Privacy Policy

1. Who controls your information

HRS NEWSAGENTS LTD, trading as HRS Food, is the data controller. The company number is 16764459 and the registered office is 786 Whalley New Road, Blackburn, England, BB1 9BA.

Email hrsnewsltd@gmail.com for a privacy question or to exercise a data-protection right.

2. Information we handle

Shopify and its payment providers process payment details. HRS Food does not receive your full card number.

When checkout starts, Shopify also receives the market, buyer country and any builder mode needed to process the cart. With confirmed analytics consent at checkout, HRS also copies a sanitised source, campaign and landing-path snapshot into the Shopify cart and order for acquisition measurement. No browser attribution is copied when analytics is declined or unconfirmed.

When the Shopify Customer Privacy connection is configured, an accept or decline choice is also passed to Shopify on the shared hrsfood.com domain so that hosted checkout can respect the same analytics and marketing choices. Marketing is passed only when the visitor separately chooses it; analytics consent alone never grants marketing consent. Marketing consent is separate from the analytics consent used for the order-source snapshot.

A basket or saved box kept in browser storage can contain product choices and personalisation entered by the user, such as a recipient name or gift message.

• •Contact, billing and delivery information supplied at Shopify checkout.
• •Order details, payment status, fulfilment records and communications about the order.
• •Recipient details and gift messages when a buyer asks us to deliver an order to somebody else.
• •Messages, photographs and other evidence sent when somebody asks for support or reports a return, damaged parcel or product problem.
• •Essential browser storage for the basket, saved box choices and the analytics and marketing consent settings.
• •A consented attribution record containing limited UTM values, a path-only landing page, external-referrer hostname, recognised AI source and timestamps. UTM values that look like an email address or a long phone number are discarded.
• •Optional Google Analytics events and sanitised campaign-source information when the visitor accepts analytics. Shopify checkout measurement can include product identifiers, quantities, order value, currency and a transaction identifier.
• •After separate marketing consent, Meta receives storefront page/product views and basket events, public product names, values, quantities, URLs, browser/device information and cookie identifiers. The storefront does not add recipient names, gift messages, photographs or checkout links to these events. Shopify manages checkout and purchase measurement through its Facebook & Instagram integration, including advanced matching and Conversions API under its privacy controls. Shopify requires both analytics and marketing consent for its Meta checkout tracking.
• •Technical logs needed to operate and protect the website.
• •Basic UK site-usage statistics are immediately aggregated into daily counts of broad page categories, navigation steps and selected shopping actions. The statistics store contains no visitor IDs or individual event records. This is separate from Google and Meta tracking.

3. Why we use it and our lawful bases

• •Contract: to take steps requested before a purchase, process an accepted order, arrange delivery and provide order support.
• •Legal obligation: to keep required accounting records, handle statutory consumer rights and respond to lawful requests from authorities.
• •Legitimate interests: to secure the service, prevent fraud, answer general enquiries and deliver a gift to the recipient chosen by the buyer. We use only the information needed for those purposes and consider the effect on the people involved.
• •Consent: to run optional Google Analytics and store sanitised attribution for measurement. Separate consent applies to Meta advertising measurement and relevant ads. These choices can be changed using Cookie settings.
• •Basic aggregate site statistics run for UK visits under PECR's statistical purposes exception, solely to improve the website. To the extent that requests involve personal information while being transmitted, our legitimate interest is understanding and improving the service with immediate aggregation and no retained visitor profiles. You can object immediately and free of charge using Turn off basic statistics in Cookie settings. The Cookie Policy explains the limited information and controls.

4. Who receives information

Shopify supplies the cart and checkout service and, when the Customer Privacy connection is configured, receives the visitor's analytics and marketing choices. Payment providers process payment. Vercel hosts the website. Delivery companies receive the details needed to deliver an order. Google receives optional analytics data only after consent and only when analytics is configured.

OpenAI receives advertising measurement events after marketing consent, including public browsing and shopping activity, completed-purchase values and advertising/browser references. HRS does not manually send contact details, gift messages or photographs to OpenAI. The Cookie Policy explains these events, cookies, retention periods and withdrawal controls.

Meta receives marketing data after the separate marketing choice, subject to Shopify privacy controls. This helps measure ads and show relevant ads on Facebook and Instagram. Marketing cookie consent does not subscribe you to email marketing. See the Cookie Policy for details and withdrawal controls.

Vercel processes basic statistics on HRS's behalf through a first-party endpoint and a private aggregate store. These counts are not shared with advertising partners, linked to consented Google or Meta tracking, or used to make decisions about individuals.

We may also disclose information to professional advisers, insurers, regulators, courts or law-enforcement bodies where it is necessary and lawful.

Some providers process information outside the United Kingdom. Where UK law requires a transfer safeguard, we use providers that rely on an adequacy regulation, approved contractual clauses or another lawful transfer mechanism. Email us if you want details about the safeguard relevant to your information.

5. How long we keep information

We review retention when a purpose ends and erase or anonymise information that we no longer need.

• •Order, payment, invoice and accounting records are kept for six years from the end of the company financial year they relate to, or longer when the law requires it.
• •Support, return and complaint records are kept while the issue is open. After it closes, we keep only what is needed for legal obligations, fraud prevention or a possible legal claim, then delete or anonymise it when that reason ends.
• •A browser basket expires after 30 days and saved boxes expire after 90 days under the periods described in the Cookie Policy, unless the visitor removes them or clears browser data sooner.
• •Analytics and marketing consent choices expire after 180 days unless the visitor changes it or clears browser data sooner. The HRS attribution record expires 90 days after its most recent recorded non-direct visit, and declining analytics removes it sooner.
• •When Google Analytics is enabled, its first-party cookies are configured by this website to expire after 90 days, although browser restrictions may shorten that period. The HRS Food Google Analytics property keeps user-level and event-level data for 14 months. This setting does not control standard aggregated reports.
• •Security and hosting logs are kept according to operational need and provider settings, then removed or anonymised when they are no longer required.
• •Basic statistics are aggregated immediately. We retain anonymous daily counts for comparisons over time; individual event rows are never saved in the statistics store. The separate basic-statistics objection preference stays on your device until you change it or clear browser data.

6. Your rights

Depending on the purpose and lawful basis, you may have the right to access, correct, erase or restrict personal information, object to its use, or receive portable data. You can withdraw analytics and marketing consent at any time using Cookie settings. Withdrawal stops new measurement and new order-source snapshots; it does not automatically delete data already received by a provider or source fields already copied to a Shopify cart or order. Contact us with your order number to request removal of those source fields without deleting the purchase record. Where the Shopify Customer Privacy connection is configured, the updated choice is also passed to Shopify.

Email hrsnewsltd@gmail.com to make a request. You can also complain to the Information Commissioner's Office at ico.org.uk.

7. Snack Club email requests and offers

When you claim a Snack Club offer, we save your email address, the offer requested and the request time in a private Vercel store so we can handle your request. This does not subscribe you to future marketing emails.

If you separately tick the email permission box, your browser sends your email address, the signup source and permission wording directly to Klaviyo, which records your subscription and sends HRS news, gift ideas and offers, starting about once a week. Ball-drop email subscribers also receive an automated welcome email. Shopify subscribers are synced to Klaviyo with their email permissions. You can unsubscribe using the link in any marketing email or contact us. Unticked offer requests are not sent to Klaviyo as marketing subscribers. Email permission is separate from advertising cookies. The signup connection does not load Klaviyo website tracking or set advertising cookies.

The offer animation always awards the same 33% subscription saving. We do not use your email or game result to choose a different discount. A browser reminder prevents repeated automatic popups; you can reopen the offer yourself.

8. Snack Club feedback, photos and thank-you rewards

Invited customers can send an honest review, rating, optional snack preferences and up to three optional photos. We use the order reference and contact details already held to verify the invitation and record one thank-you of five free mystery snacks in the next paid Snack Club box. The reward does not depend on the rating, photos or permission to publish. Sending feedback does not subscribe anyone to marketing or create another order.

Feedback and photos are held in private Vercel storage. We remove photo location metadata. HRS uses legitimate interests to improve the service, handle feedback securely and prevent duplicate rewards, and fulfils the offered thank-you when a qualifying next box is packed. We request separate, optional consent to publish a review with the chosen display name and/or photos on hrsfood.com and HRS's own Instagram, Facebook and TikTok accounts. This does not include paid advertising. We identify incentivised reviews, preserve their meaning, and do not publish contact details, order numbers or private preferences.

Publication permission lasts up to 12 months from submission. It can be withdrawn earlier through the private invitation link or by emailing hrsnewsltd@gmail.com with the order number. Withdrawal does not remove the earned thank-you. We stop new use and remove HRS-controlled publications as soon as reasonably possible; we cannot remove copies other people independently shared. We remove unpublished feedback and original uploaded photos within 12 months, keeping only minimal consent, withdrawal and reward evidence while necessary. HRS checks publication permissions before each use and removes content when permission expires.

9. Other people's information

If you enter a recipient's name, address or gift message, provide only the information needed to deliver the order. Do not enter health information or other sensitive personal information in a gift message or packing note.

10. Changes to this notice

We will update the date and wording when our providers, purposes, lawful bases or retention practices change.