Last updated: February 2026
Elaka Food City is committed to protecting the privacy of every individual who uses our website and mobile application. This policy sets out clearly what personal data we collect, why we collect it, and how we handle it. We operate in accordance with the UK General Data Protection Regulation (UK GDPR) and the Data Protection Act 2018.
By creating an account or placing an order with us, you acknowledge that you have read and understood this policy. We encourage you to review it periodically, as we may update it from time to time to reflect changes in our practices or applicable law.
For the purposes of data protection law, the data controller is Elaka Food City, a grocery retailer based at 42 London Road, Tooting, London, SW17 9HP, United Kingdom. We specialise in Sri Lankan and South Asian groceries, serving customers both through our physical store and via our online platform.
If you have any questions about how we handle your personal information, you can reach us at info@elakafoodcity.com.
We collect personal data that is necessary to provide you with our services. The types of data we collect depend on how you interact with us:
When you register for an account, we collect your name, email address, and phone number. If you choose to sign in using Google, we receive your name and email address from Google as part of the authentication process. We do not receive or store your Google password.
If you opt for home delivery, we collect and store the delivery address you provide. We use mapping services to calculate the distance between our store and your delivery address so that we can determine available delivery options and applicable delivery charges. This calculation is performed solely for the purpose of fulfilling your order and is not used to track your location.
Each time you place an order, we record the items purchased, quantities, prices, delivery method, payment method, and any special instructions you provide. This information is necessary for us to fulfil and manage your order.
When you pay by card, your payment details are collected and processed directly by Stripe, our third-party payment processor. We do not see, store, or have access to your full card number, expiry date, or CVV. We retain only a reference identifier that links your order to the corresponding payment transaction.
Our servers automatically collect certain technical information when you visit our website or use our app, including your IP address, browser type, device type, and operating system. This data is used to maintain the security and performance of our platform, and it is not linked to your personal account unless you are logged in.
We use the personal data we collect for the following purposes:
We do not use your data for automated decision-making or profiling that has a legal or similarly significant effect on you. We do not sell your personal data to third parties, and we do not use it for advertising or marketing purposes beyond our own service-related communications.
Under the UK GDPR, we must have a lawful basis for processing your personal data. The bases we rely on are as follows:
Performance of a contract: Most of the data we collect is necessary for us to perform our contract with you, that is, to process and deliver your orders. Without this data, we would be unable to fulfil your purchases.
Legitimate interests: We process certain data, such as technical and security data, on the basis of our legitimate interest in maintaining the security, availability, and performance of our platform. This includes fraud prevention and system monitoring.
Consent: Where we send push notifications via the mobile app, we do so on the basis of your consent, which you provide when you opt in through your device settings. You may withdraw this consent at any time.
Legal obligation: We retain certain records, such as order and transaction data, to comply with our legal obligations under applicable tax and accounting regulations.
We offer several payment methods: card payment (via Stripe), cash on delivery, and payment at our store. When you choose to pay by card, the transaction is handled entirely by Stripe, which is a PCI DSS Level 1 certified payment processor. Your card details are transmitted directly to Stripe using encrypted connections and are never stored on or accessible from our systems. For more information on how Stripe processes your data, please refer to Stripe's Privacy Policy.
If you pay by cash on delivery or at the store, no card data is collected. We record the payment method and order total for our own accounting purposes.
We share your personal data only when it is necessary to provide our services or when required by law. Specifically:
We do not sell, rent, or trade your personal data to any third party for marketing purposes. We may disclose your data if required to do so by law, regulation, or legal process, or to protect our rights, safety, or property.
We retain your order data for a period of one year from the date of purchase. This allows us to handle any queries, refunds, or disputes that may arise, and to comply with our record keeping obligations.
Your account information (name, email, phone number, and saved addresses) is retained for as long as you maintain an active account with us. If you wish to delete your account and all associated personal data, you may contact us at info@elakafoodcity.com and we will process your request within 30 days, subject to any legal obligations that require us to retain certain records.
Under the UK GDPR, you have several rights in relation to the personal data we hold about you. These are not absolute rights and may be subject to exemptions under applicable law.
Right of access: You have the right to request a copy of the personal data we hold about you. You can view much of this data directly through your account settings, including your order history, profile details, and saved addresses.
Right to rectification: If any of your personal data is inaccurate or incomplete, you can update it through your account profile or by contacting us.
Right to erasure: You may request that we delete your personal data. We will comply with such requests unless we are legally required to retain certain information.
Right to restrict processing: In certain circumstances, you may ask us to restrict how we use your data while we investigate a concern you have raised.
Right to data portability: You have the right to receive your personal data in a structured, commonly used, and machine-readable format.
Right to object: You may object to our processing of your data where we rely on legitimate interests as the legal basis.
To exercise any of these rights, please contact us at info@elakafoodcity.com. We will respond to your request within one month, as required by law. If you are not satisfied with our response, you have the right to lodge a complaint with the Information Commissioner's Office (ICO), the UK's supervisory authority for data protection. The ICO can be contacted at ico.org.uk.
We take the security of your data seriously and implement appropriate technical and organisational measures to protect it. All data transmitted between your browser or app and our servers is encrypted using TLS (Transport Layer Security). Passwords are stored using strong cryptographic hashing, meaning that even we cannot view your password in its original form.
Access to personal data within our organisation is restricted to authorised personnel who require it for the performance of their duties. Our cloud infrastructure providers maintain industry-standard security certifications and controls.
While we strive to protect your personal data, no method of transmission over the internet or electronic storage is completely secure. We cannot guarantee absolute security, but we continuously review and improve our security practices to mitigate risks.
Our service is not intended for individuals under the age of 16. We do not knowingly collect personal data from children under 16 years of age. If you are a parent or guardian and believe that your child has provided us with personal information, please contact us at info@elakafoodcity.com so that we can take appropriate steps to remove such data.
We may update this privacy policy from time to time to reflect changes in our practices, technology, legal requirements, or other factors. When we make material changes, we will update the “Last updated” date at the top of this page. We encourage you to review this policy periodically. Your continued use of our services after any changes constitutes your acceptance of the updated policy.
If you have any questions, concerns, or requests regarding this privacy policy or how we handle your personal data, please do not hesitate to get in touch: