Privacy policy.

We may collect the following categories of personal data:

• Identity and contact data: your name, billing and delivery addresses, email address and telephone number.
• Account and order data: account details, products ordered, order history, selected delivery date, delivery instructions, Regular Order preferences, discounts used and customer-service records.
• Payment and transaction data: payment status, transaction references, refunds and limited payment-related information supplied by our payment provider. We do not intentionally store full payment-card details on our own servers.
• Technical and usage data: IP address, device and browser information, login data, website activity and cookie identifiers, subject to your cookie choices.
• Communications and preferences: messages sent to us, complaints, survey responses, reviews and marketing preferences.
• Proof of delivery: a photograph taken by our driver at the point of delivery, showing where your order was left. We use it only to confirm that a delivery was made and to answer any query about it. It is stored privately, is visible only to our team, and is deleted automatically after 30 days. You can ask us to delete it sooner.

We normally collect personal data directly from you, automatically through the website, or from service providers involved in payment, website operation and delivery.

We use personal data only where we have a lawful basis. Depending on the purpose, we rely on:

• Contract: to create and administer your account, process payment, accept and fulfil orders, arrange delivery, manage Regular Orders, provide customer support and issue refunds.
• Legal obligation: to meet tax, accounting, food-safety, product-recall and regulatory requirements.
• Legitimate interests: to operate and secure the business, prevent misuse and fraud, manage delivery operations, improve our service, understand performance and establish or defend legal claims, where those interests are not overridden by your rights.
• Consent: for non-essential cookies and electronic marketing where consent is required. You may withdraw consent at any time without affecting earlier lawful processing.

We do not use personal data for solely automated decision-making that produces legal or similarly significant effects on you.

We send email or SMS marketing only where you have actively opted in or where another lawful permission applies. Marketing consent is separate from acceptance of our Terms and Conditions. You can unsubscribe at any time by using the unsubscribe link in a message, changing your account preferences or contacting us. We may retain a minimal suppression record to make sure we continue to respect your opt-out.

We share personal data only where reasonably necessary with the following categories of recipient:

• Payment providers, including Stripe. Depending on the processing activity, a payment provider may act as our processor or as an independent controller for its own legal, fraud-prevention and compliance purposes.
• Website hosting, cloud, security, customer-support, email, SMS and IT service providers.
• Delivery-routing tools, drivers and logistics personnel who need information to complete your delivery.
• Butcher, fulfilment or supplier partners where limited order information is necessary to prepare, verify or resolve an order.
• Analytics and advertising providers, but only where the relevant non-essential cookies or technologies have been permitted.
• Google, through the Google Customer Reviews programme. Where you have accepted non-essential cookies, our order-confirmation page loads Google's review opt-in module, which receives your device connection data and your order number, email address, delivery country and estimated delivery date so that it can offer you a review survey. Google may process this data outside the United Kingdom, including in the United States. If you decline non-essential cookies, the module is not loaded and nothing is shared for this purpose.
• Professional advisers, insurers, banks, auditors, accountants, law-enforcement bodies, courts and regulators where required or reasonably necessary.

We do not sell your personal data. Where a supplier acts as our processor, we require appropriate contractual and security protections.

Some service providers may process personal data outside the United Kingdom. Where this happens, we use a lawful transfer mechanism, such as UK adequacy regulations, the UK International Data Transfer Agreement, the UK Addendum to approved standard contractual clauses, or another safeguard permitted by data-protection law.

We keep personal data only for as long as reasonably necessary for the purpose for which it was collected, including legal, accounting, food-safety and dispute-resolution requirements. Typical periods are:

• Order, payment, invoice and transaction records: generally up to six years after the end of the relevant financial year.
• Account data: while the account remains active and for a reasonable period after closure, after which it is deleted or anonymised unless retention is required.
• Customer-service and complaint records: normally up to two years after the matter is closed, or longer where needed for a legal claim, product-safety matter or regulatory obligation.
• Marketing records: until consent is withdrawn or you object, with a limited suppression record retained where necessary to honour the opt-out.
• Cookie and analytics data: for the periods shown in the live Cookie Settings panel.

Subject to applicable law and any relevant exemption, you may have the right to request access to your personal data, correction, erasure, restriction, portability, and to object to processing. You may withdraw consent at any time. To exercise a right, contact info@co-bridge.co.uk. We may need to verify your identity before acting on a request.

You also have the right to complain to the Information Commissioner's Office (ICO). Information about making a complaint is available at ico.org.uk. We would appreciate the opportunity to address your concern first.

We use appropriate technical and organisational measures designed to protect personal data against unauthorised access, loss, misuse or disclosure. No online system is completely secure, but we review and improve our safeguards as appropriate.

Our ordering service is intended for adults. We do not knowingly allow anyone under 18 to create an account or place an order. If you believe a child has provided personal data to us, please contact us.

We may update this policy to reflect changes in law, technology or our service. The current version and its last-updated date will always be available on the website.