Privacy Policy

Last updated: 8 October 2026

This privacy notice explains how Ali Tandoori Express collects and uses your personal information when you visit our website, place an order, use your account or contact us. We have written it in plain language so you can understand what happens to your information and the choices available to you.

Who we are

Ali Tandoori Express is the data controller for personal information collected through alitandooriexpress.co.uk and our online ordering service.

You can contact us at:

• Address: 100 Harvey Lane, Norwich NR7 0AQ
• Email: contact@alitandooriexpress.co.uk
• Telephone: 01603 300 002

Information we collect

The information we collect depends on how you use the website. It may include:

• Order and delivery information: your name, email address, telephone number, billing or delivery address, postcode, chosen dishes, prices, order notes, delivery or collection preference and order status.
• Account information: your login details, saved addresses, profile information and order history. Passwords are stored in a protected form and are not visible to us.
• Payment information: payment status, payment method and transaction or provider reference. Card and account credentials are entered into the secure systems of our payment providers; we do not store your full card number or card security code.
• Messages and support information: information you include in a contact form, email, telephone call or request for help.
• Technical and usage information: IP address, device and browser information, approximate location derived from your IP address, website activity, security logs, cookie identifiers and your cookie choices.

Allergy and dietary information

If you choose to include allergy, dietary or other health-related details in an order note, we use that information only to respond to your request and prepare or discuss your order. Because this information can be sensitive, please provide only what is necessary. For a serious allergy, contact us directly before ordering so our team can discuss your requirements.

How and why we use your information

We use personal information only where we have a lawful reason to do so:

• To perform our contract with you: taking and preparing your order, arranging collection or delivery, processing payment, sending order updates, managing your account and providing customer support.
• To meet legal obligations: keeping accounting and tax records, responding to lawful requests and handling legal claims or food-safety matters.
• For our legitimate interests: protecting the website and our customers from fraud or misuse, diagnosing technical problems, improving our service, keeping appropriate business records and showing our adverts on Facebook and Instagram to people who have ordered from us before (see Advertising on Facebook and Instagram). We consider your rights before relying on this basis, and you can object at any time.
• With your consent: using non-essential analytics or marketing technologies where consent is required, including the Meta Pixel described in Advertising on Facebook and Instagram. You may withdraw consent at any time without affecting earlier lawful use.
• For sensitive information you ask us to use: responding to allergy or dietary instructions you deliberately provide, where data protection law allows us to do so.

We do not use your information for solely automated decisions that produce legal or similarly significant effects.

Who we share information with

We share only the information needed for the relevant purpose. Recipients may include:

• our authorised team members, kitchen staff and delivery personnel;
• website hosting, security, email and technical-support providers;
• WooCommerce and related service providers that support our online shop;
• Stripe and PayPal when you choose their payment services;
• Google services used for site measurement, diagnostics or maps, depending on your settings and consent;
• Meta Platforms Ireland Limited (Facebook and Instagram), for advertising, as explained in Advertising on Facebook and Instagram; and
• professional advisers, regulators, courts, law-enforcement bodies or other authorities where disclosure is necessary or legally required.

We do not sell your personal information.

International data transfers

Some technology and payment providers, including Meta, may process information outside the United Kingdom. Where this happens, we require an appropriate legal safeguard, such as a UK adequacy regulation, the UK International Data Transfer Agreement or an approved contractual addendum, unless another lawful exception applies. You can contact us if you would like more information about a relevant safeguard.

How long we keep information

We keep personal information only for as long as it is needed for the purposes described above. In general:

• order, payment-reference and invoice records are normally kept for up to six years to meet accounting, tax and legal requirements;
• account information is kept while the account remains active and for a reasonable period afterwards;
• general contact enquiries are normally kept for up to 12 months, unless they relate to an order, complaint or legal matter that requires longer retention;
• security and technical logs are kept for a limited period appropriate to investigating problems and protecting the service;
• information used for advertising on Facebook and Instagram is kept as explained in Advertising on Facebook and Instagram; and
• payment providers keep information under their own retention policies.

We may keep information longer when required by law, when a dispute is ongoing or when it is needed to establish, exercise or defend a legal claim. When information is no longer required, it is deleted or anonymised.

Cookies and similar technologies

Our website uses strictly necessary cookies and local storage to remember your basket, maintain checkout and account sessions, protect forms and keep the site working securely. These technologies are necessary to provide the service you request.

The website may also use Google measurement tools to help us understand website performance and improve the customer experience. With your consent, we also use the Meta Pixel, an advertising technology explained in Advertising on Facebook and Instagram. Non-essential analytics or advertising technologies require consent where applicable. You can change your choice at any time using the “Cookie settings” link at the bottom of every page, and you can also block or delete cookies in your browser settings. Blocking necessary cookies may prevent the basket, checkout or account features from working correctly.

Advertising on Facebook and Instagram

We advertise on Facebook and Instagram, which are run by Meta. For people in the UK, the Meta company responsible is Meta Platforms Ireland Limited. We use Meta in the two ways explained below.

The Meta Pixel on our website (only if you accept cookies)

The Meta Pixel is a small piece of code from Meta. It only loads if you choose “Accept” on our cookie banner. If you choose “Reject”, or make no choice, it does not load and our website sends nothing to Meta.

If you accept, the Pixel tells Meta when you:

• view a page (PageView);
• view a dish page (ViewContent);
• add a dish to your basket (AddToCart);
• start checkout (InitiateCheckout); and
• complete an order (Purchase).

These events include the product codes of the dishes, the number of items, the basket or order value, the currency and, for a completed order, our order reference number. Meta also receives technical information such as your IP address, browser and device details, the address of the page you are on and which buttons you click. It uses its own cookies, _fbp and, if you arrived from one of our adverts, _fbc, which normally last up to 90 days. The Pixel does not send Meta your name, email address, telephone number, delivery address or payment details.

We use this to measure whether our adverts lead to orders, to show our adverts to people more likely to be interested, and to show relevant offers to people who have visited our website. If you have a Facebook or Instagram account, Meta may link this information to it. We and Meta are joint controllers for collecting and sending this information to Meta. Meta decides how it uses the information after that, as described in Meta’s Privacy Policy.

To change your mind: select “Cookie settings” at the bottom of any page of our website and choose “Reject”. This stops the Pixel and deletes the Meta cookies from your browser. We remember your choice in a cookie called ate_cookie_consent for 180 days, after which we will ask you again.

Showing our adverts to existing customers

If you have ordered from us through this website, we may use Meta’s Custom Audiences tool to show you our adverts on Facebook and Instagram, or to leave you out of adverts meant only for new customers.

To do this, we take the email address and telephone number from your order and upload them to Meta. Before they leave our computer, Meta’s upload tool turns them into scrambled codes (this is called hashing), so Meta does not receive them in readable form. Meta compares these codes with codes made in the same way from its own users’ details. If there is a match, you are added to a private audience that only we can use for our adverts. If there is no match, nothing is added. Meta deletes the uploaded codes once the matching is finished. We do not upload your name, address, order history or payment details.

Meta carries out this matching on our behalf, under its Custom Audiences terms, and is not allowed to use the uploaded codes for its own purposes. We rely on our legitimate interests in letting people who already know us hear about our offers, and in not showing new-customer offers to existing customers. This does not involve sending you any messages.

Your right to object: you can ask us to stop at any time by emailing contact@alitandooriexpress.co.uk with the email address or telephone number you used to order. We will leave you out of every future upload and remove you from the audience within 30 days. You can also manage the adverts you see in your Facebook or Instagram settings.

How long we keep it: we only include customers who have ordered from us in the last 24 months. We delete the upload file from our computer once the upload is finished, refresh the audience at least every six months so that older customers drop out, and delete the audience when we no longer use it.

Transfers outside the UK: Meta Platforms Ireland Limited may share information with Meta Platforms, Inc. in the United States. For these transfers Meta relies on safeguards recognised under UK law, such as the UK Extension to the EU-US Data Privacy Framework (the “UK-US data bridge”) and standard contractual clauses with the UK Addendum.

Links, maps and social media

Our website contains links to Google Maps and social-media services. If you open a link or interact with third-party content, that provider may receive information such as your IP address and device details and will handle it under its own privacy notice. We are not responsible for the privacy practices of third-party websites.

How we protect information

We use appropriate technical and organisational measures designed to protect personal information from accidental loss, unauthorised access, alteration or disclosure. Access is limited to people and providers who need the information for their work. No internet service can be guaranteed completely secure, but we review and improve our safeguards as needed.

Your data protection rights

Depending on the circumstances, UK data protection law may give you the right to:

• ask for a copy of the personal information we hold about you;
• ask us to correct incomplete or inaccurate information;
• ask us to delete information or restrict how it is used;
• receive certain information in a portable format;
• object to processing based on legitimate interests (including using your details to show you our adverts on Facebook and Instagram) or to direct marketing; and
• withdraw consent where we rely on consent.

These rights are not absolute and an exemption may apply. To make a request, email contact@alitandooriexpress.co.uk. We may ask for information needed to confirm your identity. We normally respond within one month.

Children

Our online ordering service is intended for adults. We do not knowingly ask children to create accounts or place orders without the involvement of a parent or guardian.

Changes to this notice

We may update this privacy notice when our services, providers or legal obligations change. The latest version will always appear on this page with the date it was last updated.

Contact us

For privacy questions or requests, email contact@alitandooriexpress.co.uk, call 01603 300 002, or write to Ali Tandoori Express, 100 Harvey Lane, Norwich NR7 0AQ.