Who we are
AFIKI MARKETPLACE LTD, trading as Afiki Marketplace, is the controller for the personal information used to operate Afiki’s grocery marketplace. We are registered in England and Wales under company number 16995178. Our registered office and correspondence address is 4th Floor Office, 205 Regent Street, London, England, W1B 4HB. Email privacy@afiki.store for privacy enquiries or visit help.afiki.store for order support.
This notice covers our marketplace, customer accounts, orders, delivery, vendor and driver tools, business shopping and support. Independent stores and payment providers can also act as controllers for their own sales, legal obligations and payment services. Their notices apply to that processing.
Information we use
We use the details you supply when registering, signing in, shopping or contacting us: name, email, telephone number, account and verification details, delivery and saved addresses, order instructions, basket contents, purchases, payment and refund references, reviews and correspondence. Vendor and driver accounts also provide the business, eligibility and payout information needed for their roles. Payment details entered into a payment provider’s secure service are processed by that provider. Do not put passwords, verification codes or full card numbers into support messages or order notes.
We also use information generated by the service, including IP addresses, browser and device details, session identifiers, sign-in and security events, order status changes, delivery progress, chat and notification records. Optional analytics and advertising identifiers are used only with the relevant cookie consent. If you use Google or Facebook sign-in, the sign-in provider supplies the profile and email information authorised by you; its privacy notice also applies.
Why we use information
Contract: we use information needed to create your requested account, fulfil and manage orders, take payments, arrange delivery or pickup, process refunds, administer vendor and driver services, and respond to service requests. Without necessary contact, payment or fulfilment details, we may be unable to provide the requested service.
Legal obligations: we retain necessary accounting and transaction records and respond to lawful regulatory requirements, food-safety concerns and legally required checks. We limit this processing to information relevant to the obligation.
Legitimate interests: we use proportionate information for fraud prevention, account security, investigating complaints, resolving disputes and administering the marketplace. These interests are balanced against your rights. You can object to processing based on legitimate interests.
Consent: optional analytics and advertising technologies and marketing requiring permission rely on your choice. You can withdraw consent without affecting earlier lawful processing. Browser location and notification permissions can also be changed in your device settings. Refusing optional marketing or analytics does not prevent shopping.
Location and delivery
The location you enter helps us find stores and check delivery coverage. Postcode searches can send the entered postcode to postcodes.io. Address suggestions use Google Maps and can send the search text and selected address to Google. See policies.google.com/privacy for Google’s privacy information.
If you choose current location, your browser requests permission before sharing coordinates. You can enter a location manually instead. Selected town and rounded location cookies can last up to one year and can be changed through the location controls or removed in your browser.
Delivery functions use an assigned driver’s reported location to support dispatch and show delivery progress. The assigned customer and authorised operations staff can see relevant tracking information. Do not include unnecessary sensitive information in delivery instructions. Contact privacy@afiki.store to ask about location records associated with your delivery.
Who receives information
The fulfilling store receives the information needed to prepare and manage its order. The assigned delivery partner receives the address, contact and order information needed for delivery. Stores must not use fulfilment details for unrelated marketing without a separate lawful basis. Where Afiki sells goods through its own store, Afiki also acts as the seller.
Brevo provides email delivery and the email-list service used by signup forms. It receives the contact details, message content and subscription choices needed for those services. See www.brevo.com/legal/privacypolicy/.
Twilio provides SMS messaging, including enabled verification and service notifications. It receives the destination telephone number, message and delivery information needed to send the message. See www.twilio.com/en-us/legal/privacy.
Stripe processes card payments and connected-account payouts. Payment, fraud-prevention and onboarding information is handled under Stripe’s applicable terms and privacy notice: stripe.com/gb/privacy. Afiki receives the payment status and references needed to administer orders, refunds and payouts.
Vercel provides website hosting and Supabase provides database and authentication infrastructure. Our primary Supabase project is hosted in London, United Kingdom (eu-west-2). These services process the application records and technical information required to operate Afiki. See vercel.com/legal/privacy-policy and supabase.com/privacy. Support enquiries submitted at help.afiki.store are used to investigate and resolve your request.
Where enabled and consented to, Google, Meta and TikTok tracking technologies receive permitted browsing and shopping events for analytics or advertising. A vendor’s enabled tracking tags may receive events on that vendor’s pages. The Cookies page explains your controls. We may also disclose necessary information to professional advisers, authorities where legally required, or parties involved in a lawful business transfer with appropriate protections.
Marketing and public content
Order, payment, account security and delivery notifications are service messages. Marketing subscriptions are separate. Unsubscribe using the message link or contact support; marketing objections can be made at any time. Changing cookie consent does not automatically cancel an email subscription, and unsubscribing from marketing does not stop essential order messages.
Reviews can display the author name shown by the review interface and the submitted review. Do not include private addresses, telephone numbers or other people’s personal information in public content. Contact support to report content or request help with a review.
Cookies and your choices
Necessary storage supports sign-in, security, basket functions, requested location selection and consent records. Optional analytics and advertising remain off until the relevant consent is given. Afiki remembers a consent choice, including rejection, for 30 days in the current browser. Clearing storage, using a different browser or expiry can show the banner again. Use Cookie settings in the footer to change your choice. Individual third-party cookies can have different lifetimes; see the Cookies page.
How long information is needed
We determine retention by the purpose of each record, account activity, unresolved orders or disputes, legal requirements and the need to demonstrate permissions or protect against abuse. Account and saved-address information is needed while you use the account; following closure or a deletion request, only information still needed for a lawful purpose should remain.
Accounting records, including necessary order, payment, refund and payout records, generally need to be kept for six years from the end of the company financial year to which they relate. A longer period can apply where required by law, an investigation or a continuing dispute. This does not mean every saved address, message or location record needs to be kept for that period.
Support correspondence and order chat are assessed against whether the enquiry, refund, complaint or dispute remains open and any continuing evidential need. Security logs are assessed against incident investigation and proportionate fraud prevention. Driver location and onboarding evidence are assessed against fulfilment, eligibility verification and any related claim; they are not kept simply because they might be useful indefinitely.
Marketing permissions and a minimal suppression record may be needed to demonstrate your choices and prevent unwanted contact after unsubscribe. Reviews remain associated with the relevant listing unless removed or anonymised where appropriate. Backup copies follow the relevant backup lifecycle and may remain temporarily after a live record is removed. A deletion request does not remove records that must lawfully be retained. Contact privacy@afiki.store for the retention criteria applying to a particular record.
Processing outside the UK
Our infrastructure and communications providers operate internationally. Processing and support access can involve locations outside the UK; this notice does not represent all information as UK-hosted. Applicable transfer protections depend on the provider, service region and receiving entity. UK data protection law requires a valid transfer basis, such as applicable adequacy regulations or approved contractual safeguards, where relevant. Contact privacy@afiki.store for information about the destinations and safeguards applying to your information and how to obtain a copy of relevant safeguards.
Business accounts and automated tools
If you shop using an organisation’s account or allowance, the organisation can receive the administration, allowance, invoice and order information needed for that programme. This does not give it unrestricted access to unrelated private shopping.
Recommendations, store coverage, recipe matching and dispatch use product, location and order information to suggest options and coordinate service. Recommendations are suggestions; check prices, ingredients, allergens and availability yourself. Contact support if an automated check prevents access or you want a decision reviewed. Do not submit sensitive health information to recipe tools or ordinary delivery notes.
Security and your rights
We use access controls and authentication to protect marketplace information. No online service can guarantee absolute security. Report suspected account compromise promptly through the help centre and use the secure account controls to change your credentials.
Subject to applicable conditions, you may request access, correction, erasure, restriction or portability of your information; object to legitimate-interest processing; and withdraw consent. You have the right to object to direct marketing at any time. Some requests are limited by legal record-keeping duties or the rights of others.
Send requests to privacy@afiki.store or our correspondence address. We may ask for proportionate identity verification. Requests are normally answered within one month; permitted extensions, fees or refusals will be explained where applicable. You can complain to the Information Commissioner’s Office at ico.org.uk/make-a-complaint/ without first completing our support process.
Children and updates
Shopping requires legal capacity to enter the purchase contract or a parent or guardian placing the order. Age-restricted goods have separate identification and age requirements. Contact privacy@afiki.store if you believe a child’s information has been provided inappropriately so we can investigate.
We update this notice when our processing changes. Material changes will be communicated where required; revised wording does not create retrospective consent. Contact privacy@afiki.store with questions about this notice.