Who we are
Nandan Trading Limited, trading as World of Spices is the controller of the personal data described in this notice. That means we decide how and why it is used, and we are responsible for protecting it. Our registered office is 12 Talbot Street, Dublin 1.
For anything about your data, email hello@worldofspices.ie or call 01 558 6267. Please put “Data protection” in the subject line so it reaches the right person quickly. We are not required to appoint a Data Protection Officer, but one named person in our team is responsible for data protection and answers these messages.
What this notice covers
This notice explains how we handle personal data when you:
- visit worldofspices.ie
- join our members' club by scanning the QR code in one of our shops
- use your coupon or manage your membership
- receive emails from us
- contact us by email, phone or a message on Instagram or Facebook
It is written to meet the EU General Data Protection Regulation (GDPR), the Irish Data Protection Act 2018 and the ePrivacy Regulations 2011 (S.I. No. 336 of 2011).
What we collect
When you browse this website
We do not ask for or collect any personal data. There are no analytics, tracking pixels, advertising tags or social media plugins on this website, and our fonts are served from our own website, not from a third party. Like every website, our hosting provider automatically records basic technical data for security and to keep the site running: your IP address, the page you asked for, the time, and your browser type. We do not use this to identify you.
When you join the members' club
- Your details: your name, email address, mobile number and the shop you usually visit.
- Your age confirmation: that you ticked “I am 16 or over”. We do not ask for your date of birth.
- Your marketing choice: whether you said yes or no to the weekly deal emails, the date, and the version of the wording you saw, so we can prove what you agreed to.
- Your coupon: when it was issued, when it expires, and, if you used it, the date, time and shop.
- Email records: the dates we sent your welcome email and any reminder, the date you unsubscribed if you did, and the date we last told you that you had already joined.
- Two private links: long random codes in the links to your coupon and your “Manage your membership” page. They are how the website knows it is you, instead of a password.
You give us all of this yourself. We do not buy data, combine it with data from other sources, or collect anything from you without you knowing. Your name, email, phone and shop are needed to give you the membership. Saying yes to marketing emails is optional and does not change your coupon.
When you contact us
If you email, call or message us, we use what you tell us, and your contact details, to answer you. We do not add you to any mailing list because you contacted us.
To protect the website
When someone submits the join form, or tries to sign in to our admin area, we briefly hold their IP address in the server's memory to stop too many attempts from one place in a short time. It is never written to our database and is cleared within an hour. The join form also has a hidden field that only automated spam bots fill in.
What we never collect
We do not ask for or keep payment card details, your address, your date of birth, your location, or any special category data such as religion or health. Buying halal meat does not tell us anything about you, and we do not record what you buy.
Why we use it, and our legal basis
The GDPR says we must have a lawful basis for every use of personal data. Here is each one.
| What we do | Data used | Legal basis |
|---|---|---|
| Create and run your membership, and show it to you on your Manage page | Name, email, phone, shop, private links | Contract: providing the membership you asked for (Article 6(1)(b)) |
| Send your welcome email with your 10% coupon | Name, email, coupon | Contract (Article 6(1)(b)). This email is part of the service, so it goes to every new member. |
| Check your coupon at the till and stop it being used twice | Coupon status, shop, date and time | Contract (Article 6(1)(b)) |
| Make sure each person gets the welcome coupon only once, and tell you if you try to join again | Email, phone | Contract (Article 6(1)(b)) and legitimate interests in preventing misuse of the offer (Article 6(1)(f)) |
| Send the weekly members' deal, coupon reminders and World of Spices news | Name, email, marketing choice | Consent (Article 6(1)(a)) and Regulation 13 of the ePrivacy Regulations 2011. Only if you ticked the box. |
| Keep proof of your marketing choice | Your yes or no, date, wording version | Legal obligation: to show we had your consent (Articles 6(1)(c) and 7(1)) |
| Check that members are 16 or over | Your age confirmation | Contract (Article 6(1)(b)) and Section 31 of the Data Protection Act 2018 |
| Answer your messages and calls | What you send us, your contact details | Legitimate interests in answering customers (Article 6(1)(f)) |
| Keep the website secure and stop spam sign-ups | IP address, technical data | Legitimate interests in running a safe service (Article 6(1)(f)) |
| Deal with a legal claim, or meet a legal or regulatory duty | Only what is relevant | Legal obligation (Article 6(1)(c)) or legitimate interests (Article 6(1)(f)) |
We will not use your data for a new purpose that does not fit these, unless we tell you first and, where needed, ask for your consent.
Our legitimate interests
Where we rely on legitimate interests, we have weighed our needs against your rights. Answering a message you sent us, and keeping our website safe from spam and attacks, are things you would reasonably expect, use very little data, and do not affect you in any significant way. You can object to any use based on legitimate interests at any time (see Your rights).
Marketing emails
- We only send the weekly members' deal, coupon reminders and news if you ticked the box when you joined, or switched it on later.
- The box is never ticked for you. Saying no does not affect your coupon.
- Every one of these emails has an unsubscribe link. You can also switch it off on your Manage page, or email hello@worldofspices.ie.
- We never send marketing by text message or phone call, and we never share your details with other companies for their marketing.
- You have an absolute right to stop marketing. When you unsubscribe, we stop straight away and keep only a note that you unsubscribed, so we never email you by mistake.
Automated decisions
We do not make any decisions about you by computer alone, and we do not profile you. The website only checks simple facts, such as whether your coupon has already been used or whether your email or phone number has joined before.
Who we share it with
We never sell or rent personal data. Inside World of Spices, only staff who need it can see it: the owners and named staff who run the members' club. Staff at the till see only your coupon on your own phone. We use these service providers, who process data only on our instructions, under written contracts that meet Article 28 of the GDPR:
| Provider | What they do for us | Where |
|---|---|---|
| Vercel Inc. | Hosts this website and runs its server code. Our server functions run in Dublin, Ireland. | Ireland (servers). Vercel is a US company. |
| Our database provider | Stores member records and coupon status. | European Union |
| Resend | Delivers our emails: your welcome coupon and, if you agreed, the weekly members' deal. | Resend is a US company |
| Our staff keep a working copy of the members list in Google Sheets. It updates and deletes in step with our database. | Google may process data in the EU and the US |
We may also share personal data:
- with our accountants, solicitors or insurers, if they need it to advise us
- with An Garda Síochána, a court or a regulator, if the law requires it
- with a buyer, if our business is ever sold, under the same protections as this notice
Transfers outside the EU
Our member data is stored in the European Union and our website runs in Dublin. Some of our providers are US companies, so data can sometimes be accessed from or processed in the United States. When that happens, it is protected by the EU-US Data Privacy Framework (where the provider is certified) or by the European Commission's Standard Contractual Clauses, as Articles 45 and 46 of the GDPR require. You can ask us for a copy of these safeguards.
How long we keep it
| Data | How long |
|---|---|
| Your membership and coupon | Until you delete it or ask us to. Otherwise we delete it automatically 24 months after you joined or last used your coupon, whichever is later. |
| Your coupon | It works for 30 days. Its record stays with your membership. |
| Proof of your marketing choice | As long as your membership exists. If you unsubscribe, we keep only a note of the date so we never email you again. |
| The working copy in Google Sheets | Updated and deleted in step with our database, usually within seconds |
| Messages, emails and calls | Up to 12 months after we last hear from you, unless we need them for a legal claim |
| IP addresses for spam protection | Held in memory only, gone within an hour |
| Hosting security logs | A short period set by our hosting provider, then deleted |
| Backups | Our database provider keeps rolling backups for a short time. Deleted data drops out of them when they are overwritten. |
When you delete your membership, it is removed from our database and our Google Sheet straight away. The weekly deal emails stop at the same time.
How we keep it safe
- Every page and form on this website uses an encrypted connection (HTTPS).
- Member data is stored in the EU with a provider that encrypts it at rest.
- Only named staff can open the admin area. It is protected by a password, a signed login cookie that expires after 12 hours, and limits on failed tries.
- Your coupon and Manage links use long random codes that cannot be guessed. Members never need a password, so there is no password to steal.
- The join form limits how often it can be used and blocks automated spam.
- We collect as little as we can and delete what we no longer need.
If a personal data breach ever puts your data at risk, we will report it to the Data Protection Commission within 72 hours where the law requires, and tell you without delay if it is likely to put your rights at high risk (Articles 33 and 34).
Your rights
Under the GDPR you have the right to:
- Access your data and get a copy of it (Article 15)
- Correct anything that is wrong or incomplete (Article 16)
- Delete your data (Article 17)
- Restrict how we use it, for example while we check a complaint (Article 18)
- Take your data with you in a common format (Article 20)
- Object to uses based on legitimate interests, and to marketing at any time (Article 21)
- Withdraw consent at any time, without affecting anything we did before you withdrew it (Article 7(3))
- Not be subject to decisions made only by a computer that have legal or similarly significant effects on you (Article 22). We make none.
The quickest way is the “Manage your membership” link in any of our emails. It shows everything we hold, lets you change your shop and marketing choice, and deletes your membership in one tap. For anything else, see how to make a request or email hello@worldofspices.ie. It is free. We reply within one month. If a request is complex we may need up to two more months, and we will tell you why within the first month. We may ask you to confirm it is you before we share or delete anything.
Children
Our members' club is only for people aged 16 and over, in line with Section 31 of the Data Protection Act 2018. This website is not aimed at children. If you think a child under 16 has joined, email hello@worldofspices.ie and we will delete their details.
Other websites
Our pages link to Google Maps, Instagram and Facebook. We do not embed them, so nothing from those companies loads until you click. Once you leave our website, their own privacy policies apply.
Complaints
If you are unhappy with how we have handled your data, please tell us first at hello@worldofspices.ie so we can put it right. You also have the right to complain to the Data Protection Commission, 21 Fitzwilliam Square South, Dublin 2, D02 RD28, Ireland, www.dataprotection.ie, or to the data protection authority in the EU country where you live or work.
Changes to this notice
We will update this notice when the way we use data changes, and change the version and date at the top. If a change affects members, we will email them before it takes effect. See also our cookie notice and your data rights.