any time, where we're relying on consent (this won't affect anything we did before you withdrew it);
- ask for your data in a portable, machine-readable format, where relevant.
To exercise any of these, email hello@jamjardesserts.co.uk. If you're unhappy with how we've handled your data, you also have the right to complain to the UK's data protection regulator, the Information Commissioner's Office (ICO).
8. Children
Jamjar isn't specifically directed at children, and our Rewards accounts aren't intended for anyone under 13. If you believe a child has given us personal data without appropriate consent, please contact us and we'll remove it.
9. Changes to this policy
We may update this policy from time to time — for example, as the Rewards programme or ordering system changes. We'll update the "last updated" date at the top whenever we do.
10. Contact us
Jamjar, 418 Coventry Road, Birmingham, B10 0UF · hello@jamjardesserts.co.uk