Privacy Policy
Last updated: September 2026 · Compliant with UK General Data Protection Regulation (UK GDPR)
1. Overview & Data Controller
Mama Africa ("we", "our", "us") operates mamaafrica.online. We are committed to protecting the privacy, confidentiality, and security of your personal information. For the purposes of the UK Data Protection Act 2018 and the UK General Data Protection Regulation (UK GDPR), Mama Africa is the data controller responsible for your personal data (located at 27a Farthing Grove, Netherfield, Milton Keynes MK6 4JH).
2. What Information We Collect
To process food orders and provide courier delivery in Milton Keynes, we collect and process the following categories of data:
- Contact & Identity Data: Full name, email address, and telephone/mobile number.
- Delivery & Location Data: Delivery street address, delivery instructions/notes, and postal code (e.g. MK1, MK5, MK6, MK7, MK9).
- Account Credentials: Hashed and salted authentication credentials managed securely via enterprise-grade cloud identity and access management systems.
- Order History & Preferences: Past orders, selected dishes, delivery window preferences, and order timestamps.
- Technical & Session Data: IP address, browser type, and functional session cookies necessary for cart persistence and authentication.
3. How & Why We Use Your Information
We only process your personal data where we have a lawful basis under UK GDPR:
- Contract Performance: To accept, prepare, verify, and dispatch food orders to your address; to communicate order updates via email and SMS/push notifications.
- Legitimate Interests: To prevent fraud, detect malicious automated activity (anti-bot verification), manage courier route assignments, and ensure cash payment safety.
- Legal Compliance: To comply with UK food hygiene regulations, tax and accounting record-keeping requirements, and health and safety obligations.
4. Third-Party Service Providers (Sub-Processors)
We never sell, rent, or trade your personal data to third parties for advertising or marketing purposes. We share data only with vetted infrastructure partners strictly necessary for delivering our service:
- Secure Cloud Infrastructure & Hosting Partners: Vetted cloud infrastructure providers operating within secure UK and European data centers for database storage, platform hosting, and automated transactional email dispatch.
- Authorized Couriers: Delivery couriers receive only the minimal operational details (recipient name, delivery address, contact phone number, and order contents) strictly necessary to fulfill your delivery.
5. Data Retention
We retain personal data only as long as necessary to fulfill the purposes for which it was collected:
- Active Accounts: Customer account profiles, contact details, and order history are retained while your account remains active so you can access your order history and manage your account.
- Deleted Accounts: When an account deletion is requested, your authentication credentials, personal contact information, and delivery details are permanently erased or anonymized immediately. Past transaction records are preserved in an anonymized ledger for up to 6 years strictly to satisfy UK statutory accounting, tax, and HMRC compliance requirements, after which they are permanently deleted.
6. Cookies & Local Storage
We utilize strictly necessary first-party cookies and browser local storage:
- Authentication Cookie: Secure HTTP-only session token to keep you logged in.
- Shopping Basket (localStorage): Retains your selected food items across page refreshes.
- We do not deploy third-party advertising, behavioural tracking, or marketing cookies.
7. Your Rights Under UK GDPR
You have the right to:
- Access: Request a copy of the personal data we hold about you.
- Rectification: Request correction of inaccurate or incomplete information.
- Erasure ("Right to be Forgotten"): Request deletion of your personal account data, subject to legal record-keeping obligations.
- Restriction & Objection: Object to or request restriction of data processing in specific circumstances.
- Data Portability: Request transfer of your data in a standard structured format.
To exercise any of these rights, please email us at info@mamaafrica.online.
8. Account Deletion & Data Erasure Procedure
If you wish to close your account and have your personal information erased from our platform, you may follow our standardized deletion procedure:
You can initiate account closure in either of two ways:
- Self-Service: Log into your account, visit your Order History & Account page, and select "Delete My Account" in the account management section.
- Email Request: Send an email from your registered account email address to info@mamaafrica.online with the subject line "Account Deletion Request".
To protect your account against unauthorized erasure, requests received via email are verified against your registered email address. Upon confirmation, active login credentials, authentication tokens, and browser sessions are immediately revoked.
Your personal profile data (full name, phone number, delivery address notes, and web push notification subscriptions) is permanently deleted or irreversibly anonymized across our operational databases within 14 to 30 days.
In accordance with UK statutory accounting, tax, and HMRC compliance rules, records of completed monetary transactions (dish items purchased, order totals, and payment methods) are retained in an anonymized archive for up to 6 years, with all personal identities and contact details permanently removed.
9. Security Measures
All communications between your device and mamaafrica.online are encrypted in transit using Transport Layer Security (TLS/HTTPS). Stored databases and operational backups are encrypted at rest using industry-standard cryptographic algorithms. Authentication sessions are digitally signed and verified using modern asymmetric cryptography. Access to production systems is strictly restricted to authorized operational personnel with multi-factor authentication.