Privacy Policy

1. Who we are

Forago ("Forago", "we", "us") is an online marketplace operated by [PLACEHOLDER: Legal entity name, e.g. "Forago Ltd, a company registered in England and Wales (Company No. 00000000)"]. Our registered address is [PLACEHOLDER: Registered/contact postal address]. We are the data controller for the personal information described in this policy, except where we say otherwise.

Forago connects independent food makers ("sellers" or "shops") with customers. This policy explains what personal data we collect, how we use it, and — because Forago is a marketplace — how it is shared with sellers so that orders can be fulfilled.

2. Information we collect

Account information

When you create an account, we collect your name, email address and password (stored encrypted, never in plain text).

Dietary preferences and allergy information

You can optionally tell us about dietary preferences (e.g. vegetarian, vegan) and allergies, so we can help you filter products. Allergy information is "special category" data under UK GDPR because it relates to your health. We only collect it with your explicit consent, only use it to power on-site filtering and allergen labelling, and never share it with sellers or anyone else without your separate consent at the point of an order.

Order and delivery information

When you place an order, we collect the information needed to fulfil it: your name, delivery address, contact phone number, and the items and quantities ordered. See Section 4 for how this is shared with sellers.

Seller and shop information

If you apply to sell on Forago, we collect business details (business name, address, phone, email, company registration number), local authority food registration details, your food hygiene certificate, HACCP confirmation, Food Hygiene Rating Scheme score, and public liability insurance details. We use this to assess applications and to meet our own legal obligations around food safety and trading standards.

Cookies and usage data

We use essential cookies to keep you signed in and remember your basket. With your consent, we also use Google Analytics to understand how the site is used. See Section 5 for details. We do not use Facebook Pixel or any other social media advertising trackers.

3. How we use your information

We rely on the following lawful bases under UK GDPR:

• Performance of a contract — creating your account, processing orders, and enabling sellers to fulfil them.
• Legal obligation — keeping seller food-safety and insurance records as required by law.
• Legitimate interests — keeping the site secure, preventing fraud, and improving our service.
• Consent — analytics cookies, and any optional dietary/allergy information you choose to provide.

4. Sharing your information with sellers

Forago is a marketplace: shops are run by independent businesses, not by us. When you place an order, we share the information needed to fulfil it — your name, delivery address, contact phone number, and order details — with the seller(s) whose products you ordered.

Sellers act as independent data controllers for the information we share with them for order fulfilment, and are responsible for handling it in line with data protection law. We require sellers to use this information only to fulfil your order (and any related customer service or legal obligations) and not for unrelated marketing.

We otherwise only share personal data with:

• Service providers who host our infrastructure or process data on our behalf, under contract;
• Google, for analytics, where you have given cookie consent (see Section 5);
• Regulators, law enforcement or other authorities where we are legally required to.

We do not sell your personal data.

5. Cookies and analytics

We use a small number of essential cookies that are necessary for the site to work (for example, keeping you logged in and remembering the contents of your basket). These don't require consent.

With your consent, given via the cookie banner shown when you first visit, we also use Google Analytics to understand how visitors use Forago (e.g. pages viewed, general location, device type). Google Analytics sets cookies and may transfer data to Google LLC in the United States; Google processes this data under its own standard contractual clauses. We do not currently use Facebook Pixel or other advertising/retargeting trackers.

You can change your mind at any time using the "Cookie Preferences" link in the footer, which lets you accept or reject analytics cookies again.

6. International transfers

Most of your personal data is stored within the UK/EU. Where a service provider (such as Google Analytics) processes data outside the UK, we rely on appropriate safeguards, such as the UK's International Data Transfer Addendum or the EU Standard Contractual Clauses, to ensure your data remains protected.

7. How long we keep your information

• Account data — for as long as your account is active, and for [PLACEHOLDER: retention period, e.g. "12 months"] after closure in case you return or for legal/accounting purposes.
• Order data — kept for [PLACEHOLDER: retention period, e.g. "6 years"] to meet accounting and consumer law obligations.
• Seller compliance records (food hygiene certificates, insurance details) — kept for as long as the shop is active on Forago, and for a reasonable period afterwards to meet food-safety record-keeping obligations.
• Analytics data — retained by Google Analytics according to our configured retention setting (typically 14 months).

8. Your rights

Under UK GDPR, you have the right to:

• Access the personal data we hold about you;
• Ask us to correct inaccurate data;
• Ask us to delete your data, in some circumstances;
• Ask us to restrict or object to certain processing;
• Receive your data in a portable format;
• Withdraw consent at any time, where we rely on consent (e.g. analytics cookies, optional health data);
• Complain to the Information Commissioner's Office (ICO) if you think we've mishandled your data.

To exercise any of these rights, contact us using the details in Section 11.

9. Children's privacy

Forago is not intended for use by children, and we do not knowingly collect personal data from children.

10. Changes to this policy

We may update this policy from time to time. If we make significant changes, we'll let registered users know by email or via a notice on the site. The "Last updated" date at the top of this page always reflects the current version.

11. Contact us

If you have any questions about this policy or how we handle your personal data, contact us at [PLACEHOLDER: Privacy contact email, e.g. "privacy@forago.co.uk"].