Privacy Policy

1. Who we are

This site is operated by Tippy's Thai ("we", "us", "our"), of 71-75 Shelton Street, Covent Garden, London, WC2H 9JQ, United Kingdom. For the purposes of UK data protection law, Tippy's Thai is the data controller for the personal data described in this policy.

Questions about this policy, or requests relating to your personal data, can be sent to hello@tippysthai.co.uk.

2. What we collect

We collect personal data in a few different ways:

• When you place an order — name, delivery address, email address, phone number, and order details. Checkout and payment are handled entirely by Shopify, our e-commerce platform; we do not see or store your card details ourselves.
• When you create an account — your name, email address, and order history, stored by Shopify on our behalf.
• When you sign up to our newsletter or an on-site pop-up — your email address, which is passed to Klaviyo, our email marketing platform.
• When you contact us — by email, or through a booking/enquiry form (for example on our Weddings & Events page) — whatever details you choose to share with us in that message.
• When you browse the site — the contents of your shopping cart, stored in your browser's local storage so it persists between visits. This stays on your device and is not personal data we hold on our own servers.

3. How we use it

• To take, fulfil, and deliver your order, including passing your delivery details to DPD, our courier partner.
• To manage your account and respond to customer service enquiries.
• To send you order confirmations and delivery updates.
• To send you marketing emails, product updates, and offers — only if you've opted in, and you can unsubscribe at any time.
• To respond to enquiries sent through our contact or booking forms.
• To keep the site secure and working properly.

4. Our legal basis

Under UK GDPR, we rely on:

• Contract — to process your order, take payment, and arrange delivery.
• Consent — for marketing emails and newsletter sign-ups, which you can withdraw at any time.
• Legitimate interests — for keeping the site secure, preventing fraud, and improving our service.

5. Who we share your data with

We don't sell your personal data. We share it only with the following, so they can help us run the business:

• Shopify — our e-commerce platform, which processes your order, account, and payment information.
• DPD — our delivery courier, who receives the name, address, and contact details needed to deliver your order.
• Klaviyo — our email marketing platform, which holds the email addresses of newsletter subscribers.
• Law enforcement or regulators, where we're legally required to.

Some of these providers may process data on servers outside the UK, including in the United States. Where that happens, they do so under safeguards recognised by UK law, such as Standard Contractual Clauses.

6. Cookies & local storage

We use your browser's local storage to remember the contents of your shopping cart between visits — this data stays on your device. Shopify's checkout and Klaviyo's email tools may also set their own cookies to keep you signed in, remember your cart at checkout, or measure how their pop-ups and emails perform; you can control or clear cookies at any time through your browser settings.

We don't currently run Google Ads conversion tracking, Google Analytics, or Meta/Facebook pixel tracking on this site. If that changes, we'll update this section to say so.

7. How long we keep it

We keep order and account data for as long as needed to fulfil orders, meet our accounting and tax obligations, and handle any related queries or disputes — typically up to 6 years after your last order, in line with UK record-keeping requirements. Newsletter email addresses are kept until you unsubscribe.

8. Your rights

Under UK GDPR, you have the right to:

• Ask us what personal data we hold about you, and get a copy of it.
• Ask us to correct inaccurate data.
• Ask us to delete your data, where we're not required to keep it.
• Object to, or ask us to restrict, certain kinds of processing.
• Withdraw consent to marketing at any time.
• Ask for your data in a portable format.

To exercise any of these, email hello@tippysthai.co.uk. If you're not happy with how we've handled your data, you can also complain to the UK's Information Commissioner's Office (ICO) at ico.org.uk.

9. Children

Our site and products are intended for adults. We don't knowingly collect personal data from children.

10. Changes to this policy

We may update this policy from time to time — for example, if we start using new tools like ad conversion tracking. We'll update the effective date above when we do.