Your data, plainly.
What Wrap & Roll collects when you order, who else touches it, and what you can ask us to do about it.
version 1.0 — last updated 25 August 2026
Wrap & Roll is the data controller
When you order food on this site, Wrap & Roll decides what is collected and why. That makes Wrap & Roll the data controller for your personal data under the UK GDPR, and the business to contact first about anything on this page.
This site is built and hosted for Wrap & Roll by Declan Morton, trading as CustomerCloud — a sole trader, so there is no limited company and no registered office. CustomerCloud is Wrap & Roll's data processor: it holds and handles your data only to run this site, on Wrap & Roll's instructions and under a written agreement. It does not use your data for its own purposes, and it does not sell it.
22 Greenknowe Street
Wishaw
ML2 0QT
When you place an order
Every field below exists in the order record or in a live code path. Nothing here is aspirational, and nothing is collected that is not listed.
Your name
So we know whose order it is and can hand it over.
Email address
Your order confirmation and receipt are sent here.
Phone number
So we can reach you about your order — a missing item, a delivery that cannot find you.
Delivery address and postcode
Delivery orders only. The postcode is also checked against our delivery zones to work out the charge.
Delivery instructions
Delivery orders only. Free text — see the box below.
Special instructions
Free text you type at checkout — see the box below.
What you ordered
The items, options and quantities, and the totals.
Order number and times
Your order number, when you placed it, and your pickup or delivery time.
Payment status
Whether payment succeeded, and the Stripe references for it. No card details.
You do not need an account to order. If you do create one, we also hold your password as a bcrypt hash (never the password itself), any addresses you save, your order history and any saved favourite orders.
The special instructions box, and what happens to what you type
At checkout there is a free-text box headed Special Instructions, with the prompt “Any allergies or special requests? (optional)”. It holds up to 500 characters. You should know exactly where that text goes, because it goes further than most people would assume.
- It is stored on your order record in our database, in the same way as your name and address.
- It is shown to our staff on the kitchen order board, and to the driver on a delivery.
- It is copied into your confirmation email and into the new-order email sent to the shop. Those emails are delivered by Resend, our email supplier.
- It is copied into the payment session held by Stripe as order metadata, so Stripe holds a copy of it too.
- It is not encrypted separately from the rest of your order, and it is not hidden from anyone who can see the order.
If you type an allergy, an intolerance, a medical condition or anything else about your health into that box, that is health information. Health information is special category data under Article 9 of the UK GDPR — it needs a higher standard of protection than an ordinary notes field gives it. We are telling you this rather than burying it: the box is a general-purpose operational field, and it is handled like one.
If you have a food allergy or intolerance, the safest thing is to speak to us directly on 01698 000000 before you order. You get an answer from a person who knows what is in the food, and you do not have to put health information into a text box to get it.
If you have already used the box and would rather it were not held, ask us to erase it — our erasure process clears this field along with the rest of your details. See your rights below.
What leaves your browser, and where it goes
Three things send data outside this site while you are using it. None of them is advertising or analytics — this site runs no analytics, no tag manager and no advertising pixels of any kind.
Address autocomplete
On a delivery order, once you have typed four characters the address you are typing is sent to nominatim.openstreetmap.org — run by the OpenStreetMap Foundation — to fetch suggestions. It sees what you typed and your IP address. Requests are delayed 400ms so it is not sent on every keystroke.
Payment
Paying takes you to a checkout page hosted by Stripe. Your card details are entered on Stripe’s own page and never reach this site or our systems. Stripe receives your name, email, phone, order number, delivery address and the special-instructions text as payment metadata, and is its own controller for fraud prevention.
Delivery routing
On a delivery, our driver opens a Google Maps directions link built from your delivery address. Opening it discloses that address to Google. This happens on the driver’s device, not yours.
Behind the site, Railway hosts the application and the database, and Resend sends the order emails. Recipient email addresses are deliberately not written into our server logs.
We do not sell your data and we do not share it for anyone else's marketing.
Why we are allowed to hold it
Taking and fulfilling your order
Contract — Article 6(1)(b). We cannot make and hand over your food without it.
Keeping financial and tax records
Legal obligation — Article 6(1)(c).
Security, rate limiting, fraud prevention, server logs
Legitimate interests — Article 6(1)(f): running a service that is not abused.
Marketing
Consent — Article 6(1)(a), plus PECR. See below.
On marketing, being exact: this website does not ask you for marketing consent anywhere, and the marketing flag on a customer record is off by default. It can only be switched on by Wrap & Roll from the staff dashboard. If you are ever marked as opted in without having agreed to it, that is a mistake — tell us and we will switch it off.
Data leaving the UK
Several of the suppliers above are US companies. Where your data leaves the UK we rely on the UK International Data Transfer Addendum to the EU Standard Contractual Clauses, or on the supplier's own UK-approved transfer mechanism.
Being straight with you: a per-supplier transfer risk assessment has not yet been completed, and the physical region our hosting provider stores the database in has not been confirmed in writing. That work is outstanding. We would rather say so than imply a check that has not happened.
How long we keep it
Your order and customer record
Kept while you are a customer of ours, and afterwards as part of our order history — see the honesty note below.
Financial and payment records
Six years from the end of the accounting period, because HMRC requires it. These survive an erasure request.
Server logs
Short-lived operational logs. Recipient email addresses are kept out of them.
If this shop closes its account
The site is suspended, the data is kept untouched for 30 days, and after that the site and its database are permanently deleted.
The honest version: we have a working erasure mechanism and we use it on request, but there is no automatic time-based deletion — nothing on this site currently deletes itself on a schedule. Building that is on our list. Until it exists, the way your data goes is by you asking, and we would rather tell you that than imply a tidy retention clock that is not running.
What you can ask for
You can ask us to:
- give you a copy of your data (access);
- correct anything that is wrong (rectification);
- delete it (erasure), except records we must keep by law, such as payment records;
- restrict or object to what we do with it, including objecting to marketing, which we will always honour;
- give you a portable copy in a machine-readable format;
- and to have a human review any decision made purely by automated means — we do not make any.
What erasure actually does here, because a vague promise is worth less than a precise one: your customer record is deleted, and on every order you have placed your name is replaced with “Erased” and your phone, email, delivery address, postcode, delivery instructions and special instructions are cleared. The order lines and totals remain, with nothing personal attached, because they are part of the shop's accounts.
Ask Wrap & Roll at hello@wrapandroll.com, or on 01698 000000. We will respond within one month. If you cannot reach us, email hello@customercloud.cc and CustomerCloud will pass your request on and help us answer it — but the decision is ours, not theirs.
What is actually in place
- Passwords stored as bcrypt hashes, never in readable form.
- All traffic over HTTPS, with HSTS and standard security headers.
- Rate limiting on public forms, checkout and the staff login.
- Card details never touch this site — the payment page is Stripe's.
- Stripe webhook signatures verified on every event, so a forged “payment succeeded” is rejected.
- An independent security review of this codebase was carried out on 25 August 2026 and its findings were remediated. A further external audit is commissioned.
Deliberately not claimed, because none of it is true today: ISO 27001, Cyber Essentials, penetration testing, or encryption at rest beyond what the hosting provider does by default.
Cookies and what is stored on your device
This site sets no cookies at all, and runs no analytics or tracking. A few things are kept in your browser's local storage to make ordering work — your basket, and your sign-in token if you have an account. The detail is on the cookie policy.
If you are not happy with our answer
Tell us first — we would rather fix it. If you are still not satisfied you can complain to the Information Commissioner's Office: ico.org.uk, 0303 123 1113.
We will post any change to this notice here. See also our terms.