Privacy notice
What happens to the details you give us when you order from La Bocata online. Plain English, no legal fog.
Last updated: 22 July 2026.
This page explains what we do with the details you give us when you order from La Bocata on this website. It is deliberately short. If anything on it is not clear, ask us in the shop or ring 07824 390914.
Who is responsible for your information
La Bocata, 16 Dynevor Street, Merthyr Tydfil, CF48 1AY, is the data controller for the information described on this page. That means we decide what gets collected and what happens to it.
What we collect
When you place an order on this site we ask you for:
- your name, so we know whose order it is when you walk in;
- your mobile number, so we can ring you if there is a problem with it;
- your email address, only if you choose to give one, so we can send you a copy of the order;
- the order itself: what you have picked, any options, the collection time, and anything you type into the notes box. That box sometimes carries an allergy or something you want left out, so treat it as sensitive.
Our web host also keeps a short technical record of visits, things like the page requested, the time and the browser used, so the site can be kept working and secure.
Card details
You pay by card when you order, and that payment is handled entirely by Stripe, a regulated payment provider. Your card number is typed into Stripe's own form and goes straight to Stripe. It never touches this website. La Bocata never sees your card number and never stores it. All the shop gets back is whether the payment worked and the last four digits.
Why we use it, and our lawful basis
- To take your order, make it, and hand it over. Lawful basis: performance of a contract with you.
- To contact you about that order, for example if something has run out or you are not here at your collection time. Lawful basis: performance of a contract.
- To run the shop properly. Keeping a record of orders so we can answer a question or fix a mistake, checking the ordering page is not being abused, and getting a rough sense of how busy each day is. Lawful basis: our legitimate interests in running a small food business and keeping the service reliable.
- To meet legal duties, mainly keeping accounting records. Lawful basis: legal obligation.
We do not use your details for marketing. Ordering online does not put you on a mailing list, and we do not sell, rent or swap your information with anybody.
How long we keep it
- Order records, including your name, number and notes: up to 12 months, so we can deal with a query or a refund.
- Financial records of payments: six years, because tax law requires it.
- Technical logs from the web host: a short period set by the host, usually a few weeks.
After that it is deleted.
Who else sees it
Only the people who need it to get your bocata made and paid for:
- Netlify, who host this website and pass your order to the shop.
- Stripe, who will handle card payments once online payment is switched on. Stripe is responsible for your card data in its own right and publishes its own privacy notice.
- Our email provider, which delivers the order notification into the shop's inbox.
- SH Studios, who built this website, and who may see order data while fixing a fault on it.
We will also hand information over where the law requires it, for example a valid request from an enforcement body.
Some of those providers run servers outside the UK. Where your information leaves the UK it is covered by the safeguards UK data protection law requires, such as an adequacy decision or the UK addendum to the standard contractual clauses.
Cookies, and what your browser keeps
This site sets no advertising cookies and does no cross site tracking. Your basket, and the fact that you closed the preview banner, are held in your own browser's storage on your own device. Clear your browser data and they go. If card payment is switched on, Stripe sets its own cookies on its checkout to spot fraud, and Stripe explains those on its site.
Your rights
Under UK data protection law you can ask us to:
- tell you what we hold about you, and give you a copy of it;
- correct anything that is wrong;
- delete it, where we have no reason to keep it;
- pause what we do with it while a query is sorted out;
- hand it over in a portable form, or send it on to someone else;
- stop using it where we are relying on our legitimate interests.
Ask in the shop or ring 07824 390914 and we will sort it. We answer within one month and it costs you nothing. We do not make automated decisions about you and there is no profiling.
If you are not happy
Tell us first and we will try to put it right. You also have the right to complain to the Information Commissioner's Office, the UK regulator for this, at ico.org.uk/make-a-complaint.
Changes to this notice
If we change how we handle your information we will update this page and change the date at the top of it.
Contact
La Bocata, 16 Dynevor Street, Merthyr Tydfil, CF48 1AY. 07824 390914. Open Monday to Saturday, 9am to 3.30pm. Closed Sunday. Our terms of online ordering sit alongside this notice.