Privacy Policy

1. Who controls your information

HRS NEWSAGENTS LTD, trading as HRS Food, is the data controller. The company number is 16764459 and the registered office is 786 Whalley New Road, Blackburn, England, BB1 9BA.

Email hrsnewsltd@gmail.com for a privacy question or to exercise a data-protection right.

2. Information we handle

Shopify and its payment providers process payment details. HRS Food does not receive your full card number.

When checkout starts, Shopify also receives the market, buyer country and any builder mode needed to process the cart. The storefront does not currently copy browser attribution into the Shopify cart or order record.

When the Shopify Customer Privacy connection is configured, an accept or decline choice is also passed to Shopify on the shared hrsfood.com domain so that hosted checkout can respect the same analytics choice. This handoff does not grant marketing consent and does not add campaign information to an order.

A basket or saved box kept in browser storage can contain product choices and personalisation entered by the user, such as a recipient name or gift message.

• •Contact, billing and delivery information supplied at Shopify checkout.
• •Order details, payment status, fulfilment records and communications about the order.
• •Recipient details and gift messages when a buyer asks us to deliver an order to somebody else.
• •Messages, photographs and other evidence sent when somebody asks for support or reports a return, damaged parcel or product problem.
• •Essential browser storage for the basket, saved box choices and the analytics-consent setting.
• •A consented attribution record containing limited UTM values, a path-only landing page, external-referrer hostname, recognised AI source and timestamps. UTM values that look like an email address or a long phone number are discarded.
• •Optional Google Analytics events and sanitised campaign-source information when the visitor accepts analytics. Shopify checkout measurement can include product identifiers, quantities, order value, currency and a transaction identifier.
• •Technical logs needed to operate and protect the website.

3. Why we use it and our lawful bases

• •Contract: to take steps requested before a purchase, process an accepted order, arrange delivery and provide order support.
• •Legal obligation: to keep required accounting records, handle statutory consumer rights and respond to lawful requests from authorities.
• •Legitimate interests: to secure the service, prevent fraud, answer general enquiries and deliver a gift to the recipient chosen by the buyer. We use only the information needed for those purposes and consider the effect on the people involved.
• •Consent: to run optional Google Analytics and store sanitised attribution for measurement. Consent can be changed using Analytics settings.

4. Who receives information

Shopify supplies the cart and checkout service and, when the Customer Privacy connection is configured, receives the visitor's analytics choice. Payment providers process payment. Vercel hosts the website. Delivery companies receive the details needed to deliver an order. Google receives optional analytics data only after consent and only when analytics is configured.

We may also disclose information to professional advisers, insurers, regulators, courts or law-enforcement bodies where it is necessary and lawful.

Some providers process information outside the United Kingdom. Where UK law requires a transfer safeguard, we use providers that rely on an adequacy regulation, approved contractual clauses or another lawful transfer mechanism. Email us if you want details about the safeguard relevant to your information.

5. How long we keep information

We review retention when a purpose ends and erase or anonymise information that we no longer need.

• •Order, payment, invoice and accounting records are kept for six years from the end of the company financial year they relate to, or longer when the law requires it.
• •Support, return and complaint records are kept while the issue is open. After it closes, we keep only what is needed for legal obligations, fraud prevention or a possible legal claim, then delete or anonymise it when that reason ends.
• •A browser basket expires after 30 days and saved boxes expire after 90 days under the periods described in the Cookie Policy, unless the visitor removes them or clears browser data sooner.
• •The analytics consent choice expires after 180 days unless the visitor changes it or clears browser data sooner. The HRS attribution record expires 90 days after its most recent recorded non-direct visit, and declining analytics removes it sooner.
• •When Google Analytics is enabled, its first-party cookies are configured by this website to expire after 90 days, although browser restrictions may shorten that period. The HRS Food Google Analytics property keeps user-level and event-level data for 14 months. This setting does not control standard aggregated reports.
• •Security and hosting logs are kept according to operational need and provider settings, then removed or anonymised when they are no longer required.

6. Your rights

Depending on the purpose and lawful basis, you may have the right to access, correct, erase or restrict personal information, object to its use, or receive portable data. You can withdraw analytics consent at any time using Analytics settings. Where the Shopify Customer Privacy connection is configured, the updated choice is also passed to Shopify.

Email hrsnewsltd@gmail.com to make a request. You can also complain to the Information Commissioner's Office at ico.org.uk.

7. Other people's information

If you enter a recipient's name, address or gift message, provide only the information needed to deliver the order. Do not enter health information or other sensitive personal information in a gift message or packing note.

8. Changes to this notice

We will update the date and wording when our providers, purposes, lawful bases or retention practices change.