Privacy Policy
Last updated: 28 August 2026
1. Introduction
This Privacy Policy explains how Barakah Blend (“we”, “us”, “our”) collects, uses, shares and protects personal data when you visit https://barakahblend.com/ (the “Site”), place an order, create an account, leave a product review, or contact us.
We are committed to handling your personal data lawfully, fairly and transparently in accordance with the UK General Data Protection Regulation (UK GDPR), the Data Protection Act 2018, the EU General Data Protection Regulation (Regulation (EU) 2016/679), and the Privacy and Electronic Communications Regulations 2003 (PECR).
Please read this policy carefully. If you do not agree with it, please do not use the Site.
2. Who we are (Data Controller)
For the purposes of data protection law, the data controller is:
Barakah Blend [Registered company name, if different] [Registered address / trading address] [Company registration number, if applicable] Email: [privacy@barakahblend.com] Telephone: [phone number]
Note for the site owner: the fields in square brackets must be completed before publishing. Under Articles 13–14 UK/EU GDPR you are legally required to identify the controller and give a working contact point.
We have not appointed a Data Protection Officer, as we are not required to do so under Article 37 GDPR. All privacy queries should be sent to the email address above.
EU representative: If you are located in the EU/EEA and we do not have an establishment there, you may contact us using the details above. [If you sell into the EU/EEA and have no EU establishment, an Article 27 representative must be appointed and named here.]
3. The personal data we collect
3.1 Information you give us
When you place an order Name; billing address; delivery address; email address; telephone number; order contents and order history; delivery instructions; and any notes you add at checkout.
Payment information. We do not collect or store your full card number, expiry date or security code. Payments are processed directly by our payment providers (Stripe, PayPal and Amazon Pay). We receive only a confirmation of payment, the last four digits of the card, the card type and the transaction reference.
When you create an account Username, email address, password (stored in hashed, unreadable form), saved addresses, order history, wishlist contents and any preferences you set.
When you leave a product review or comment The name and email address you supply, the content of your review, your rating, any images you upload, and the IP address and browser user-agent recorded at the time of submission (WordPress records these automatically for spam prevention).
When you contact us Your name, email address, telephone number if provided, and the content of your message and any attachments.
3.2 Information we collect automatically
Technical and usage data. IP address, approximate location derived from IP, browser type and version, operating system, device type, screen size, referring website, pages viewed, time spent on pages, links clicked, and the dates and times of your visits.
Cookies and similar technologies. See section 8 below.
Security data. Our hosting provider and Cloudflare Turnstile process technical signals (including IP address and browser characteristics) to distinguish genuine visitors from automated bots and to protect the Site against abuse.
3.3 Special category data
We do not intentionally collect special category data (such as health, religious or philosophical beliefs, or biometric data). Please do not include such information in messages, reviews or order notes unless it is strictly necessary. Note that a purchase from a halal or faith-oriented retailer could, in some contexts, imply a religious belief; we do not use purchase data to infer or record any belief about you, and we do not share such inferences with third parties.
3.4 Children
The Site is not directed at children. We do not knowingly collect personal data from anyone under 16. If you believe a child has provided us with personal data, please contact us and we will delete it.
4. How and why we use your personal data
The table below sets out each purpose, the data involved, and our lawful basis under Article 6 GDPR.
| Purpose | Data used | Lawful basis |
|---|---|---|
| Processing and fulfilling your order, arranging delivery, and handling returns or refunds | Identity, contact, delivery, order and transaction data | Contract — necessary to perform our contract with you |
| Creating and administering your account | Identity, contact, account and order data | Contract |
| Taking payment and preventing fraudulent transactions | Transaction, technical data | Contract and legitimate interests (preventing fraud and financial loss) |
| Sending service messages such as order confirmations, dispatch notices and delivery updates | Identity, contact, order data | Contract |
| Responding to your enquiries and providing customer support | Identity, contact, message content | Contract or legitimate interests(responding to those who contact us) |
| Publishing product reviews on the Site | Name, review content, rating | Consent (given when you submit the review) |
| Keeping accounting, tax and VAT records | Identity, contact, transaction data | Legal obligation |
| Securing the Site, preventing spam and detecting abuse | Technical, security data | Legitimate interests (protecting our business and users) |
| Analysing how visitors use the Site, and measuring the performance of advertising | Technical, usage, cookie data | Consent (via the cookie banner) |
| Improving our products, range and website experience | Usage, order data (aggregated where possible) | Legitimate interests (developing and improving our business) |
| Establishing, exercising or defending legal claims | Any relevant data | Legitimate interests / legal obligation |
Where we rely on legitimate interests, we have carried out a balancing assessment to satisfy ourselves that our interests are not overridden by your rights and freedoms. You may ask us for details of that assessment, and you have the right to object (see section 9).
Marketing. We will only send you marketing emails where you have given us consent, or where you have bought from us before and we are offering similar products under the “soft opt-in” permitted by PECR. Every marketing email contains an unsubscribe link, and you can opt out at any time at no cost by emailing us.
5. Who we share your data with
We never sell your personal data. We share it only with the following categories of recipient, and only to the extent necessary:
Payment providers. Stripe, PayPal and Amazon Pay act as independent controllers for the payment data they collect. Their own privacy notices apply: Stripe (https://stripe.com/privacy), PayPal (https://www.paypal.com/uk/legalhub/privacy-full), Amazon Pay (https://pay.amazon.co.uk/help/201212490).
Delivery partners. Royal Mail, and any other carrier we use, receive your name, delivery address, and contact details so they can deliver your order and notify you of its progress.
Hosting and infrastructure. Hostinger hosts the Site and its database on our behalf. Cloudflare provides bot protection (Turnstile) and network security. jsDelivr and Google Fonts serve scripts and typefaces to your browser; when your browser requests these, your IP address is transmitted to those providers.
Analytics and advertising. Google Analytics 4 and the Meta (Facebook) Pixel, where you have consented to analytics and marketing cookies. These providers may use the data to measure traffic, attribute conversions, and build advertising audiences. See Google’s privacy policy (https://policies.google.com/privacy) and Meta’s (https://www.facebook.com/privacy/policy).
Professional advisers. Accountants, auditors, insurers and lawyers, where necessary.
Public authorities. HMRC, regulators, courts or law enforcement, where we are legally required to disclose.
Business transfers. If our business is sold, merged or reorganised, your data may transfer to the new owner, who will remain bound by this policy.
All processors act on our documented instructions under a written contract that meets Article 28 GDPR.
6. International transfers
Some of our providers process data outside the UK and the EEA, including in the United States. Where this happens, we ensure an appropriate safeguard is in place, which will be one of:
- an adequacy decision by the UK Government or the European Commission (including the EU–US Data Privacy Framework and its UK Extension, where the recipient is certified); or
- Standard Contractual Clauses, together with the UK International Data Transfer Addendum, supported by a transfer risk assessment.
You may request a copy of the relevant safeguard by contacting us.
7. How long we keep your data
| Data | Retention period |
|---|---|
| Order, invoice and transaction records | 6 years after the end of the financial year in which the transaction took place (UK tax and accounting requirements) |
| Account data | For as long as your account is active, then 12 months after your last activity, after which we delete or anonymise it |
| Customer service correspondence | 2 years from the date of the last message, unless it relates to a dispute |
| Product reviews | Until you ask us to remove them, or the product is delisted |
| Marketing consent records and mailing list entries | Until you withdraw consent, plus 2 years to evidence the withdrawal |
| Analytics data | Up to 14 months in Google Analytics; up to 180 days for Meta Pixel event data, subject to those providers’ settings |
| Server and security logs | Up to 12 months |
Where data is no longer needed, we delete it securely or irreversibly anonymise it so that it can no longer be linked to you.
8. Cookies and tracking
Cookies are small files placed on your device. We use four categories:
Strictly necessary. Required for the Site to function — WooCommerce shopping basket and session cookies, checkout state, login and authentication cookies, and Cloudflare Turnstile’s security token. These do not require consent, and the Site cannot work without them.
Functional. Remember choices such as your saved addresses, region or recently viewed products.
Analytics. Google Analytics 4 cookies, which tell us how many people visit, which pages they read, and where they arrive from. Set only with your consent.
Advertising. Meta Pixel cookies, which measure the effectiveness of advertising and allow us to show relevant ads on Meta platforms. Set only with your consent.
Managing cookies. You can accept or reject non-essential cookies through the banner shown on your first visit, and change your choice at any time via the cookie settings link in the Site footer. You can also block or delete cookies in your browser settings, though this may stop parts of the Site working. To opt out of Google Analytics across all sites, install Google’s browser add-on: https://tools.google.com/dlpage/gaoptout.
We do not currently respond to “Do Not Track” browser signals, as no common standard for them has been agreed.
9. Your rights
Under UK and EU GDPR you have the right to:
- be informed about how your data is used — this policy serves that purpose;
- access a copy of the personal data we hold about you;
- rectification of inaccurate or incomplete data;
- erasure of your data where there is no continuing lawful reason for us to hold it;
- restrict processing in certain circumstances, for example while we verify a dispute about accuracy;
- data portability — to receive the data you gave us in a structured, commonly used, machine-readable format, or have it sent to another controller;
- object to processing based on legitimate interests, and to object at any time to direct marketing, which we will always honour;
- withdraw consent at any time where consent is our lawful basis, without affecting the lawfulness of processing before withdrawal;
- not be subject to decisions based solely on automated processing that produce legal or similarly significant effects. We do not carry out such decision-making.
To exercise any right, email us at [privacy@barakahblend.com]. We will respond within one month, and may extend this by two further months for complex requests, telling you if we do. We may ask you to verify your identity before we act. Exercising your rights is free of charge, though we may charge a reasonable fee or refuse a request that is manifestly unfounded or excessive.
Complaints. If you are unhappy with how we have handled your data, please tell us first so we can put it right. You also have the right to complain to a supervisory authority:
- UK: Information Commissioner’s Office, Wycliffe House, Water Lane, Wilmslow, Cheshire SK9 5AF — 0303 123 1113 — https://ico.org.uk/make-a-complaint/
- EU/EEA: the data protection authority in your country of residence, place of work, or where the alleged infringement occurred. A list is available at https://edpb.europa.eu/about-edpb/about-edpb/members_en
10. Security
We take appropriate technical and organisational measures to protect your data, including encryption in transit using TLS/HTTPS, hashed password storage, bot protection through Cloudflare Turnstile, restricted administrative access on a need-to-know basis, keeping WordPress, WooCommerce, themes and plugins updated, and regular backups.
No method of transmission or storage is completely secure, so we cannot guarantee absolute security. If a personal data breach occurs that is likely to result in a risk to your rights and freedoms, we will notify the ICO within 72 hours, and will inform you directly where the risk is high.
You are responsible for keeping your account password confidential and for choosing a strong, unique password.
11. Third-party links
The Site may link to other websites, social media pages or payment providers. We are not responsible for their content or privacy practices. We encourage you to read the privacy policy of every site you visit.
12. Changes to this policy
We may update this policy from time to time to reflect changes in our practices or the law. The “Last updated” date at the top will always show the current version. Where changes are significant, we will bring them to your attention by a notice on the Site or by email. Please check back periodically.
13. Contact us
Questions, requests or complaints about this policy or your personal data:
Barakah Blend Email: [orders@barakahblend.com]