Privacy notice

Last updated 3 September 2026 · version 2 — replaces the reopening-list notice of 31 July 2026.

This notice explains what personal data Hot Dough collects when you use www.hot-dough.com and the kiosk in our shop, why we collect it, how long we keep it, who else sees it, and what rights you have. We have tried to write it the way we would say it across the counter.

The short version

We only ask for what an order or the Club actually needs — no accounts for the sake of it.
Card payments go through Stripe. We never see or store your card number.
We text you about your order. Offers only come if you tick the box, and every one has an opt-out link.
No analytics, no advertising cookies, no tracking pixels — and no fonts fetched from Google. The only outside code that runs here is Stripe's secure card form, at the moment you pay.
Your data is stored in the UK. We never sell it or share it for anyone else's marketing.

Who we are

Hot Dough is the pizza shop at 250 High Street, Waltham Cross, Hertfordshire EN8 7DZ, run by Hot Dough Ltd (company no. [NUMBER]). We are the data controller for the personal data described in this notice — the people responsible for looking after it.

Privacy questions, requests and complaints: email theobalds@hot-dough.com, call 01992 747997, or ask at the counter and we will pass it on the same day.

What we collect, and why

UK data protection law says we need a reason (a "lawful basis") for everything we do with your data. Here is the whole list. The sections that follow explain each one in plain English.

What	Why	Lawful basis	How long
Your order: name, mobile number, email address (optional), what you ordered and when, and whether it has been paid for	To make your order, text you when it is ready, hand it to the right person, and send a receipt if you gave us an email	Contract — you asked us to make your order	6 years after the end of the tax year of the order (tax and accounting law)
Payment: taken by Stripe. We receive confirmation that you paid, a payment reference and the amount — never your card number	To take payment and deal with any refund	Contract; legal obligation (keeping accounts)	6 years, with the order
Order-status texts: your mobile number and order number, sent through Twilio	To tell you we have your order and when it is ready to collect. These are service messages about your order, not marketing	Contract	With the order
Hot Dough Club: mobile number (your member ID), first name, optional email, optional birthday (day and month only), your member QR code, your slices, rings and vouchers, and what you have ordered with us as a member	To run the Club — earn a slice for every pizza, give you the free one, show you "your usual", and put a treat on your account around your birthday	Contract — the Club rules	While your membership is active, then 24 months after your last activity, then anonymised
Signing in: the code we text you (we keep a scrambled copy, never the code itself), the mobile number that asked for it and the internet address (IP) it came from; a sign-in token for each device you use	To prove it is you on a new device, to stop someone else's phone bombarding your number with codes, and to remember you on this device	Contract; legitimate interests (keeping memberships secure)	Codes and IP records: 24 hours. Device sign-ins: until you sign out, or 12 months without use
Offers and news: your mobile number and/or email, which boxes you ticked, when and where you ticked them, the wording you saw, and any opt-out	To send you offers and news — only on the channels you ticked — and to be able to show what you agreed to	Consent — withdraw at any time using the link in every message, or by emailing us	We stop sending the moment you opt out. The record of what you agreed to (and of your withdrawal) is kept as evidence
Wallet pass: if you add your Club card to Apple Wallet or Google Wallet, your member QR, first name and slice count go to Apple or Google to build the pass	So your card is one tap away at the counter	Contract — you asked for the pass	On your phone until you remove it. Apple and Google handle the pass under their own privacy terms
Reopening list: your email address, if you gave it on our summer holding page	To tell you we have reopened	Consent	Deleted once we have told you we are open, or as soon as you unsubscribe

We do not use your data to make automated decisions about you, and we do not build profiles of you beyond the slices and "your usual" that the Club needs to work.

Ordering for collection

You do not need an account to order. At checkout we ask for a name (so we can call your order), a mobile number (so we can text you when it is ready) and, if you want a receipt by email, an email address. The kiosk in the shop asks only for a name to call out — and even that is optional — and you pay at the counter.

Payment is taken by Stripe, a regulated payment provider. Your card details go straight to Stripe; we never see or store your card number. Stripe tells us you have paid and gives us a reference we can use for a refund. Stripe may use its own strictly-necessary cookies to prevent fraud when you pay.

Order-status texts come from the sender "HotDough". They only ever say things about your order — we have it, it is ready — and never carry offers. The sender is one-way, so if you reply, the message does not reach us: ring us on 01992 747997 instead.

The Hot Dough Club

The Club is free and optional. Your mobile number is your membership — it is how we tell members apart and how you sign in on a new device. We also ask for your first name (so the counter can say hello), and optionally an email address and your birthday as a day and month — never the year — so we can put a treat on your account around it.

To run the Club we keep a ledger of your slices, rings and vouchers, your member QR code, and what you have ordered with us as a member, which is what lets us work out the size of your free pizza and show you "your usual". When you show your QR at the counter, the till shows our staff your first name and your slices, rings and vouchers so they can add to or redeem them.

Signing in and staying signed in

On a new phone or browser we text you a sign-in code. It expires after five minutes; we store only a scrambled (hashed) copy of it, together with the mobile number that asked and the internet address (IP) the request came from, and we delete that record after 24 hours. We use the IP address purely to limit how many codes can be requested from one place, so nobody can pester your number.

Once you are signed in, we remember you on this device with a sign-in token kept in your browser. You can see every device you are signed in on, and sign any of them out, from the Club screen. A device that has not been used for 12 months is signed out automatically.

Offers and news — only if you tick the box

When you join the Club, or at checkout, you can choose to hear from us by text, by email, or both. The boxes are separate, they start empty, and you can join the Club or order without ticking either — saying no costs you nothing.

Every marketing message carries a link to stop. One tap and you are off the list for that channel, straight away.
Our text sender "HotDough" is one-way, so "reply STOP" cannot reach us — please use the link in the message, change your choices on the Club screen, or email us.
We record when and where you ticked, and the exact wording you saw, so we can show what you agreed to. A withdrawal is recorded the same way.
Messages about rewards already on your account — a free pizza ready, a voucher about to run out — are service messages under the Club rules, not marketing.

Allergies

We do not collect allergy or dietary information online. Nothing on this site or the kiosk asks for it, and we do not record it against your order or your membership. If you have an allergy or intolerance, please tell us at the counter every time you order, so the person making your food hears it directly.

What's stored in your browser

We set no analytics, advertising or tracking cookies, and we do not use tracking pixels or social-media plug-ins. Fonts are served from our own site, so opening a page here makes no request to Google or anyone else — the one exception is the payment step, which loads Stripe's secure card form. The only things the site keeps on your device are small settings, stored in your browser's local storage, so the site works properly:

hd_guest — the name, mobile and email you typed at checkout, so you do not have to retype them next time. Kept on your device only.
hd_active_order — the order you are currently tracking, so the "your order" screen comes back if you close the tab.
hd_club_session — your Club sign-in on this device (see above).
hd_club_card — a copy of your member card, so your QR shows even with no signal in the shop.
hd_tester — used only on our own test devices; it does nothing on yours.

The site also stores a copy of its own pages and logo in your browser so it opens quickly and works offline. None of that contains your data. Clearing site data in your browser removes all of it; signing out of the Club removes your sign-in.

Who else sees it

We use a small number of service providers who process data on our behalf, under contract, and may only use it to provide their service to us:

Supabase — our database and the functions behind the site. Data is stored in London (UK region).
Vercel — hosts and serves the website.
Stripe — takes card payments.
Twilio — sends our text messages (order status, sign-in codes and, if you have opted in, offers).
Resend — sends email receipts and, if you have opted in, email offers.
Apple or Google — only if you choose to add your Club card to Apple Wallet or Google Wallet; they then hold the pass under their own terms.

Some of these companies are based outside the UK. Where data leaves the UK, the transfer is covered by the UK International Data Transfer Addendum built into their standard terms. We never sell your data and never share it for anyone else's marketing. We would only share it beyond this list if the law required us to — for example a lawful request from HMRC or the police.

How long we keep it

This is our current retention schedule. We check what we hold against it and delete or anonymise anything that has passed its period.

Orders and payment records: 6 years after the end of the tax year they belong to — tax and accounting law requires it.
Club membership: While it is active, then 24 months after your last activity. After that we anonymise it: your name, contact details and birthday are removed and the slice ledger no longer points at anyone.
Marketing consent records: Kept as evidence of what you agreed to and when — including the record of your withdrawal, if you withdraw.
Sign-in codes and IP rate-limit records: 24 hours.
Device sign-ins: Until you sign out, or 12 months without use.
Guest details kept in your browser: On your device only, until you clear them.

Your rights

Under UK data protection law you can ask us to:

give you a copy of the personal data we hold about you (access);
correct it if it is wrong (rectification);
delete it (erasure);
stop or limit what we do with it (restriction and objection);
send you or another company the data you gave us, in a usable format (portability);
withdraw consent for offers and news at any time — as easily as you gave it, and without affecting anything done before you withdrew.

Email theobalds@hot-dough.com — or ask at the counter — and we will reply within one month, free of charge. We may need to check it is really you before we send anything, which we will do using the mobile number or email already on your account.

If you ask us to delete your data we anonymise your membership straight away. We have to keep order and payment records for tax law, but once anonymised they no longer say who you are.

Complaints

If you are unhappy with how we have handled your data, please tell us first so we can put it right. You also have the right to complain to the Information Commissioner's Office (ICO): ico.org.uk/make-a-complaint, telephone 0303 123 1113, or Information Commissioner's Office, Wycliffe House, Water Lane, Wilmslow, Cheshire SK9 5AF.

Age

Anyone can order. The Hot Dough Club is for people aged 16 or over. If you are under 16 please do not join; if we learn that a member is under 16 we will close the membership and delete its details.

Keeping it safe

Everything travels over an encrypted connection. Sign-in codes are stored scrambled, card details never touch our systems, and each member of staff can only see what their job needs — the counter sees a first name and a slice ring, not your contact details. If something ever went wrong with your data we would tell you and, where the law requires it, the ICO.

Changes to this notice

If we change this notice we will update the date at the top. If the change is significant and affects you, we will tell you directly.

3 September 2026 — version 2. Expanded from the reopening email list to cover online and kiosk ordering, order-status texts, the Hot Dough Club, sign-in codes, marketing consent, browser storage and wallet passes. Fonts are now served from our own site rather than Google Fonts.
31 July 2026 — version 1. Reopening email list only.