Privacy policy

Hop-In Express, the convenience store in Eastleigh that runs hopinexpress.com, is the data controller for the information described here. To ask about your data, use the contact page.

• Account: your name, email address, mobile number and password (stored as a hash; we cannot read it).
• Orders: what you ordered, the slot, the delivery address, the price paid, refunds, and the messages about swaps.
• Payment: the card brand and the last four digits, so you can recognise the payment. The card number itself goes to Stripe and never reaches us.
• Age verification: only the outcome, verified or not. The document you show is handled by the verification service and is not stored on your account.
• Messages: anything you send through the contact or franchise forms.
• Technical: your IP address and browser type in server logs, used for security and to keep the site running.

• To take, pick, deliver and refund your orders (performance of a contract).
• To check age for restricted products (legal obligation).
• To contact you about an order: a swap, a delay, a driver at the door (contract).
• To reset your password when you ask us to (contract).
• To answer messages you send us (legitimate interest).
• To keep the site secure and stop abuse (legitimate interest).

We do not send marketing emails or texts, and we do not sell or share your details for anyone else's marketing. Every email we send is about an order or your account.

• Stripe processes payments and refunds. They receive your card details and the amount.
• Resend delivers our emails. They receive your email address and the message.
• Our hosting providers store the website and database on our behalf.
• Our staff see your name, address and order to pick and deliver it. Managers can see who did what on each order.
• The police or a regulator, where the law requires it, for example an age-check inspection.

We use one cookie, to keep you signed in. Your basket and shopping list are kept in your browser's storage so they survive a refresh. We do not use advertising or tracking cookies.

Your account and orders for as long as you have an account, and order records for six years afterwards because tax law requires it. Age-verification outcomes for as long as the account exists. Messages you send us for two years. Server logs for 30 days.

Under UK GDPR you can ask us for a copy of your data, ask us to correct it, ask us to delete it (we may need to keep order records for tax), object to how we use it, or ask us to move it elsewhere. Ask through the contact page and we will reply within one month.

You can also complain to the Information Commissioner's Office at ico.org.uk, though we would rather you told us first.

The site is served over HTTPS, passwords are hashed, payment details never touch our servers, and staff access is by role and is logged. No system is perfect; if we ever find a breach that affects you, we will tell you.

The site is for adults. We do not knowingly hold data about anyone under 18.

We will update this page when anything changes, for instance when a new service handles part of your data. The date at the top tells you when.