Privacy Policy
Last Updated: 30 April, 2026
1. Introduction and Company Information
1.1. Purpose of this Policy
This Privacy Policy explains how ARCANE PANTRY LTD collects, uses, stores, shares, and protects personal data when you visit https://arcanepantry.com/, create an account, place an order, contact us, or otherwise interact with the website.
This Privacy Policy is intended to provide clear information about our data handling practices and should be read together with our Terms and Conditions, Cookies Policy, Delivery Policy, and any other policies published on the website.
1.2. Company Information
The website is owned and operated by ARCANE PANTRY LTD, a company registered in England and Wales under company number 17140285, with its registered office at:
284 Wood Lane, London, United Kingdom, W12 0BZ
Contact email: [email protected]
1.3. Governing Jurisdiction
This Privacy Policy is prepared with reference to the laws of the United Kingdom, including applicable data protection laws such as the UK GDPR, the Data Protection Act 2018, and, where applicable, other relevant legal requirements.
1.4. Acceptance and Use of the Website
By using the website, creating an account, placing an order, or otherwise providing your personal data to us, you acknowledge that your information will be processed in accordance with this Privacy Policy.
2. Scope of this Privacy Policy
2.1. Application of this Policy
This Privacy Policy applies to personal data collected through the website and related interactions, including when you:
(a) browse the website;
(b) register an account;
(c) place an order;
(d) contact us by email or through the website;
(e) subscribe to newsletters or marketing communications, where offered;
(f) request support, assistance, or other information; or
(g) otherwise interact with us in connection with our products or services.
2.2. Personal Data Covered
This Policy applies to information that identifies you directly or indirectly, or that can reasonably be associated with you as an individual.
2.3. Third-Party Websites
The website may contain links to third-party websites, tools, or services. This Privacy Policy does not apply to those external websites or services, and we are not responsible for their privacy practices or content.
3. Categories of Personal Data We Collect
3.1. Information You Provide Directly
We may collect personal data that you provide directly to us, including:
(a) your full name;
(b) your email address;
(c) your billing address;
(d) your delivery address;
(e) your telephone number, where provided;
(f) your account login details;
(g) order-related information; and
(h) the content of any communication, message, enquiry, or support request you send to us.
3.2. Account and Order Information
When you register an account or place an order, we may collect and store information necessary to manage your account, process your order, communicate with you, arrange delivery, respond to your requests, and maintain records of transactions and customer service interactions.
3.3. Technical and Usage Data
When you use the website, we may automatically collect certain technical and usage-related information, such as:
(a) IP address;
(b) browser type and version;
(c) device type;
(d) operating system;
(e) referring URLs;
(f) pages visited;
(g) time and date of access;
(h) browsing actions and patterns; and
(i) other analytical or diagnostic information.
3.4. Marketing and Communication Preferences
Where available and applicable, we may collect your communication preferences, including whether you have chosen to receive marketing materials, newsletters, or promotional messages from us.
3.5. Payment Information
We do not collect or store full payment card details or other complete payment credentials on our own systems. All payments made through the website are processed by an independent third-party payment provider. We may receive limited payment-related information necessary for order administration, such as payment status, payment confirmation, transaction reference information, or partial identifiers required for recordkeeping and support, but we do not have access to full payment card data.
4. How We Collect Personal Data
4.1. Direct Collection
We collect personal data directly from you when you submit information through the website, create an account, place an order, contact us, or otherwise communicate with us.
4.2. Automated Collection
We may collect certain technical and usage information automatically through cookies, server logs, pixels, analytics tools, and similar technologies when you browse or interact with the website.
4.3. Third-Party Sources
We may receive limited personal data from third parties where necessary for the operation of the website and our business, including payment service providers, delivery partners, analytics providers, fraud prevention services, customer support tools, and similar service providers.
5. How We Use Personal Data
5.1. General Purposes
We may use your personal data for purposes including:
(a) creating and managing your account;
(b) processing and administering orders;
(c) arranging shipment and delivery;
(d) communicating with you regarding your order, account, or enquiries;
(e) providing customer support;
(f) preventing fraud, abuse, and unauthorized activity;
(g) maintaining internal records;
(h) complying with legal and regulatory obligations;
(i) improving the website, products, and customer experience; and
(j) sending marketing communications, where permitted and where you have consented or where another lawful basis applies.
5.2. Order Fulfilment and Support
We use personal data to complete and manage your purchases, verify order information, process dispatch, provide delivery updates, resolve support issues, and maintain after-sales records.
5.3. Website Operation and Improvement
We may use personal data and technical information to operate the website effectively, diagnose issues, monitor performance, improve functionality, enhance security, and better understand how users interact with the website.
5.4. Legal and Administrative Purposes
We may process personal data where necessary to protect our legal rights, comply with applicable law, respond to lawful requests, enforce our Terms and Conditions, resolve disputes, and maintain appropriate business and compliance records.
6. Legal Bases for Processing
6.1. Contractual Necessity
We process personal data where necessary to enter into or perform a contract with you, including for account creation, order fulfilment, delivery, and customer support relating to your purchases.
6.2. Legitimate Interests
We may process personal data where necessary for our legitimate interests, provided that such interests are not overridden by your rights and freedoms. These interests may include operating the website, improving our services, preventing fraud, securing our systems, maintaining records, and communicating with customers.
6.3. Legal Obligation
We may process personal data where necessary to comply with legal and regulatory obligations, including obligations relating to accounting, taxation, consumer protection, fraud prevention, and lawful disclosure requirements.
6.4. Consent
Where required, we will rely on your consent for certain types of processing, such as certain cookies or certain marketing communications. Where consent is used as the lawful basis, you may withdraw it at any time, although this will not affect the lawfulness of processing carried out before withdrawal.
7. Payment Processing, PSD2, and Strong Customer Authentication
7.1. Third-Party Payment Providers
All payments on the website are processed through independent third-party payment service providers. We do not collect or store full payment card details on our own systems.
7.2. Payment-Related Information
Although we do not process full card information ourselves, we may receive limited transaction-related information from the payment provider, such as whether payment was successful, whether further verification is required, or reference information necessary to administer an order, investigate a payment issue, or respond to a customer enquiry.
7.3. Strong Customer Authentication
Where applicable, online payments may be subject to Strong Customer Authentication (SCA) in order to increase transaction security. SCA is designed to verify a customer’s identity using two or more authentication elements, such as something the customer knows, something the customer possesses, or something inherent to the customer.
7.4. PSD2 Compliance
Where applicable, payment processing may be carried out in a manner consistent with the requirements of PSD2 and related regulatory standards. This may include additional authentication steps required by the payment provider or card issuer before a transaction is completed.
7.5. Responsibility for Payment Provider Practices
The collection and handling of full payment information are governed by the relevant payment provider’s own terms and privacy practices. We recommend that you review those third-party terms and privacy notices before completing payment.
8. Cookies and Similar Technologies
8.1. Use of Cookies
We may use cookies and similar technologies to operate the website, remember your preferences, improve performance, analyse traffic, and enhance the user experience.
8.2. Types of Cookie Purposes
Cookies and similar technologies may be used for purposes including:
(a) essential website functionality;
(b) account-related features;
(c) analytics and performance measurement;
(d) security and fraud prevention;
(e) remembering preferences; and
(f) advertising or marketing, where applicable.
8.3. Further Information
More detailed information about our use of cookies and similar technologies is set out in our Cookies Policy.
9. Disclosure of Personal Data
9.1. Service Providers
We may share personal data with trusted third-party service providers where necessary for the operation of the website and our business. These may include providers involved in:
(a) website hosting and infrastructure;
(b) payment processing;
(c) delivery and logistics;
(d) customer support;
(e) analytics and website performance;
(f) fraud prevention and security;
(g) communication services; and
(h) legal, accounting, or administrative support.
9.2. Limited and Purpose-Based Sharing
We share personal data only to the extent reasonably necessary for the relevant purpose and subject to appropriate contractual, legal, or operational safeguards.
9.3. Legal Disclosures
We may disclose personal data where required by law, regulation, court order, lawful request by a public authority, or where such disclosure is necessary to establish, exercise, or defend legal claims.
9.4. Business Transfers
If our business is sold, merged, restructured, or otherwise transferred, personal data may be disclosed to relevant professional advisers and to a prospective or actual buyer or successor entity, subject to appropriate confidentiality and legal safeguards.
10. International Transfers and Extra-EEA Transfers
10.1. International Processing
Some of our service providers or partners may process personal data outside the United Kingdom or outside the European Economic Area.
10.2. Transfers Outside the EEA or UK
Where personal data is transferred to, stored in, or accessed from countries outside the EEA or the UK, we take steps to ensure that such transfers are carried out in accordance with applicable data protection law.
10.3. Safeguards
Where required, we use appropriate legal and organizational safeguards for such transfers, which may include:
(a) adequacy regulations or adequacy decisions;
(b) standard contractual clauses;
(c) international data transfer agreements; or
(d) other lawful transfer mechanisms recognized under applicable law.
10.4. Protection of Data in Cross-Border Contexts
We seek to ensure that transferred personal data remains protected by appropriate confidentiality, security, and compliance measures regardless of where it is processed.
11. Data Security
11.1. Security Measures
We use a range of technical and organizational security measures designed to protect personal data against unauthorized access, misuse, alteration, disclosure, destruction, or accidental loss.
11.2. Examples of Protections
These measures may include, where appropriate:
(a) encryption and secure transmission technologies;
(b) restricted access controls;
(c) role-based access to systems and data;
(d) internal confidentiality measures;
(e) security monitoring and testing;
(f) regular review of security practices; and
(g) operational safeguards intended to reduce the risk of data breaches or unauthorized processing.
11.3. Ongoing Security Governance
We maintain data protection and security practices aimed at preserving the confidentiality, integrity, and availability of personal data. This may include internal reviews, staff awareness and training, periodic assessment of our systems and procedures, and implementation of appropriate technical and organizational measures consistent with applicable data protection law, including GDPR-related requirements where applicable.
11.4. No Absolute Guarantee
While we take reasonable and appropriate steps to protect personal data, no method of transmission over the internet or method of electronic storage can be guaranteed to be completely secure. Accordingly, we cannot guarantee absolute security.
12. Data Retention
12.1. Retention Principle
We retain personal data only for as long as necessary for the purposes for which it was collected, including for contractual, legal, tax, accounting, customer service, dispute resolution, fraud prevention, and recordkeeping purposes.
12.2. Retention Factors
The length of time we retain personal data may depend on factors including:
(a) the nature of the data;
(b) the reason it was collected;
(c) whether an account remains active;
(d) whether there are unresolved issues or disputes; and
(e) whether retention is required by law or regulatory obligations.
12.3. Deletion or Anonymization
When personal data is no longer required, we may delete it, anonymize it, or otherwise securely dispose of it in accordance with applicable law and our internal retention practices.
13. Your Data Protection Rights
13.1. General Rights
Subject to applicable law, you may have rights in relation to your personal data, including the right to:
(a) request access to your personal data;
(b) request correction of inaccurate or incomplete data;
(c) request erasure of your personal data in certain circumstances;
(d) request restriction of processing in certain circumstances;
(e) object to certain forms of processing;
(f) request portability of personal data where applicable; and
(g) withdraw consent where processing is based on consent.
13.2. Limits and Exceptions
These rights are not absolute and may be subject to legal limitations, exemptions, or conditions. For example, we may need to retain certain information for legal, tax, fraud prevention, or contractual reasons.
13.3. How to Exercise Your Rights
If you wish to exercise any of your rights, you may contact us at [email protected]. We may request information to verify your identity before responding to the request.
14. Marketing Communications
14.1. Marketing Use of Data
Where permitted by law, we may use your personal data to send you updates, promotional communications, newsletters, or marketing messages relating to our products, offers, or services.
14.2. Consent and Opt-Out
Where required, marketing communications will be sent only where you have provided the necessary consent. In other situations where marketing is allowed under applicable law, you will always have the opportunity to opt out.
14.3. Unsubscribing
You may opt out of marketing communications at any time by using the unsubscribe mechanism included in the communication or by contacting us directly.
14.4. Service Messages
Please note that opting out of marketing communications will not affect service-related or transactional communications necessary for your account, order, delivery, support, or legal compliance.
15. Third-Party Services and Integrations
15.1. External Service Providers
The website may use or rely on third-party tools, integrations, or platforms for hosting, analytics, communications, payment processing, delivery coordination, customer support, and related business functions.
15.2. Third-Party Data Handling
Where personal data is processed by such third parties on our behalf, we seek to ensure that appropriate contractual or legal safeguards are in place. However, where a third party acts as an independent controller of personal data, its own terms and privacy policy may apply.
16. Complaints and Regulatory Contact
16.1. Contacting Us First
If you have any questions, concerns, or complaints regarding this Privacy Policy or our handling of personal data, we encourage you to contact us first at [email protected] so that we may review and address your concern.
16.2. Right to Complain
If you believe that your personal data has been handled in a manner that does not comply with applicable law, you may also have the right to lodge a complaint with the relevant data protection authority in the United Kingdom or another competent supervisory authority, where applicable.
17. Changes to this Privacy Policy
17.1. Right to Update
We reserve the right to amend this Privacy Policy from time to time in order to reflect legal, regulatory, operational, or technological changes, or changes to our website, services, or data practices.
17.2. Effective Date of Changes
Any revised version of this Privacy Policy will take effect from the date it is published on the website, unless otherwise stated.
17.3. Continued Use
Your continued use of the website after an updated Privacy Policy has been published may constitute acknowledgment of the revised terms, to the extent permitted by law.
18. Severability and Interpretation
18.1. Severability
If any provision of this Privacy Policy is found to be invalid, unlawful, or unenforceable, the remaining provisions shall remain in full force and effect.
18.2. Interpretation
Headings are included for convenience only and do not affect the interpretation of this Privacy Policy.
19. Governing Law and Jurisdiction
19.1. Governing Law
This Privacy Policy shall be governed by and construed in accordance with the laws of England and Wales, except to the extent that mandatory data protection laws provide otherwise.
19.2. Jurisdiction
Any dispute arising out of or in connection with this Privacy Policy shall be subject to the jurisdiction of the courts of England and Wales, except where mandatory law provides otherwise.
20. Contact Information
If you have any questions about this Privacy Policy, your personal data, or our data protection practices, you may contact us at:ARCANE PANTRY LTD
284 Wood Lane, London, United Kingdom, W12 0BZ
Email: [email protected]
