Privacy policy

This notice explains what personal data Treatsdom collects, why we collect it, how long we keep it, and the rights you have over it. It covers treatsdom.com and the orders we fulfil. We are the “data controller” for this information.

Last updated: 10 August 2026

Who we are

Treatsdom is a trading name of Esther Oluwatomisin Akinyoola, a sole trader based in the United Kingdom, selling Nigerian snacks online. She is the data controller for the personal data described here.

• Email: treatsdomuk@gmail.com — the fastest way to reach us about anything on this page.
• WhatsApp: message us
• Postal address: available on request — email us and we'll provide it.

We have not appointed a Data Protection Officer, as we are not required to. Privacy questions go to the email address above.

What we collect, why, and our lawful basis

We only collect what we need. Under UK GDPR every use of your data needs a “lawful basis”, so each purpose is listed with its own.

When you place an order

We collect your name, email address, delivery address, and phone number if you give one, together with what you ordered and the amount paid. We use this to take payment, pack and deliver your order, send you order emails, and handle any refund or problem afterwards.

Lawful basis: performance of a contract. Retaining the transaction record afterwards is a legal obligation (tax law).

You have to give us this information to place an order — without it we cannot take payment or deliver to you.

When you create an account

We store your name, email address, a securely hashed password, your saved addresses, and your order history. If you choose to, we also store an allergen profile (the allergens you want flagged), your marketing preferences, and your wishlist.

Lawful basis: performance of a contract for the account itself; consent for the optional allergen profile and preferences, which you can change or clear at any time in your account.

Your allergen profile is used only to highlight products on this site. It is never sold, shared, or used for advertising. Please always check the product page and the pack itself — the profile is a convenience, not a substitute for reading the ingredients.

When you sign up to our newsletter

We collect your email address and a record of your consent. We use double opt-in, so we only add you after you click the confirmation link we email you.

Lawful basis: consent. Every email has an unsubscribe link, and unsubscribing takes effect immediately.

When you leave a review

We collect the name you enter, your rating, and your review text. Reviews are checked before they appear. Whatever name you enter is published, so please use a first name or initials rather than your full name if you would prefer not to be identifiable.

Lawful basis: consent.

When you contact us

If you email or message us, we keep that correspondence so we can deal with your query and refer back to it if you contact us again.

Lawful basis: legitimate interests — responding to people who contact us, which we consider you would reasonably expect.

Cookies and site measurement

See our cookie policy for the full list of cookies, what each one does, and how to change your choices.

What we never do

• We never see or store your card details. Card payments are handled entirely by Stripe on their own systems. Your card number never reaches our servers.
• We do not sell or rent your personal data to anyone.
• We do not use your data for automated decision-making or profiling.

Who else processes your data

We use a small number of suppliers to run the shop. They act on our instructions only, and each is bound by a contract that restricts what they may do with your data.

• Stripe — payment processing. Receives your name, email, billing details and the amount. Stripe is an independent controller for fraud prevention.
• Resend — sends our order and account emails. Receives your email address and the contents of the message.
• Vercel — hosts this website and processes the requests you make to it.
• Hetzner — hosts our shop server and database in the EU.
• Backblaze B2 — stores encrypted database backups in the EU.

We will also disclose data where the law requires it — for example to HMRC, or in response to a valid legal request.

Transfers outside the UK

Our servers and backups are in the EU. Some of our suppliers, including Stripe, Resend and Vercel, are based in or route data through the United States. Where data leaves the UK we rely on the safeguards UK data protection law allows — an adequacy decision (such as the UK–US data bridge) or the International Data Transfer Agreement. You can ask us for details of the safeguards for any specific supplier.

How long we keep it

• Order and payment records — 6 years after the end of the financial year they relate to, because UK tax law requires it.
• Account data — while your account is open, and deleted within 30 days of you closing it, except for order records covered above.
• Newsletter — until you unsubscribe, after which we keep only a suppression record so we do not email you again by mistake.
• Reviews — until you or we remove them.
• Correspondence — 2 years after your query is resolved.
• Backups — encrypted database backups are kept for 30 days and then deleted automatically.

How we protect it

Data is encrypted in transit (HTTPS everywhere) and our backups are encrypted at rest. Passwords are stored hashed, never in readable form. Access to the shop's admin system is restricted and protected by two-factor authentication.

Your rights

Under UK GDPR you have the right to:

• Be informed — which is what this notice is for.
• Access a copy of the personal data we hold about you.
• Rectification — have inaccurate data corrected.
• Erasure — ask us to delete your data, where we are not required to keep it.
• Restrict processing — ask us to pause using your data while a concern is resolved.
• Data portability — receive your data in a machine-readable format.
• Object — to processing based on our legitimate interests, and to direct marketing at any time.
• Withdraw consent — at any time, where consent is the basis. This does not affect anything done before you withdrew it.

To exercise any of these, email treatsdomuk@gmail.com. We will respond within one month, and it is free. Some of it you can do yourself at any time from your account: update your details, clear your allergen profile and preferences, or change your marketing choices.

Complaints

If you are unhappy with how we have handled your data, please tell us first so we can put it right. You also have the right to complain to the UK's data protection regulator:

Information Commissioner's Office
Wycliffe House, Water Lane, Wilmslow, Cheshire SK9 5AF
Helpline: 0303 123 1113 — ico.org.uk/make-a-complaint

Children

This shop is intended for adults. We do not knowingly collect data from children under 13. If you believe a child has given us their data, contact us and we will delete it.

Changes to this notice

If we change how we use your data we will update this page and the date at the top. If the change is significant we will tell you directly.

See our delivery, returns and allergens pages for the rest of our terms.