Privacy policy

Last updated: 16 September 2026

1. ABOUT THIS POLICY

This Privacy Policy explains how NoshRocket collects, uses, shares and retains personal information when you:

• visit noshrocket.co.uk;
• create or use an account;
• place a restaurant or vendor order;
• request a Personal Shopper;
• request a Personal Courier;
• receive a delivery;
• contact customer support;
• communicate through email, telephone, live chat or WhatsApp; or
• otherwise interact with NoshRocket.

NoshRocket processes personal information in accordance with applicable UK data-protection law, including the UK General Data Protection Regulation and the Data Protection Act 2018.

1. WHO CONTROLS YOUR INFORMATION

The data controller is:

Data controller: Barry James, trading as NoshRocket
Correspondence address: 98 Carmelite Way, Salisbury, Wiltshire, SP1 2HW
Email: launchpad@noshrocket.co.uk
Telephone and WhatsApp: 07727 353560
Website: noshrocket.co.uk

Questions or requests concerning personal information should be sent using these details.

The correspondence address is not a retail shop, collection point or public customer-service office and is not open to visitors without a prior appointment.

1. PERSONAL INFORMATION WE COLLECT

Depending upon how you use NoshRocket, we may collect the following information.

3.1 Identity and contact information

This may include:

• name;
• delivery and collection addresses;
• billing address;
• postcode;
• telephone number;
• email address;
• account identifier; and
• preferred contact method.

3.2 Account information

This may include:

• account details;
• account preferences;
• saved addresses;
• previous orders;
• authentication records; and
• account-security information.

Account authentication may be managed through Shopify or passwordless access. NoshRocket does not claim to hold a customer password where authentication is managed by another provider.

3.3 Order and transaction information

This may include:

• products ordered;
• participating vendors;
• shopping lists;
• requested brands, sizes and quantities;
• approved substitutions;
• order values;
• service and delivery charges;
• payment status;
• refund information;
• retailer receipts; and
• customer-support records relating to the transaction.

3.4 Personal Shopper information

When you request a Personal Shopper, we may process:

• your shopping list;
• requested shops;
• spending limits;
• brand and product preferences;
• substitution instructions;
• messages exchanged with the shopper;
• the itemised checkout;
• payment confirmation;
• the retailer receipt; and
• information reasonably required to complete the assignment.

An authorised Personal Shopper may receive more information than an ordinary delivery driver because the shopper must understand the shopping request and may need to contact you directly.

3.5 Personal Courier information

This may include:

• the sender’s and recipient’s names;
• collection and delivery addresses;
• telephone numbers;
• descriptions of the items;
• collection authority;
• declared value;
• packaging and handling instructions; and
• records of attempted or completed collection and delivery.

3.6 Delivery and tracking information

NoshRocket and its logistics providers may process:

• driver assignment information;
• collection and delivery addresses;
• delivery routes;
• live or recent device location;
• GPS coordinates;
• estimated arrival times;
• collection and delivery timestamps;
• delivery status;
• recipient name;
• signature where required;
• customer delivery instructions; and
• proof-of-delivery photographs.

Live tracking is used to administer the active delivery. It is not intended to provide customers with indefinite access to a driver’s location.

3.7 Communications

We may retain communications sent through:

• email;
• telephone;
• SMS;
• live chat;
• WhatsApp;
• website forms; and
• communications with Personal Shoppers, drivers or support staff.

3.8 Device and website information

When you use the website, Shopify and other authorised service providers may collect:

• IP address;
• device type;
• browser type;
• operating system;
• cookie identifiers;
• website activity;
• pages viewed;
• approximate location;
• referral source; and
• diagnostic and security information.

Further information about cookies and similar technologies is contained in the NoshRocket Cookie Policy.

3.9 Age-verification information

For age-restricted orders and deliveries, the customer or recipient may be required to provide acceptable proof of age.

Unless legally required for a particular service:

• NoshRocket does not photograph identification;
• NoshRocket does not scan identification;
• identification document numbers are not recorded;
• copies of identification are not retained; and
• the order or delivery record may state only that age verification succeeded or failed.

Proof-of-delivery photographs must not deliberately include identification documents.

3.10 Allergy and health information

A customer may voluntarily provide allergy, intolerance, disability, accessibility or other health-related information where it is relevant to a shopping or delivery request.

This can be special-category personal data.

NoshRocket will use such information only where necessary to:

• communicate the customer’s instruction;
• complete the requested service;
• protect the customer’s safety; or
• meet a legal obligation.

Where processing relies upon explicit consent, the customer may withdraw that consent. Withdrawal will not affect processing already completed, but it may mean that NoshRocket cannot safely continue the affected request.

Customers should provide only information relevant to the order and should not send unrelated medical records or detailed medical histories.

1. INFORMATION OBTAINED FROM OTHER PEOPLE

We may receive personal information from:

• a customer booking delivery for another recipient;
• a sender arranging a Personal Courier delivery;
• participating vendors;
• authorised Personal Shoppers;
• drivers;
• Shopify;
• Shipday or another logistics provider;
• payment and open-banking providers;
• customer-support and communications providers; and
• fraud-prevention or security providers.

A person providing another individual’s details must have a lawful reason to do so and should tell that person that their information has been provided to NoshRocket.

1. WHY WE PROCESS PERSONAL INFORMATION

NoshRocket may process personal information for the following purposes:

Receiving and managing bookings
Typical information: Contact, order and address information
Principal lawful basis: Performance of a contract

Personal Shopper assignments
Typical information: Shopping list, contact details and instructions
Principal lawful basis: Performance of a contract

Personal Courier assignments
Typical information: Sender, recipient, item and journey information
Principal lawful basis: Performance of a contract

Processing payments and refunds
Typical information: Transaction and payment-status information
Principal lawful basis: Performance of a contract

Delivery and live tracking
Typical information: Addresses, contact details, location and status
Principal lawful basis: Performance of a contract

Proof of delivery
Typical information: Photograph, time and delivery location
Principal lawful basis: Performance of a contract and legitimate interests

Customer support and complaints
Typical information: Communications and transaction records
Principal lawful basis: Performance of a contract and legitimate interests

Accounting and tax records
Typical information: Orders, payments and receipt copies
Principal lawful basis: Legal obligation

Fraud and service security
Typical information: Account, device and transaction information
Principal lawful basis: Legitimate interests and legal obligation

Service improvement
Typical information: Operational and website information
Principal lawful basis: Legitimate interests

Email and WhatsApp marketing
Typical information: Contact details and preferences
Principal lawful basis: Consent

Legal claims and regulatory enquiries
Typical information: Relevant transaction and communication records
Principal lawful basis: Legal obligation and legitimate interests

Age verification
Typical information: Handover result and limited delivery records
Principal lawful basis: Legal obligation and legitimate interests

Where NoshRocket relies upon legitimate interests, those interests ordinarily include:

• operating a safe and reliable delivery service;
• preventing fraud;
• resolving disputes;
• protecting customers, drivers and Personal Shoppers;
• maintaining transaction records; and
• improving service performance.

NoshRocket will consider whether those interests are overridden by the individual’s rights and freedoms.

1. PERSONAL SHOPPER ACCESS

Only separately authorised NoshRocket Personal Shoppers may receive the information required to undertake Personal Shopper work.

An authorised Personal Shopper may receive:

• the customer’s name;
• shopping list;
• requested shops;
• product preferences;
• substitution instructions;
• relevant budget information;
• telephone number or direct contact route; and
• delivery information where the shopper is completing the delivery.

Shopify may technically describe an authorised Personal Shopper as “staff” for access-control purposes. This is a Shopify technical classification and does not, by itself, describe the person’s employment status.

Ordinary drivers do not receive Personal Shopper Shopify POS access and should receive only the information required for their assigned collection and delivery.

1. RECEIPT PHOTOGRAPHS

After a Personal Shopper purchase is completed:

• the original physical retailer receipt is supplied with the customer’s goods; and
• a complete and legible photographic copy is sent to and retained by NoshRocket.

The photographic copy is used for:

• bookkeeping;
• transaction reconciliation;
• verifying how customer funds were used;
• handling refunds or disputes;
• fraud prevention; and
• complying with accounting or legal obligations.

Receipt photographs will not be used for marketing.

1. PROOF-OF-DELIVERY PHOTOGRAPHS

Proof-of-delivery photographs are collected to:

• demonstrate delivery;
• identify where goods were left;
• resolve missing-item or non-delivery reports;
• protect customers and delivery personnel; and
• investigate complaints or insurance claims.

Drivers should avoid unnecessarily photographing:

• neighbouring properties;
• children;
• identification documents;
• private correspondence;
• screens displaying personal information; or
• individuals who do not need to appear in the photograph.

A photograph showing the goods or delivery location will usually be sufficient.

1. PROMOTIONAL PHOTOGRAPHS AND CUSTOMER SELFIES

Proof-of-delivery evidence is separate from promotional photography.

A photograph containing an identifiable customer will not be used for advertising, social media or other promotional purposes unless that person has given separate and express permission.

Customers are not required to participate in promotional photographs. Refusal will not affect their order or delivery.

Where consent is given, it may be withdrawn for future use by contacting NoshRocket.

Withdrawal will not necessarily require NoshRocket to recall or remove printed material already lawfully produced and distributed, but reasonable steps will be taken to stop future digital use.

A parent or guardian must provide appropriate consent before an identifiable child is used in promotional material.

1. AGE-VERIFICATION PRIVACY

NoshRocket operates Challenge 25 for age-restricted goods.

Drivers and Personal Shoppers inspect identification only for the purpose of verifying age and lawful handover.

Unless a specific legal requirement applies:

• identification will not be photographed;
• identification will not be scanned;
• document numbers will not be recorded;
• copies will not be retained; and
• identification must not appear in proof-of-delivery photographs.

The delivery record may show:

• that age verification was requested;
• whether verification succeeded or failed;
• the general type of identification inspected; and
• the reason a handover was refused.

1. WHO RECEIVES PERSONAL INFORMATION

NoshRocket may share relevant information with the following recipients.

11.1 Shopify

Shopify provides the website, commerce, customer-account and Shopify POS infrastructure used by NoshRocket.

11.2 Participating vendors and retailers

A restaurant or retailer may receive order details, customer instructions and information required to prepare, identify or supply the order.

They should not receive information unrelated to their part of the service.

11.3 Authorised Personal Shoppers

Personal Shoppers receive the information required to understand and complete the shopping assignment and communicate with the customer where necessary.

11.4 Drivers and delivery personnel

Drivers receive information necessary to collect and deliver goods, normally including:

• recipient name;
• collection address;
• delivery address;
• telephone number;
• delivery instructions; and
• relevant order or package references.

11.5 Shipday and logistics providers

Shipday or another appointed logistics provider may process delivery addresses, contact information, journey status, driver information, tracking data, GPS information and proof-of-delivery records.

11.6 Payment and open-banking providers

Authorised providers process payment instructions, payment status, refunds and information required to complete or protect the transaction.

Money paid to NoshRocket for Personal Shopper goods is received and applied to place the customer’s requested purchase as the customer’s disclosed agent. It is not payment for a sale of those goods by NoshRocket.

NoshRocket does not receive or store a customer’s complete online-banking login credentials.

Customers should review the payment provider’s own privacy information when it is presented during payment.

11.7 Communications providers

Email, SMS, live-chat, telephone and WhatsApp providers may process communications and contact details transmitted through their systems.

WhatsApp services are provided by companies within the Meta group and may involve processing under Meta’s applicable privacy terms.

11.8 Professional and public bodies

Information may be disclosed where reasonably necessary to:

• accountants;
• insurers;
• legal advisers;
• fraud-prevention services;
• banks and payment providers;
• law-enforcement authorities;
• courts;
• regulators;
• Trading Standards;
• the Information Commissioner’s Office; or
• other bodies where disclosure is required or permitted by law.

NoshRocket does not sell or rent customer personal information.

1. INTERNATIONAL TRANSFERS

Some service providers, including Shopify, Meta and other technology providers, may process information outside the United Kingdom.

Where UK personal information is transferred internationally, NoshRocket will rely upon an applicable legal safeguard, such as:

• UK adequacy regulations;
• the UK International Data Transfer Agreement;
• the UK Addendum to approved contractual clauses; or
• another transfer mechanism permitted by UK law.

Customers may contact NoshRocket for further information about the safeguards relevant to their information.

1. HOW LONG INFORMATION IS RETAINED

NoshRocket retains information only for as long as reasonably required for the purpose for which it was collected and for applicable legal, tax, accounting, insurance and dispute-resolution requirements.

Typical retention periods are:

• order and transaction records: up to six years after the transaction;
• Personal Shopper retailer-receipt photographs: up to six years;
• payment and refund records: up to six years;
• customer complaints and associated evidence: up to six years where relevant to a claim;
• proof-of-delivery photographs: deleted earlier where no longer required, but retained for up to six years where needed as transaction, complaint, insurance or legal evidence;
• GPS and detailed tracking information: retained for the shortest operationally reasonable period unless required for a complaint, safety incident or legal claim;
• age-verification and refused-handover records: retained for the period reasonably required to demonstrate compliance or manage a dispute;
• marketing-consent records: retained while consent remains active and for an appropriate period afterwards to demonstrate compliance;
• marketing-suppression records: retained as necessary to respect an opt-out;
• unsuccessful enquiries: normally retained for a shorter period unless there is a legal or operational reason to retain them; and
• account information: retained while the account remains active and afterwards where records must be kept.

NoshRocket may anonymise information instead of deleting it where the resulting information can no longer identify an individual.

1. EMAIL AND WHATSAPP MARKETING

NoshRocket may send promotional messages by email or WhatsApp only where the recipient has consented or another lawful marketing rule clearly applies.

Marketing consent is optional and is separate from accepting the Terms of Service.

Customers can withdraw marketing consent at any time by:

• using an unsubscribe link;
• replying “STOP” where supported;
• messaging NoshRocket through WhatsApp; or
• emailing launchpad@noshrocket.co.uk.

Withdrawing from marketing will not prevent necessary service messages concerning active orders, account security, payments, refunds or deliveries.

NoshRocket may retain limited suppression information to ensure that an opt-out continues to be respected.

1. COOKIES AND SIMILAR TECHNOLOGY

The website may use cookies or similar technology for:

• essential site operation;
• security;
• shopping-basket functions;
• account access;
• customer preferences;
• analytics; and
• marketing where enabled and consented to.

Essential cookies may operate without consent where legally permitted.

Non-essential analytics and advertising cookies must not be activated until the user has made the relevant consent choice.

Users should be able to reject non-essential cookies as easily as they can accept them and should be able to change their choice later.

Further information is contained in the NoshRocket Cookie Policy and the website’s cookie-preference controls.

1. AUTOMATED DECISIONS

NoshRocket may use automated systems to:

• calculate delivery charges;
• check service-area eligibility;
• route assignments;
• offer work to nearby drivers;
• detect possible fraud; or
• manage basic order availability.

NoshRocket does not intend to make decisions based solely on automated processing that produce legal or similarly significant effects without appropriate safeguards.

Customers who believe an automated result is incorrect may contact NoshRocket and request human review.

1. SECURITY

NoshRocket uses reasonable organisational and technical measures to protect personal information.

These measures may include:

• access controls;
• individual system accounts;
• passwordless or secured authentication;
• restricted Shopify POS permissions;
• encrypted platform connections;
• minimum-necessary sharing;
• staff and contractor instructions;
• device-security requirements; and
• incident investigation.

No internet or communications system can be guaranteed completely secure.

Customers should protect their account access and promptly report suspected unauthorised use.

1. DATA INCIDENTS

If NoshRocket becomes aware of a personal-data breach, it will:

• investigate the incident;
• take reasonable steps to contain it;
• assess the risk to affected individuals;
• notify the Information Commissioner’s Office where legally required; and
• notify affected individuals where the law requires it.

1. YOUR DATA-PROTECTION RIGHTS

Depending upon the circumstances and lawful basis used, individuals may have rights to:

• be informed about processing;
• access their personal information;
• correct inaccurate information;
• request deletion;
• restrict processing;
• object to processing;
• receive certain information in a portable format;
• withdraw consent; and
• request safeguards concerning solely automated decisions.

These rights are not always absolute. For example, NoshRocket may need to retain transaction information to meet tax, accounting or legal obligations.

Requests should be sent to:

Email: launchpad@noshrocket.co.uk

NoshRocket may request reasonable information to verify the requester’s identity before disclosing or altering personal information.

1. COMPLAINTS TO THE ICO

Customers should contact NoshRocket first where possible so that the matter can be investigated.

Individuals also have the right to complain to the Information Commissioner’s Office:

Website: ico.org.uk
Telephone: 0303 123 1113

1. CHILDREN

NoshRocket accounts and bookings are intended for adults aged 18 or over.

NoshRocket does not knowingly invite children to create accounts or independently purchase services.

A child may nevertheless appear incidentally in a delivery environment. Drivers and Personal Shoppers must avoid collecting unnecessary information or photographs of children.

NoshRocket will not knowingly supply or arrange the supply of age-restricted goods to a person below the applicable legal age.

1. CHANGES TO THIS POLICY

NoshRocket may update this policy to reflect changes in law, technology, providers or operating practices.

The current version and its revision date will be published on noshrocket.co.uk.

Where a change materially affects how existing customer information is used, NoshRocket will provide additional notice where required.

1. CONTACT

For privacy questions or requests:

Barry James, trading as NoshRocket
Correspondence address: 98 Carmelite Way, Salisbury, Wiltshire, SP1 2HW
Email: launchpad@noshrocket.co.uk
Telephone and WhatsApp: 07727 353560

hrocket.co.uk & Noshrocket.com