Privacy notice
Last updated 8 September 2026
This explains what we do with your personal information when you order from DASARA. We have tried to write it in plain English rather than legal boilerplate.
The short version: we collect the least we can — your name, phone number and, for delivery, your address — and we use it to cook and deliver your food. We do not sell it, and we do not share it with advertisers.
Who we are
DASARA, 163 High Town Road, Luton, LU2 0BX. Trading name of Eastern Spices. We are the data controller for the information described here.
Contact us about anything on this page: 01582 967192 or 07344 878762.
What we collect
| Information | Why we need it |
|---|---|
| Your name | So we know whose order it is |
| Mobile number | To confirm the order, send login codes, and call you if the driver cannot find you |
| Delivery address | Delivery orders only — to bring you the food |
| Email address | Optional — an alternative way to receive a login code |
| Your order and any notes | To cook it correctly, including allergy notes |
| Order history and loyalty points | To run the points scheme and let you reorder |
We do not collect or store card details. Where card payment is offered, it is handled by our payment provider and never reaches us.
Your account
Placing an order creates an account tied to your phone number. You can sign in three ways, and you choose which:
- A six-digit code sent to you each time. We hold only a one-way scrambled copy of the code, and it expires in five minutes.
- A password, if you set one. We never store the password itself — only a salted, stretched one-way hash of it, which cannot be turned back into your password.
- Your Google account. If you use this, Google tells us your name, email address and a reference number for your account. We never see your Google password.
You can order as a guest without creating an account, though you will not collect loyalty points.
Our lawful bases
- Performance of a contract — your name, number, address and order. We cannot deliver your food without them.
- Legitimate interests — keeping order records for our own accounting, resolving complaints, and preventing fraudulent or abusive orders.
- Consent — marketing messages about specials, and only if you tick the box. You can withdraw this at any time and it will not affect your ordering.
- Legal obligation — tax and accounting records we are required to keep.
Who else sees it
- Our delivery driver — your name, address and phone number, for that delivery only.
- Cloudflare, Inc., who host this website and store the order database on our behalf. Data is held in Cloudflare's UK and EU regions.
- Stripe Payments Europe, Ltd., where you pay by card. You are taken to Stripe's own page to pay; they tell us only that the payment succeeded and for how much.
- Meta Platforms (WhatsApp), if you choose to receive login codes or order updates on WhatsApp. Messaging us on WhatsApp is also subject to their own privacy policy.
- Google Ireland Ltd., only if you choose to sign in with Google.
- Our accountant, and HMRC, for the financial records we must keep.
We do not sell your information, and we do not pass it to advertisers or data brokers.
Information leaving the UK
Our suppliers above are established in the UK, Ireland or the EU, but some are part of groups that may process data in the United States for support and security purposes. Where that happens, the transfer is covered by the UK's International Data Transfer Addendum or the EU Standard Contractual Clauses, together with the UK extension to the EU–US Data Privacy Framework where the supplier is certified under it. You can ask us for details of the safeguards that apply.
How long we keep it
- Order records: six years, because tax law requires it.
- Your account and loyalty points: while your account is open, and for two years after your last order if you stop using us.
- Login codes: they expire after five minutes and are deleted within 24 hours.
- Failed sign-in attempts, kept to stop people guessing passwords: 15 minutes.
- Marketing consent: until you withdraw it.
Closing your account
Ask us — by phone, WhatsApp or email — and we will close your account and delete your name, address, email and any password within 30 days. Two things we cannot delete: the order records themselves, which tax law makes us keep for six years, and anything needed for a dispute still going on. After those six years the order records go too. Unused loyalty points are lost when an account closes.
Cookies
We use one essential cookie to keep you signed in after you enter your login code. It does not track you across other websites. We do not use advertising cookies, so there is no consent banner to click through.
Your basket is stored in your own browser, on your device, and never leaves it until you place the order.
Your rights
Under UK GDPR you can ask us to: give you a copy of what we hold; correct anything wrong; delete your information (where we are not legally required to keep it); restrict or object to how we use it; or send it to another provider. You can also withdraw marketing consent at any time.
Just call or message us and we will sort it out. We will respond within one month.
If you are unhappy with how we have handled your information, you can complain to the Information Commissioner's Office at ico.org.uk or on 0303 123 1113. We would appreciate the chance to put it right first.
Keeping it safe
The website is served over HTTPS. Login codes are stored hashed, never in plain text, and expire after five minutes. Only the owner and trained staff can see order details, and only for as long as they need to.
Children
This website is not aimed at children, and we do not knowingly create accounts for under-16s.
Changes
If we change how we use your information we will update this page and change the date at the top.
Questions about your information?
01582 967192 · 07344 878762
163 High Town Road, Luton, LU2 0BX