Privacy Policy

The Royal Chilli ("we", "us", "our") operates a restaurant, online ordering and table booking service from 43 Kingsley Road, Hounslow TW3 1PA. This policy explains what personal data we collect through our website, app and in-restaurant systems, why we collect it, and what rights you have over it.

Account details: your name, email address, mobile number and a securely hashed password if you create an account.

Order and booking details: items ordered, delivery or collection address, table reservation date/time/party size, and any special requests or allergy notes you add.

Loyalty data: points balance and reward redemptions if you're a member of our loyalty programme.

Marketing preferences: whether you've opted in to receive offers and updates by email — off by default, and you choose this explicitly.

Payment information: we never see or store your full card details. Payments are processed directly by Stripe, our payment provider — see "Payment processing" below.

Technical data: standard web server logs (IP address, browser type, pages visited) generated automatically by hosting and security infrastructure.

To take and fulfil your orders and table reservations, and to contact you about them (e.g. order confirmations, booking reminders).

To run your account, including loyalty points and order history.

To send you offers, news and updates by email — only if you've opted in, and you can withdraw this consent at any time.

To keep our systems secure, prevent fraud, and meet our legal and accounting obligations.

We do not sell your personal data, and we do not use third-party advertising or analytics tracking on this website.

This site uses only what's strictly necessary to work: a session cookie that keeps you logged in to your account, and a local browser setting that remembers your cookie-banner choice. We don't currently use analytics or advertising cookies.

Card payments, both online and at the till, are processed by Stripe, a PCI-DSS compliant payment provider. Your card details are sent directly to Stripe and never pass through or get stored on our own systems. See Stripe's own privacy policy at stripe.com/privacy for how they handle payment data.

Stripe, to process payments.

Our database and hosting providers (Supabase and Vercel), who store and run the systems this site and app run on, under their own data-processing agreements.

We don't share your personal data with any other third party for their own marketing purposes.

We keep account and order data for as long as your account is active, and for a period afterwards where we're legally required to (for example, transaction records for tax purposes are typically kept for 6 years). You can ask us to delete your account and personal data at any time — see "Your rights" below.

Under UK GDPR, you have the right to access the personal data we hold about you, ask us to correct it, ask us to delete it, restrict or object to how we use it, and receive a copy in a portable format. You can also withdraw marketing consent at any time, either from your account settings or by contacting us.

To exercise any of these rights, contact us using the details below. If you're not satisfied with how we've handled your data, you have the right to complain to the Information Commissioner's Office (ico.org.uk).

Our services are intended for adults. We don't knowingly collect personal data from children.

We may update this policy from time to time. The current version will always be available on this page.

Email: Info@theroyalchilli.com

Phone: 020 8797 3044

Post: 43 Kingsley Road, Hounslow TW3 1PA