Privacy Policy

Data Privacy, Third-Party Processors & GDPR Compliance

1. Payment Processing (Stripe)

Transaction safety: all financial transactions made through wildboys.uk, or via QR-directed checkout, are securely handled by Stripe, a PCI Service Provider Level 1 certified payment processor.

Data storage: Wild Boys Limited does not store, process, or hold raw payment card details, security codes, or full card numbers on our own servers or databases.

Tokenisation: payment data is fully tokenised and managed directly by Stripe under UK GDPR and PCI-DSS compliance standards.

2. Web Contact Forms & Email Signups (Formspree)

Form transmission: information submitted through website contact forms, or newsletter/email signups on wildboys.uk, is processed securely via Formspree.

Data agreements: Formspree acts as our third-party form processor under a compliant Data Processing Agreement (DPA), using standard TLS encryption in transit.

Use limitations: submitted customer details (names, emails, inquiry messages) are routed through Formspree solely for direct communication and order fulfilment. They are strictly confidential and never sold to external third parties.

AI Chat Assistant

The website features an AI chat assistant that answers questions about our products, ingredients, opening hours and policies.

1. Who is responsible

Wild Boys Limited is the data controller for anything you type into the chat. A.N.D Sovereign Group UK Limited built and maintains the assistant and acts as our data processor under a written agreement.

2. Where it runs

The assistant runs on our own hardware. Your questions are answered by a language model running locally on that machine. Your messages are not sent to OpenAI, Google, Anthropic or any other external AI provider, and they are not used to train anybody else's model.

3. What is stored, and for how long

What: the questions you ask, the answers given, and a randomly generated session reference that lets one conversation hold together. Nothing else. We do not ask for your name, there is no account, and no payment details ever pass through the chat.

How long: conversations are kept for up to 3 months, then deleted automatically. We read them to find out what customers actually ask, to correct wrong or unclear answers, and to improve the assistant for the next person. That work is done by us, on our own records, for Wild Boys only. Conversations are never sold, shared with advertisers, or pooled with another business's data.

Separation: each conversation is stored separately under its own reference. One visitor cannot see another visitor's conversation.

Stored on your device: when you open the chat, your browser stores one item — a randomly generated session reference — in session storage. It holds your conversation together while you are on the page and is deleted by your browser the moment you close the tab. It is not a tracking cookie, it is not shared with anyone, it contains nothing about you, and it is not used for advertising or analytics. It is strictly necessary for the chat to function, so no consent banner is required for it. The site sets no other cookies or device storage of any kind.

Short term memory: while you are chatting, the assistant remembers what you said earlier in that same conversation so it does not ask you the same thing twice. That memory is held temporarily, is never written anywhere permanent, and is discarded within four hours of the conversation ending.

4. Legal basis

Our legitimate interests in answering customer questions and improving our own customer service (UK GDPR Article 6(1)(f)). We have weighed that against your privacy, which is why the chat asks for no personal information and stores no more than the words exchanged.

Please do not type sensitive personal information into the chat. It is a customer service tool for questions about hot sauce. If you mention an allergy in order to ask a question, we will use it to answer you and nothing else, and you can ask us to delete it.

5. Your rights

You can ask for a copy of a conversation, or ask us to delete it, via the Contact section. Include the session reference shown in the chat window if you still have it, or tell us roughly when you visited and what you asked, and we will find it. We action deletion requests within one month, free of charge.

6. What the assistant will not do

It will not confirm that a product is safe for your allergy, it will not take payments, and it has no access to your order history or any customer database. It answers from our published product and policy information only. For anything allergy related, please confirm with a person before ordering.

Surveillance, Security & Asset Protection (Box Hill Stall)

1. Operator & Security Provider

The Wild Boys Box Hill retail stall is protected, managed, and monitored by A.N.D. Technologies, a subsidiary operating under A.N.D. Sovereign Group UK Limited.

2. Recorded Media & Operational Scope

To protect unmanned inventory and ensure a safe Click & Collect environment, the physical premises operate under active surveillance during monitoring hours (06:00–00:00). High-definition video and localised audio for threat verification are captured and streamed to secure, localised hardware.

3. Advanced Threat Detection & Biometric Processing

The site is monitored by AI computer vision infrastructure deployed for theft prevention, asset protection, and property damage deterrence. Processing of biometric image data and automated facial recognition is conducted strictly under the legal basis of Substantial Public Interest (Schedule 1, Data Protection Act 2018) for the explicit prevention and detection of unlawful acts. Standard video capture relies on Legitimate Interest for the protection of physical assets and business operations.

4. Incident Resolution & Law Enforcement Escalation

Recovery procedure: in the event of theft, fraud, or intentional property damage, compiled digital evidence will be used to establish the identity of responsible parties. Where identity is established, formal demands for civil recovery of stolen or damaged goods will be issued.

Law enforcement referral: failure to satisfy outstanding civil recovery claims within the designated timeframe will result in escalation to Surrey Police, including handover of unedited HD video, audio logs, facial identification data, and compiled evidence profiles for formal prosecution.

5. Data Rights, Transparency & Retention

Surveillance and data processing at this location are driven by the strict necessity of crime prevention, not by implied consent. To ensure data minimisation, routine non-incident footage is permanently destroyed within a rolling 48-hour window, and is only retained beyond this period where actively required as evidence of confirmed theft, fraud, or property damage. You retain your full rights under UK GDPR, including the right to request access to your data.

Your Rights

Under UK GDPR, you have the right to request access to, correction of, or erasure of your personal data, and to object to certain processing. For any data protection query, contact us via the Contact section of the site.