Scope and controller
This review draft explains personal data processing associated with Afiki’s grocery marketplace, customer accounts, ordering, delivery, seller and driver tools, business orders and support. It covers the website and app, but does not automatically cover independent sites linked from Afiki. The controller for Afiki’s marketplace processing is AFIKI MARKETPLACE LTD, trading as Afiki Marketplace, registered in England and Wales under number 16995178. Our registered office and correspondence address is 4th Floor Office, 205 Regent Street, London, England, W1B 4HB. Contact privacy@afiki.store for privacy questions and requests, or use help.afiki.store. Any appointed data protection officer or representative must be identified here if applicable.
Stores, payment services, delivery partners and business organisations may be separate controllers for some activities. Their roles, identities and privacy notices must be confirmed and made available where relevant. Describing a party as a vendor does not by itself establish its data protection role.
Information you provide
Account information can include name, email address, phone number, sign-in details and verification status. Order information includes products, quantities, prices, discounts, selected payment method, order references, delivery address, instructions and contact details. Customer account tools can also hold saved addresses, favourites, wallet transactions, points, reviews and recurring-order preferences. Payment providers process payment credentials through their own services; the precise details retained by Afiki must be verified before publication.
Support may receive messages, attachments, order references and correspondence history. Seller and driver onboarding may involve contact and business details, payout information and eligibility documents. Identify exactly which documents are required and how they are handled in the relevant onboarding notice. Do not send passwords, verification codes or full card numbers in messages. Avoid placing health information or other sensitive details in delivery notes; a separate lawful process is required if such information is necessary.
Information generated by use
The service may generate session identifiers, security logs, device and browser details, IP addresses, account access records, order status changes and notification delivery records. Reviews and order chat may be retained with the relevant activity. The browser can store location preferences and install or prompt preferences. Optional analytics or advertising identifiers are used only after the relevant consent choice, through enabled tags. The actual hosting logs, log retention and monitoring services require confirmation.
Location and delivery tracking
If you enter a postcode or town, Afiki uses it to find suitable stores and delivery coverage. A postcode lookup can send the entered postcode to postcodes.io. If you choose “Use my current location”, your browser asks for location permission; you can decline and enter a postcode instead. The site stores a selected town and, where supplied, rounded coordinates in location cookies for up to one year. You can change the delivery location through the location controls or remove those cookies in your browser.
Drivers may share location while using delivery functions so dispatch and delivery tracking can operate. A customer following an order may see the assigned driver’s location and progress. Driver notices must confirm when location collection starts and stops, who can see it, background collection if any, and the location history retention. Do not assume browser permission alone establishes the lawful basis for all subsequent processing.
Purposes and lawful bases
Contract: information necessary to create and manage the requested account, fulfil orders, arrange delivery, take payments, apply requested allowances, operate chosen repeat plans and respond to service requests. Information needed to enter a contract can also be processed for pre-contract steps you request. Failure to provide necessary order or payment information can prevent fulfilment; optional analytics information is not required to shop.
Legal obligation: records or checks required by tax, accounting, food safety, age-restriction or other applicable law. Afiki must identify the actual obligation and the data needed; this does not authorise collecting every possible identity document.
Legitimate interests: proportionate fraud prevention, platform security, complaint investigation and service administration where those interests do not override your rights. Document the balancing assessment and explain the actual interests. You can object to processing based on legitimate interests, subject to the applicable legal conditions.
Consent: optional analytics and advertising storage, and marketing activities requiring permission. Consent can be withdrawn as easily as it is given. Location device permission and push permission are distinct controls; the processing basis for the underlying service still needs to be identified. If special-category data is intentionally collected, identify both an Article 6 basis and a valid special-category condition, with an appropriate notice, before doing so.
Sharing with stores and delivery partners
Vendors sell directly to customers and receive and process their orders. Afiki arranges all deliveries at launch. The fulfilling vendor receives the relevant order details and the assigned delivery partner receives the delivery address, necessary instructions, contact information and other details needed to deliver safely. Access should be limited to each role’s needs. If vendor-operated delivery is introduced, the responsible provider will be identified before ordering and receive the necessary delivery details. Public reviews may display the review text and the author information shown by the review interface; avoid disclosing private contact information. Vendors must not repurpose fulfilment information for unrelated marketing without an appropriate basis and notice. The controller or processor roles for vendors and delivery partners must be checked against their actual activities and contracts.
Service providers and enabled integrations
The code supports payment services such as Stripe and PayPal, authentication and storage integrations, email and SMS services, maps, push notifications, optional Google tags and Meta pixels, and a separate help centre. Support for an integration does not mean it is enabled. Before publication, Afiki must list the actual providers, purposes, controller or processor roles, relevant countries, privacy links and safeguards. The help centre provider and its ticket retention are not yet confirmed.
Service providers should process data under appropriate contractual terms and security arrangements. Relevant information may also be shared with professional advisers or authorities where necessary and lawful. A business transfer must preserve applicable protections and provide appropriate notice. This draft does not assert that Afiki sells or does not sell data without checking the actual commercial arrangements.
Business accounts and allowances
An organisation administering a business account may need member details, allowance use, invoices and order information for the programme. Confirm exactly what the organisation can see and explain it before a member orders. Do not assume an employer can see all private shopping history. Separate organisation notices and agreements may apply to their own processing.
Cookies and similar storage
Necessary storage supports sign-in, account security, requested location selection, consent records and essential site functions. Optional analytics and advertising tags remain off until the matching choice is made. Afiki remembers the consent choice for 30 days in the current browser, including a rejection. Clearing cookies, using another browser or device, or expiry can cause the banner to appear again. Visit the Cookies page and use “Cookie settings” in the footer to review or change the choice at any time.
Where enabled and permitted, store-specific Google or Meta tags can join marketplace tags on the relevant store pages and receive allowed browsing or shopping events. General Google or Tag Manager containers are gated on both optional categories because they can contain advertising. Precise third-party cookie names, lifetimes and purposes must be verified against the tags actually enabled; a consent record’s 30-day lifetime is not the lifetime of every third-party cookie.
Marketing and notifications
Essential order, payment, account security and delivery messages serve the requested service and are distinct from promotional messages. Marketing email, SMS and push rules must be confirmed against actual opt-in and unsubscribe flows. Where a lawful existing-customer exception is used, its conditions and opt-out opportunities must be met. Provide a way to stop marketing without disabling essential account access. You can also change browser or device push permissions. Revoking cookie consent does not automatically unsubscribe you from separately chosen email marketing.
Retention and deletion
Retention periods are not yet confirmed. Before publication, complete a retention schedule for account records; orders, invoices and payment or refund references; support tickets and attachments; security logs; driver location history; onboarding and identity evidence; chat and reviews; marketing permissions; and backups. State a period or clear criteria for each category and identify relevant legal record-keeping obligations. Do not promise immediate deletion of all copies when tax, dispute or security records must lawfully be retained.
Keep information only as long as necessary for its purpose, applicable legal duties and proportionate handling of disputes. Deletion or anonymisation, restricted archival access and backup expiry must be supported by actual procedures. The browser consent record expires after 30 days; requested location cookies currently last up to one year. Other retention periods cannot be inferred from those cookie lifetimes.
International transfers
Hosting regions, support access locations and enabled service provider countries must be confirmed. If personal data is transferred outside the UK, identify the destination and applicable mechanism, such as adequacy regulations or approved contractual safeguards and necessary assessments. Explain how a person can obtain information about the safeguards. A provider’s name or a selectable storage region does not establish where every copy or support access is located.
Security
Afiki should use appropriate technical and organisational controls, such as access restrictions, secure authentication, protection of credentials and provider due diligence. Verify operational measures before making specific assurances. No service can promise absolute security. Report suspected account compromise through the help centre and change credentials using the secure account process. Sensitive payout and identity documents require particular access and retention controls.
Your rights and requests
Depending on the processing and applicable conditions, you can request access and a copy, correction, erasure, restriction or portability; object to processing; and withdraw consent. The right to object to direct marketing applies at any time. Withdrawal does not undo lawful processing before withdrawal. Some rights have exceptions, including necessary legal records. Explain any refusal or limitation and available complaint routes.
Submit a privacy request to privacy@afiki.store, through help.afiki.store or by post to our correspondence address, stating the request without including unnecessary sensitive information. Afiki may ask for proportionate identity verification to protect your data. Requests are normally answered within one month, with a lawful extension for complex or multiple requests where appropriate and notice is provided. Requests are normally free; permitted exceptions must be explained. The internal handling and escalation procedure must support these rights.
You can complain to the UK Information Commissioner’s Office at ico.org.uk/make-a-complaint/. You do not have to complete Afiki’s complaint process before contacting the regulator. Other competent regulators or legal remedies may be available depending on where you live.
Automated decisions and children
Store coverage, recommendations, dispatch and fraud checks may use automated logic. Confirm whether any process makes solely automated decisions with a legal or similarly significant effect, what data and logic it uses, and the required safeguards and human review route. Do not describe ordinary sorting as a legally significant decision, or assert that no such decisions occur without verification.
The platform’s minimum account age and treatment of children’s data must be confirmed. Age-restricted product rules are separate. If Afiki becomes aware of inappropriate collection involving a child, it should assess and act under the applicable rules. Do not assume a purchase restriction is a complete children’s privacy policy.
Updates and contact
Publish the final effective date when the remaining details are confirmed and retain prior versions. Explain material changes before new uses where required; updated wording is not retrospective consent. The provider inventory, retention schedule, international transfer details and operational processing policies still need confirmation before this draft becomes a final privacy notice. Contact privacy@afiki.store for privacy matters and help.afiki.store for order support.