Privacy notice
Draft — under review. This page has not yet been checked by ERFT or its advisers and may change before launch.
buyShea is a trading name of East River Foods Trading UK Limited, company no. 15223964, registered office 2 Azure Close, Rugby CV22 5BT. Registered in England and Wales. VAT registration pending.
Who is responsible
The data controller for personal information collected through buyshea.co.uk is East River Foods Trading UK Limited ("ERFT", "we"), trading as buyShea, company no. 15223964, 2 Azure Close, Rugby CV22 5BT. Contact us at hello@buyshea.co.uk or by post to that address. ICO registration number: [OWNER: ICO registration number].
What we collect, why, and our lawful basis
| Information | Purpose | Lawful basis (UK GDPR) |
|---|---|---|
| Name, email, phone, delivery address, items ordered | To take payment, deliver your order, send order and dispatch emails, and handle cancellations and returns | Contract (to perform our contract with you) |
| Order and payment records | Accounting and tax records | Legal obligation |
Which agent you shop with, and whether you came from their link or QR code (the bs_agent cookie and your order) |
buyShea is sold only through agents: to open the shop for you and to pay the right agent's commission | Legitimate interests (crediting the agent who introduced you) |
| Payment and device signals, basic technical logs (IP address, browser) | Fraud prevention and keeping the site secure | Legitimate interests (preventing fraud and abuse) |
| Name, email, postcode or town, region and message, if you use "No agent yet?" | To ask a buyShea agent near you to get in touch | Consent (the box you tick on the form). You can withdraw it at any time by emailing us. |
We don't sell your information and we don't use it for advertising.
What your agent sees
Your agent is told that an order was placed, its items and value, and your first name and postcode district (for example "Jo, B15") so they can recognise their customer and be paid. Agents never see your email, phone, full address or card details. If you use "No agent yet?", we pass your name, email, town and message to the agent we choose, as you agreed on the form.
Who processes it for us
These companies process personal information for us under contract:
- Stripe — payment and fraud checks on its secure checkout page. Stripe is also a separate controller for its own fraud prevention; see stripe.com/privacy.
- Cloudflare — hosts this website and our order system, and runs Turnstile, the bot check on the "No agent yet?" form.
- Resend — sends our emails (order confirmation, dispatch, and notifications to our team).
- Royal Mail (and Parcelforce) — delivers your order and sends delivery updates, so it receives your name, address and contact details.
Some of these providers process data outside the UK. Where they do, they use safeguards approved under UK law, such as the UK International Data Transfer Addendum or an adequacy decision.
How long we keep it
| Information | How long |
|---|---|
| Orders and payment records | 6 years from the end of the financial year they belong to (HMRC) |
| "No agent yet?" requests | 12 months, then deleted automatically |
| Agent records (for buyShea agents) | For the term of the agent agreement plus 6 years |
| Technical logs | [OWNER: confirm; suggested no more than 30 days] |
Cookies and browser storage
We set one strictly necessary cookie, bs_agent, for 90 days; it records the agent you shop with and whether you came from their link or QR code. Your basket is stored in your own browser. See the cookies page.
Your rights
You have the right to access your information, to have it corrected or deleted, to restrict or object to how we use it, to data portability, and, where we rely on consent, to withdraw it at any time. Email hello@buyshea.co.uk; we'll reply within one month.
If you're unhappy with how we've handled your information, you can complain to the Information Commissioner's Office at ico.org.uk or on 0303 123 1113. We'd appreciate the chance to put things right first.
Last updated 10 November 2026.