Privacy Policy
Last updated: 15 July 2026
1. Who we are
Kulcha Express Global Ltd ("Kulcha Express", "we", "us", "our") operates this online food ordering platform. We are the data controller for personal data collected through our marketing website (kulchaexpress.co.uk) and our online ordering platform (order.kulchaexpress.co.uk). This policy applies to both.
Registered address: 398 Farnham Road, Slough, England, SL2 1JD
Contact: privacy@kulchaexpress.co.uk
We are registered with the Information Commissioner's Office (ICO) as a data controller. If you have any questions about this policy or how we handle your data, please contact us at the address above.
2. Data we collect
We collect the following categories of personal data:
When you place an order
- Full name
- Email address
- Phone number
- Delivery address, postcode, and the delivery entrance you confirm on the map (delivery orders only)
- Order contents, quantities, and customisations
- Order value and payment status (we do not store card numbers — see Section 5)
- Special instructions or notes you provide
When you create an account
- Email address and password (stored as a one-way hash — we cannot read it)
- Saved delivery addresses and confirmed entrances (if you choose to save them)
- Order history linked to your account
When you opt in to marketing
- Your marketing preferences — whether you have opted in to receive promotional emails and/or SMS messages from us
- The date and time your consent was recorded
Automatically collected data
- Necessary cookies for authentication, cart state, payment fraud prevention and recording your cookie choices
- With your consent only: analytics data (see Section 9 and our Cookie Policy)
- IP address and browser type, retained in server logs for up to 30 days for security and fraud prevention
3. How and why we use your data
We process your personal data on the following legal bases under UK GDPR:
| Purpose | Legal basis |
|---|---|
| Processing and fulfilling your order | Performance of a contract (Art. 6(1)(b)) |
| Arranging courier delivery via Just Eat | Performance of a contract (Art. 6(1)(b)) |
| Checking your delivery address, confirming the entrance, calculating delivery availability and charges, and showing delivery progress | Performance of a contract (Art. 6(1)(b)) |
| Sending your order confirmation and receipt by email | Performance of a contract (Art. 6(1)(b)) |
| Processing your payment via Stripe | Performance of a contract (Art. 6(1)(b)) |
| Maintaining your account and order history | Performance of a contract (Art. 6(1)(b)) |
| Sending missed-order alerts to restaurant staff | Legitimate interests (Art. 6(1)(f)) — ensuring orders are fulfilled |
| Fraud prevention and security monitoring | Legitimate interests (Art. 6(1)(f)) — protecting customers and the business |
| Complying with tax and accounting obligations (7-year retention of transaction records) | Legal obligation (Art. 6(1)(c)) — UK tax law |
| Resolving disputes with Just Eat regarding delivery charges | Legitimate interests (Art. 6(1)(f)) — contractual dispute management |
| Sending you promotional offers and news about Kulcha Express by email (only if you have opted in) | Consent (Art. 6(1)(a) UK GDPR + UK PECR) |
| Sending you promotional offers by SMS / text message (only if you have opted in) | Consent (Art. 6(1)(a) UK GDPR + UK PECR) |
| Analytics (PostHog and Google Analytics) to understand site usage and improve our service | Consent (Art. 6(1)(a) UK GDPR + UK PECR) — set only after you opt in via the cookie banner |
Withdrawing consent for marketing: You can withdraw your consent at any time by clicking the unsubscribe link in any marketing email, by replying STOP to any marketing SMS, or by updating your preferences in your account settings. Withdrawal does not affect the lawfulness of processing carried out before you withdrew.
We do not use your personal data for automated decision-making or profiling that produces legal or significant effects.
4. Who we share your data with
We share the minimum necessary personal data with the following third parties to fulfil your order:
For delivery orders, we share your name, phone number, and delivery address with Just Eat and their courier partners to arrange and complete your delivery. Just Eat acts as a data processor on our behalf under a signed data processing agreement. Their couriers may contact you directly via phone if needed to locate your address. Just Eat's own privacy policy is available at just-eat.co.uk/privacy-policy.
All card payments are processed directly by Stripe. We do not see or store your full card number, expiry date, or CVV — these are transmitted directly from your browser to Stripe. We retain your Stripe Payment Intent ID for reconciliation and refund purposes. Stripe's privacy policy: stripe.com/gb/privacy.
We use Resend to send order confirmation and receipt emails. Your email address and order details are passed to Resend solely for this purpose. Resend does not use this data for its own marketing.
We use Google Maps to check delivery addresses, help you confirm the correct entrance, calculate delivery availability and charges, and show delivery progress. When you use these features, Google may receive the address or location information needed to provide them, together with technical information such as your IP address. We do not include your name, email address, or account ID in our address or route checks. Google is an independent controller for the information it receives through Google Maps. See Google's Privacy Policy and Google Maps terms.
If you choose to sign in with Google, Google shares your name, email address, and profile picture with us under OAuth 2.0. We do not receive your Google password. This sharing is governed by Google's privacy policy: policies.google.com/privacy.
With your consent, we use PostHog (EU region) to understand how visitors use our websites — which pages are visited, how customers move from our marketing site through to checkout, and where they drop off. Form inputs are masked, and card details entered in Stripe's secure payment form are never captured. If you are signed in, your activity is linked only to your internal account identifier — never your name or email. PostHog acts as our data processor, stores data in the EU, and analytics are not set until you opt in via our cookie banner. See our Cookie Policy.
With your consent, we use Google Analytics 4 to measure aggregate traffic and audience trends across our websites. Google's advertising features and Google Signals are disabled, IP addresses are anonymised, and the data is not used for advertising or ad personalisation. Google Analytics is not set until you opt in via our cookie banner. Google's privacy policy: policies.google.com/privacy.
We do not sell your personal data to any third party. We do not share your data with advertisers.
5. Payment data
Card numbers, expiry dates, and CVV codes are entered directly into a Stripe-hosted payment form embedded in our checkout. This data never touches our servers. We store only the Stripe Payment Intent ID, which allows us to process refunds and reconcile payments. All card data is held by Stripe under PCI-DSS Level 1 compliance.
6. How long we keep your data
| Data | Retention period | Reason |
|---|---|---|
| Order records (items, amounts, VAT) | 7 years | UK tax law (HMRC) |
| Delivery address and confirmed entrance on completed orders | 7 years | Order fulfilment and record keeping |
| Account data (name, email, password hash) | Until you delete your account, then 30 days | Service provision |
| Saved delivery addresses and confirmed entrances | Until you delete them or your account | Your convenience |
| Marketing consent record (opt-in timestamp and channel) | Until you withdraw consent, then 3 years | Evidence of consent (PECR compliance) |
| Server logs (IP, browser) | 30 days | Security monitoring |
| Delivery job records (courier details, JustEat data) | 7 years | Contract dispute window + tax records |
7. International data transfers
Some of our service providers (Stripe, Resend, Google Maps, Google sign-in, and Google Analytics) are based in the United States. Where data is transferred outside the UK, we ensure appropriate safeguards are in place — specifically, UK International Data Transfer Agreements (IDTAs) or UK Addenda to EU Standard Contractual Clauses (SCCs) — as required by UK GDPR Article 46.
Just Eat Takeaway.com and its courier partners operate within the UK. Your delivery data does not leave the UK when processed for delivery purposes.
Our product-analytics provider (PostHog) processes data in the European Union. The EU benefits from a UK adequacy decision, so no additional transfer safeguards are required. Google Analytics data may be processed in the United States under the UK SCC safeguards described above.
8. Your rights
Under UK GDPR, you have the following rights:
- Right of access — request a copy of the personal data we hold about you (Subject Access Request).
- Right to rectification — ask us to correct inaccurate or incomplete data.
- Right to erasure — ask us to delete your data, subject to legal retention obligations (e.g. we must retain order records for 7 years).
- Right to restriction — ask us to restrict processing while a dispute is resolved.
- Right to data portability — receive your order history in a machine-readable format.
- Right to object — object to processing based on legitimate interests; we will stop unless we have compelling grounds.
- Right to object to direct marketing — you may object to us using your personal data for direct marketing at any time. We will stop immediately. This right is absolute and does not require a reason.
- Right to withdraw consent — where we process your data on the basis of consent (marketing emails and SMS), you may withdraw that consent at any time via your account settings, the unsubscribe link in any marketing email, or by replying STOP to any marketing text.
To exercise any of these rights, email privacy@kulchaexpress.co.uk. We will respond within one calendar month. We may ask you to verify your identity before processing your request.
If you are unhappy with how we handle your data, you have the right to lodge a complaint with the Information Commissioner's Office (ICO): ico.org.uk/make-a-complaint · 0303 123 1113.
9. Cookies
This policy covers both kulchaexpress.co.uk and order.kulchaexpress.co.uk. We use only the following cookies:
| Cookie | Purpose | Duration |
|---|---|---|
| authjs.session-token | Keeps you signed in to your account | 30 days or until sign-out |
| authjs.csrf-token | Protects sign-in forms against cross-site request forgery | Session |
| authjs.callback-url | Remembers where to redirect after login | Session |
| __stripe_mid / __stripe_sid | Stripe payment fraud prevention at checkout | 1 year / 30 minutes |
| kx_consent | Remembers your cookie choices (shared across both sites) | 180 days |
| ph_*_posthog | Analytics — only with consent. Distinguishes visitors and stitches the journey across our sites | 1 year |
| _ga / _ga_* | Google Analytics — only with consent. Measures aggregate traffic and usage | 2 years |
| cart (localStorage) | Stores your cart locally in the browser — not a cookie, never sent to our servers | Until cleared |
Analytics cookies (PostHog and Google Analytics) are not set unless you opt in via our cookie banner, in line with UK PECR. You can change your choice at any time using the “Cookie settings” link in the footer. We do not use advertising cookies. For the full categorised list and controls, see our Cookie Policy.
10. Security
We use industry-standard security measures including HTTPS encryption in transit and secure password hashing. Our infrastructure is hosted on a secured VPS with regular backups, and all payment data is handled exclusively by Stripe under PCI-DSS Level 1 compliance. No security measure is perfect — if you believe you have found a vulnerability, please contact us at privacy@kulchaexpress.co.uk before public disclosure.
11. Children
Our service is not directed at children under 13. We do not knowingly collect personal data from children. If you believe a child has provided us with personal data, please contact us and we will delete it promptly.
12. Changes to this policy
We may update this policy from time to time. Material changes will be notified by email to registered account holders or by a notice on the website. The date at the top of this page reflects the most recent revision.
13. Contact us
For any privacy-related queries, data subject requests, or to report a potential data breach:
Kulcha Express Global Ltd398 Farnham Road, Slough, England, SL2 1JD
privacy@kulchaexpress.co.uk