Privacy Policy

For the purposes of UK data protection law, the data controller responsible for your personal data is:

• Name: Thai Junction (trading as Thai Junction)
• Location: 381 Uxbridge Road, Pinner, HA5 4JP
• Email: info@thaijunction.co.uk
• Phone: 07952 673674

If our registered company name, company number, or registered office address differs from the trading details shown on this website, we will update this notice when those details are published. You can always reach us via the contact details above or our Contact page.

Depending on how you use our services, we may collect:

• Identity and contact data — name, email address, phone number, postal address (including delivery or collection details where you order), and messages you send via our contact form or email.
• Account data — login credentials (password is stored in hashed form by our systems), profile details you provide on registration (for example city, postcode, and related location information if you supply them).
• Order and transaction data — items ordered, order history, delivery/collection preferences, payment status, and related communications (where online ordering and payments are enabled).
• Marketing preferences — whether you have opted in to receive our newsletter or promotions.
• Technical and usage data — IP address, browser type, device information, pages viewed, approximate location derived from IP, and cookies or similar technologies (see Cookies).
• Special dietary information — if you tell us about allergies, intolerances, or dietary requirements. Health-related data is sensitive under UK GDPR; we only process it where needed to fulfil your request, with your explicit consent, or as otherwise permitted by law.

We do not knowingly collect personal data from children under 13 for online accounts. If you believe a child has provided personal data without appropriate consent, please contact us so we can delete it.

• Directly from you (forms, account registration, orders, email, phone, or in person).
• Automatically when you browse our website (cookies, server logs, analytics if used).
• From payment or technology service providers that help us run the website, process payments, or deliver messages (only as needed to provide those services).

Under UK GDPR we must have a lawful basis for each processing purpose. We use the bases summarised below.

Where we rely on legitimate interests, we balance our interests against your rights and expectations. You may object to processing based on legitimate interests in certain cases — see Your rights.

Our website may use cookies and similar technologies that store or access information on your device. Under PECR and UK guidance:

• Strictly necessary cookies may be set without consent (for example to keep a session secure, remember cart contents, or load the site securely).
• Analytics, advertising, and non-essential cookies are used only where you have given consent, or we will avoid using them until a consent mechanism is in place.

You can control cookies through your browser settings. Blocking some cookies may affect site features (for example staying signed in or checkout).

We do not sell your personal data. We may share it with:

• Service providers (processors) — hosting, email delivery, IT support, payment processors, analytics providers (if used), who process data only on our instructions and under appropriate contracts.
• Professional advisers — accountants, lawyers, insurers where needed.
• Authorities — where required by law, court order, or to protect rights, safety, or property.
• Business transfers — if we restructure, sell, or transfer our business, data may transfer under appropriate safeguards.

Some service providers may process data outside the UK. Where that happens, we take steps required by UK GDPR, such as transferring only to countries covered by UK adequacy regulations or using appropriate safeguards (for example the UK International Data Transfer Agreement / Addendum and, where needed, transfer risk assessments).

We keep personal data only as long as needed for the purposes set out in this policy, including legal, accounting, or reporting requirements. Typical periods (subject to change based on the record):

• Contact form enquiries — usually up to 12–24 months after last contact, unless needed longer for an ongoing matter.
• Customer accounts — while the account is active and for a reasonable period after closure (for security and dispute handling).
• Orders and invoices — generally up to 6 years (or as required for tax and consumer law records in the UK).
• Marketing lists — until you unsubscribe or we decide the list is no longer accurate/relevant.
• Server logs / technical data — typically for a short period unless needed for security investigations.

When retention ends, we securely delete or anonymise data where practicable.

We use appropriate technical and organisational measures to protect personal data against unauthorised access, loss, or destruction (for example access controls, encrypted connections where applied, and careful access to admin systems). No method of transmission over the internet is completely secure; please protect your password and notify us of any suspected account compromise.

Subject to legal limits, you have the right to:

• Access your personal data (subject access request).
• Rectification of inaccurate or incomplete data.
• Erasure (“right to be forgotten”) in certain circumstances.
• Restriction of processing in certain circumstances.
• Data portability for data you provided to us based on consent or contract, where processing is automated.
• Object to processing based on legitimate interests, and to object to direct marketing at any time.
• Withdraw consent where processing is based on consent (this does not affect processing already carried out).
• Not be subject to solely automated decisions with legal or similarly significant effects (we do not use such profiling as a standard practice).

To exercise these rights, email info@thaijunction.co.uk with a clear description of your request. We may need to verify your identity. We aim to respond within one month (extendable in complex cases as permitted by law).

You also have the right to complain to the Information Commissioner’s Office (ICO). See ico.org.uk. We would appreciate the chance to address your concerns first.

You have the right to request the deletion of your account and associated personal data at any time.

To request account deletion, you can use the deletion feature within your account profile settings (where available) or contact us at info@thaijunction.co.uk. Upon your request, we will delete or anonymise your personal information, except where we are legally required to retain certain records (such as order history for tax purposes).

We only send electronic marketing (email/SMS) where allowed under PECR — typically with your consent, or in limited soft opt-in situations for existing customers about similar products/services with a simple opt-out in every message.

You can unsubscribe via the link in our emails or by contacting info@thaijunction.co.uk. Service and order-related messages are not marketing and may still be sent where needed.

Our site may link to third-party websites (social media, maps, or partners). Those sites have their own privacy practices. We are not responsible for their content or how they handle your data.

We may update this Privacy Policy from time to time. The “Last updated” date at the top will change when we do. Significant changes may be highlighted on the website or notified to account holders where appropriate. Please review this page periodically.

For privacy questions or requests:

• Email: info@thaijunction.co.uk
• Phone: 07952 673674
• Web: Contact form