1. Who is responsible for your data
Roam operates this storefront and is the data controller for your account, your orders and your use of the site. The Darlington Direct Associationsupplies its membership roster (business names, addresses, contact details and membership numbers) so that member businesses can be recognised; the Association remains responsible for that roster and Roam processes it on the Association's behalf, only to run the membership features described here.
2. What we collect
- Account: your e-mail address, display name and sign-in details.
- Orders: what you ordered, from which venue, the amount, the collection code and, for delivery, the address you give us.
- Location: the town you choose on the storefront, or your device location if you allow it, to show venues near you.
- Usage: pages viewed and actions taken, only if you accept analytics (see section 5).
- Business users: if you activate a venue, the details you enter about the business and, for Association members, your membership number.
3. How we use it
To take and fulfil orders, to show you nearby venues, to run your account, to recognise Association members, to keep the site safe (fraud and abuse prevention, moderation) and to tell you about your orders. We rely on our contract with you, our legitimate interest in running a safe service, and your consent where the law requires it (analytics cookies).
4. Who receives it
- The venue you order from receives your name, your order, your collection code and, for delivery, your address and contact details — it needs them to prepare and hand over your order.
- Stripe processes card payments; Roam never sees your full card number.
- Brevo sends transactional e-mail (for example order updates) on our behalf.
- Supabase hosts our database; Railway and our web host run the service.
- Google supplies some venue listings, photos and maps data, and — only if you accept analytics — Google Analytics receives usage data.
- The Darlington Direct Association may see aggregate figures about the storefront (for example how many member businesses are active) and the status of its own roster. It does not receive your account or order details.
- Public authorities or advisers where the law requires.
5. Cookies and analytics
Essential cookies keep you signed in and remember choices such as your town and your cookie decision. Analytics cookies (Google Analytics) are set only after you choose “Accept analytics” in the cookie banner; choosing “Essential only” keeps the site working with no analytics at all. You can change your choice by clearing the site's cookies.
6. Food hygiene ratings
Ratings shown on venue pages are public information published by the Food Standards Agency under the Open Government Licence. They concern businesses, not individuals.
7. Your rights
You can access, correct, export or erase your personal data, object to or restrict certain processing, and complain to the Information Commissioner's Office. You can delete your account at any time from your account page; order records needed for accounting and dispute handling are kept for the period the law requires and then removed. Association members can also ask the Association to correct roster details.
8. Retention and security
Account data is kept while your account exists. Order and payment records are kept for up to six years for accounting and legal purposes. Roster data is kept while the business is on the Association's roster and for a short period after it lapses, then removed. Data is stored in the UK/EEA on encrypted infrastructure with access restricted to staff who need it.
9. Contact
For privacy questions or to exercise your rights, contact Roam through the support details on your account page. For questions about the Association's roster, contact the Association.