Last updated: 6 October 2026
Who we are
Southern Fried Chicken (SFC), 6a Brand Street, Hitchin, SG5 1HX. We are responsible for the personal information collected through sfchitchin.co.uk and the SFC Hitchin app. Questions about your data? Email Sfchitchin6a@gmail.com or call 01462 626663.
What we collect, and why
- Your order: your name, phone number, the food you choose, any notes (such as allergies), and the collection or delivery time. We need these to make your order and contact you about it.
- Delivery details: your address and postcode, to check you are within our delivery area, work out the delivery fee and bring your food.
- Brand Street Regulars account (optional): your name, email, phone number and a securely scrambled (hashed) password. We use these to sign you in, show your past orders and keep your stamps and rewards.
- Order chat: messages you send us about an order, so the kitchen can reply.
- Contact form and reviews: what you write to us and the contact details you give, so we can reply. Reviews you post may be shown on our website.
- Text codes: for some cash orders we text a one-time code to your phone to check the order is genuine.
- Promo codes: when you use a code such as FIRST, we record your phone number and delivery address so each code can only be used once per person and per home.
- Notifications (optional): if you turn on order alerts, we store a technical address from your browser or phone so we can send them. You can turn them off at any time.
The legal basis for most of this is that we need it to take and deliver your order (a contract with you). Fraud checks, promo limits and blocking abusive orders are in our legitimate interests. Optional extras like your account and notifications are based on your choice to use them.
Payments
Card payments for delivery are handled by Stripe. Your card details go straight to Stripe and are never seen or stored by us. We only receive confirmation that the payment went through, and we can issue refunds through Stripe.
Who we share it with
We never sell your information or use it for advertising. We only share what is needed with the services that run our ordering system:
- Stripe: card payments and refunds
- Cloudflare: runs our ordering system and stores orders securely
- Hostinger: hosts our website
- Twilio: sends verification text codes
- Resend: sends order and contact-form emails to the shop
- postcodes.io: looks up your postcode to check the delivery distance (only the postcode is sent)
- Google Fonts: provides the fonts used on our pages
- Instagram: our Our Story page shows posts from our Instagram, which Instagram loads directly and may use its own cookies for
Our staff see order details on the kitchen screen and printed ticket so they can make and deliver your food.
Cookies and storage
We don't use advertising or tracking cookies, and there is no analytics on our site. Your browser or app keeps a few things on your device so the site works: your basket, your sign-in (if you have an account), a promo code you tapped, and small preferences such as hiding the app banner. Clearing your browser data removes them.
How long we keep it
- Orders: up to 6 years, because we need sales records for tax and accounts.
- Account: until you delete it. Sign-ins expire after 60 days.
- Messages and contact-form enquiries: up to 2 years.
- Text codes: deleted once used or expired.
Deleting your account
Signed in? Go to Your account, scroll to Delete my account and confirm with your password. This deletes your account, stamps and rewards straight away. You can also ask us by email or phone. Past orders are kept for our records (see above) but are no longer linked to you.
Your rights
Under UK data protection law you can ask to see the information we hold about you, correct it, delete it, or object to how we use it. Contact us using the details above and we'll respond within one month. If you're unhappy with how we handle your data, you can complain to the Information Commissioner's Office at ico.org.uk.
Children
Our website and app are not aimed at children under 13, and we don't knowingly collect their information.
Keeping it safe
Everything is sent over secure HTTPS connections, passwords are stored scrambled, and only the shop's staff can see orders and customer details.
Changes
If we change this policy we'll update the date at the top of this page.