Privacy notice

What we do with your personal information when you shop with us — and what you can ask us to do about it.

Last updated 7 October 2026

Who is responsible for your data

The data controller — the organisation that decides what happens to your information — is:

Registered company name: Ente Keralam Ltd
Company number: 17429259
Registered with the ICO under number: ZC235919
Data protection contact: Ryane Joe, hello@entekeralam.uk

What we collect and why

We only ask for what we actually need. Everything below comes from you, when you place an order or create an account.

Your name
So the driver knows who the order is for and we can address you properly.
Lawful basis: to perform our contract with you.
Your email address
To acknowledge your order, confirm it, and tell you about your delivery. We also pass it to Stripe so it can email you a payment receipt.
Lawful basis: to perform our contract with you.
Your delivery address and postcode
To check we deliver to your area, and to bring your order to you.
Lawful basis: to perform our contract with you.
Your mobile number
So the driver can call you if they cannot find you on the day, and so our team can message you on WhatsApp about your delivery.
Lawful basis: to perform our contract with you.
Delivery addresses you save to your account
So checkout can fill them in for you. You can remove any of them at any time.
Lawful basis: to perform our contract with you.
Your marketing choices, and when and where you made them
So we only send offers you have agreed to (or not refused — see Marketing), and can prove it.
Lawful basis: your consent, and our legal obligation to be able to show it.
Your delivery date and any delivery instructions you leave
To plan the round and to find the safe place you have told us about.
Lawful basis: to perform our contract with you.
A photograph of your doorstep, if the driver takes one when your order is left
As proof your shopping was delivered, so we can settle it with you if an order goes missing. The driver is asked to photograph the doorstep and the bags, not people. We strip the location and camera information out of every photo before we store it.
Lawful basis: our legitimate interest in being able to show what happened to your order (you can object — see your rights).
What the driver writes down if a delivery does not go to plan
So the shop knows why your order did not reach you and can put it right.
Lawful basis: to perform our contract with you.
What you ordered and what you paid
To pick, deliver and invoice your order — and afterwards to keep the accounting records the law requires us to keep.
Lawful basis: to perform our contract, and to comply with a legal obligation.
Your password, if you create an account
To let you sign in. It is stored scrambled (hashed) and nobody here can read it.
Lawful basis: to perform our contract with you.
Your email address, when you ask to be told a product is back in stock
To send you one message when that product is available to order again. Nothing else.
Lawful basis: your consent.
Technical information about your request, including your IP address
To stop the site being abused or overloaded, and to spot fraudulent orders.
Lawful basis: our legitimate interest in keeping the shop working and secure.

Who else sees your information

We share your details with these companies, and only for these reasons:

Stripe — takes your card payment. Your card details go straight to Stripe and never reach us. We also pass Stripe your email address so it can send you a payment receipt.
Resend — sends your order and back-in-stock emails — the acknowledgement, the confirmation, any update about your delivery, and a back-in-stock alert you asked for. We pass Resend your email address and the contents of those messages.
WhatsApp (Meta) — carries the messages our team sends you about your delivery, if you have given us a mobile number. WhatsApp receives your number and the words of those messages.
Our delivery driver — sees your name, address, phone number and any delivery instructions, so they can find you. They see them only while your order is actually out on their van, and every time they are shown we record who looked.
Nobody outside the Ente Keralam office sees a doorstep photograph. It is not on the website and it has no public address. Only our own online office team can open one, through a screen that records every single time it is looked at. Our shop-floor till staff cannot reach it at all, and neither can the driver once the drop is done.

We may also have to share information with our accountant, our professional advisers, or a public authority such as HMRC or the police where the law requires it.

We do not sell your data, and we never share it for advertising.

Information leaving the UK

Two of the companies above are based outside the UK: Stripe, which takes your payment, and Resend, which sends your order and back-in-stock emails. Each sets out in its own data-processing terms how it protects information that leaves the UK, and we are bound by those terms: see stripe.com/legal/dpa and resend.com/legal/dpa. If you want to know what that means for your own information, ask us and we will tell you what we hold and where.

How long we keep it

Order and payment records — six years from the end of the financial year the order falls in. We are legally required to keep our accounting records, so these stay even if you delete your account. Your name, phone number and delivery address are taken off them. Two details cannot be removed, because they sit in records that are written once and can never be edited: the email address an order was paid with, and its delivery postcode (see what will not be deleted).
Your account, if you have one — until you delete it. Deleting it removes your name, contact details and saved addresses from your account and from your order records, apart from the two details named above, which are in records that cannot be edited (see what deleting does).
A back-in-stock alert you asked for — until we send it, you cancel it, or 90 days pass, whichever is first; then deleted within 30 days.
A record of your marketing choices — kept after you say no, or delete your account, with no contact details in it, so we can show that we stopped.
If you delete your account, a scrambled fingerprint of your email address (not the address) so an old list can never add you back to our marketing.
Sign-in attempts on your account — 12 months. We record the email address used, the IP address it came from and whether it worked. This is what stops someone guessing your password. After a year they are deleted automatically.
Delivery instructions and driver notes — kept with the order record. If you delete your account, anything the driver typed about your delivery goes with it.
A doorstep photograph — 90 days. After that we delete it, whether or not you ask. If you delete your account we delete any photograph of your door straight away, along with everything else above. The six-year accounting rule does not apply to it: a photograph is not an accounting record.
Emails you send us — kept while we deal with your query and for a reasonable period afterwards in case you come back to us about it.

Cookies and what is stored on your device

We do not use advertising or analytics cookies, and there are no advertising trackers on this site. So there is no cookie banner, because there is nothing to ask you about.

Your basket is stored in your own browser, on your own device. It never leaves your device until you go to checkout.
A sign-in cookie, if you create an account and log in — it is what keeps you signed in, and it disappears when you sign out.
A note of how you reached us, if you arrived through a link that said so — for example a link in one of our Instagram posts. We keep the campaign name from that link, and — if you came from another website — the name of that website, in your browser for as long as the tab is open, and nothing else: no number, no code and nothing that identifies you or that could recognise you again. If you place an order, it is attached to that order so we know which of our posts and listings actually help people find us. Closing the tab removes it.

None of these is a cookie that needs your permission. The basket and the sign-in cookie are strictly necessary to provide the service you have asked for, and the note of how you reached us holds nothing personal and never leaves your browser unless you order. You can clear all of them at any time in your browser settings, though clearing them will empty your basket and sign you out.

Your rights

UK data protection law gives you the right to:

See what we hold about you, and get a copy of it
Have mistakes corrected — if your address or name is wrong, tell us and we will fix it
Have your data deleted, where we have no continuing reason or legal obligation to keep it
Ask us to stop using it for a while, if you think it is wrong or you have objected to how we use it
Object to us using it where we rely on our legitimate interests
Get your data in a portable form, to take elsewhere
Withdraw consent at any time, where we asked for consent — for example, to marketing emails. Withdrawing it does not undo anything we did beforehand
Not be subject to automated decision-making. We do not make any decision about you by automated means, and we do not profile you

How to exercise them — and what actually happens

Email Ryane Joe, hello@entekeralam.uk, or write to us at 136 Duke Street, St Helens, WA10 2JL. Tell us what you want and give us enough detail to find your records — the email address you ordered with is usually enough. We may ask you to confirm who you are, so we do not hand your data to someone else.

To delete your account, use the button on your account page — it happens straight away. If you cannot sign in, ask us on this page and a member of staff will do it. To get a copy of your data, email us: there is no download button yet, so a member of staff gathers it by hand.

We will respond within one month. If your request is complicated we may need up to two months more, and we will tell you within the first month if that happens. It is free.

What will not be deleted, and why. We have to keep our accounting records, and UK data protection law lets us refuse erasure for exactly that reason (Article 17(3)(b) — a legal obligation). We keep the following for six years from the end of the financial year the order falls in, and then delete it:

Each order, its invoice and any credit note — what was bought, what was paid, the invoice number and the dates. Your name, phone number and delivery address are taken off these.
The payment record our card provider sent us — it holds the email address the order was paid with.
The order’s own history — the record of each step it went through. It holds the delivery postcode.

The last two are written once and can never be edited or removed, which is what makes them dependable as a record — so those two details cannot be taken out, and we are telling you rather than implying otherwise.

We also keep, for as long as we are trading: a record of your marketing choices, so we can show that we stopped; a scrambled fingerprint of your email address, so an old list cannot add you back; an entry in our internal security log saying an account was deleted; and the account’s own reference number, with no name, email or phone number on it, so the records above still hang together. None of these names you.

One thing is temporary: the email telling you your account has been deleted is sent to your address, so that address sits in our sending queue until it goes out — it is the last place it will ever be, and it is removed once the email is sent.

That is the whole list. Everything else, we delete.

Marketing

We ask separately for each way we might send you offers — email, text message and WhatsApp — and each is off until you tick it. There is one exception the law allows: once you have ordered from us, we may email or text you offers on groceries like the ones you bought, unless you tick the box at checkout saying you would rather we did not. WhatsApp offers only ever go to people who have ticked for them.

Every offer has a way to stop them, and you can change any of your choices at any time on your account page. Messages about an order you have actually placed — the confirmation, the delivery update — are not marketing, and you get those either way.

A back-in-stock alert you ask for on a product page is a service message, not marketing: it is one email about that one product, and it never puts your address on any mailing list.

If you are unhappy with how we handle your data

Please tell us first — Ryane Joe, hello@entekeralam.uk — and we will try to put it right.

You also have the right to complain to the UK’s data protection regulator, the Information Commissioner’s Office, at ico.org.uk/make-a-complaint or on 0303 123 1113. You do not have to come to us first, though we would rather you did.

Changes to this notice

If we change how we use your information we will update this page, and the date at the top will tell you when. If the change is significant we will let you know directly.

Privacy notice

What we do with your personal information when you shop with us — and what you can ask us to do about it.

Last updated 7 October 2026

Who is responsible for your data

The data controller — the organisation that decides what happens to your information — is:

Registered company name: Ente Keralam Ltd
Company number: 17429259
Registered with the ICO under number: ZC235919
Data protection contact: Ryane Joe, hello@entekeralam.uk

What we collect and why

We only ask for what we actually need. Everything below comes from you, when you place an order or create an account.

Your name
So the driver knows who the order is for and we can address you properly.
Lawful basis: to perform our contract with you.
Your email address
To acknowledge your order, confirm it, and tell you about your delivery. We also pass it to Stripe so it can email you a payment receipt.
Lawful basis: to perform our contract with you.
Your delivery address and postcode
To check we deliver to your area, and to bring your order to you.
Lawful basis: to perform our contract with you.
Your mobile number
So the driver can call you if they cannot find you on the day, and so our team can message you on WhatsApp about your delivery.
Lawful basis: to perform our contract with you.
Delivery addresses you save to your account
So checkout can fill them in for you. You can remove any of them at any time.
Lawful basis: to perform our contract with you.
Your marketing choices, and when and where you made them
So we only send offers you have agreed to (or not refused — see Marketing), and can prove it.
Lawful basis: your consent, and our legal obligation to be able to show it.
Your delivery date and any delivery instructions you leave
To plan the round and to find the safe place you have told us about.
Lawful basis: to perform our contract with you.
A photograph of your doorstep, if the driver takes one when your order is left
As proof your shopping was delivered, so we can settle it with you if an order goes missing. The driver is asked to photograph the doorstep and the bags, not people. We strip the location and camera information out of every photo before we store it.
Lawful basis: our legitimate interest in being able to show what happened to your order (you can object — see your rights).
What the driver writes down if a delivery does not go to plan
So the shop knows why your order did not reach you and can put it right.
Lawful basis: to perform our contract with you.
What you ordered and what you paid
To pick, deliver and invoice your order — and afterwards to keep the accounting records the law requires us to keep.
Lawful basis: to perform our contract, and to comply with a legal obligation.
Your password, if you create an account
To let you sign in. It is stored scrambled (hashed) and nobody here can read it.
Lawful basis: to perform our contract with you.
Your email address, when you ask to be told a product is back in stock
To send you one message when that product is available to order again. Nothing else.
Lawful basis: your consent.
Technical information about your request, including your IP address
To stop the site being abused or overloaded, and to spot fraudulent orders.
Lawful basis: our legitimate interest in keeping the shop working and secure.

Who else sees your information

We share your details with these companies, and only for these reasons:

Stripe — takes your card payment. Your card details go straight to Stripe and never reach us. We also pass Stripe your email address so it can send you a payment receipt.
Resend — sends your order and back-in-stock emails — the acknowledgement, the confirmation, any update about your delivery, and a back-in-stock alert you asked for. We pass Resend your email address and the contents of those messages.
WhatsApp (Meta) — carries the messages our team sends you about your delivery, if you have given us a mobile number. WhatsApp receives your number and the words of those messages.
Our delivery driver — sees your name, address, phone number and any delivery instructions, so they can find you. They see them only while your order is actually out on their van, and every time they are shown we record who looked.
Nobody outside the Ente Keralam office sees a doorstep photograph. It is not on the website and it has no public address. Only our own online office team can open one, through a screen that records every single time it is looked at. Our shop-floor till staff cannot reach it at all, and neither can the driver once the drop is done.

We may also have to share information with our accountant, our professional advisers, or a public authority such as HMRC or the police where the law requires it.

We do not sell your data, and we never share it for advertising.

Information leaving the UK

How long we keep it

Order and payment records — six years from the end of the financial year the order falls in. We are legally required to keep our accounting records, so these stay even if you delete your account. Your name, phone number and delivery address are taken off them. Two details cannot be removed, because they sit in records that are written once and can never be edited: the email address an order was paid with, and its delivery postcode (see what will not be deleted).
Your account, if you have one — until you delete it. Deleting it removes your name, contact details and saved addresses from your account and from your order records, apart from the two details named above, which are in records that cannot be edited (see what deleting does).
A back-in-stock alert you asked for — until we send it, you cancel it, or 90 days pass, whichever is first; then deleted within 30 days.
A record of your marketing choices — kept after you say no, or delete your account, with no contact details in it, so we can show that we stopped.
If you delete your account, a scrambled fingerprint of your email address (not the address) so an old list can never add you back to our marketing.
Sign-in attempts on your account — 12 months. We record the email address used, the IP address it came from and whether it worked. This is what stops someone guessing your password. After a year they are deleted automatically.
Delivery instructions and driver notes — kept with the order record. If you delete your account, anything the driver typed about your delivery goes with it.
A doorstep photograph — 90 days. After that we delete it, whether or not you ask. If you delete your account we delete any photograph of your door straight away, along with everything else above. The six-year accounting rule does not apply to it: a photograph is not an accounting record.
Emails you send us — kept while we deal with your query and for a reasonable period afterwards in case you come back to us about it.

Cookies and what is stored on your device

We do not use advertising or analytics cookies, and there are no advertising trackers on this site. So there is no cookie banner, because there is nothing to ask you about.

Your basket is stored in your own browser, on your own device. It never leaves your device until you go to checkout.
A sign-in cookie, if you create an account and log in — it is what keeps you signed in, and it disappears when you sign out.
A note of how you reached us, if you arrived through a link that said so — for example a link in one of our Instagram posts. We keep the campaign name from that link, and — if you came from another website — the name of that website, in your browser for as long as the tab is open, and nothing else: no number, no code and nothing that identifies you or that could recognise you again. If you place an order, it is attached to that order so we know which of our posts and listings actually help people find us. Closing the tab removes it.

Your rights

UK data protection law gives you the right to:

See what we hold about you, and get a copy of it
Have mistakes corrected — if your address or name is wrong, tell us and we will fix it
Have your data deleted, where we have no continuing reason or legal obligation to keep it
Ask us to stop using it for a while, if you think it is wrong or you have objected to how we use it
Object to us using it where we rely on our legitimate interests
Get your data in a portable form, to take elsewhere
Withdraw consent at any time, where we asked for consent — for example, to marketing emails. Withdrawing it does not undo anything we did beforehand
Not be subject to automated decision-making. We do not make any decision about you by automated means, and we do not profile you

How to exercise them — and what actually happens

We will respond within one month. If your request is complicated we may need up to two months more, and we will tell you within the first month if that happens. It is free.

Each order, its invoice and any credit note — what was bought, what was paid, the invoice number and the dates. Your name, phone number and delivery address are taken off these.
The payment record our card provider sent us — it holds the email address the order was paid with.
The order’s own history — the record of each step it went through. It holds the delivery postcode.

That is the whole list. Everything else, we delete.

Marketing

A back-in-stock alert you ask for on a product page is a service message, not marketing: it is one email about that one product, and it never puts your address on any mailing list.

If you are unhappy with how we handle your data

Please tell us first — Ryane Joe, hello@entekeralam.uk — and we will try to put it right.

Changes to this notice

If we change how we use your information we will update this page, and the date at the top will tell you when. If the change is significant we will let you know directly.