What we collect when you order, why we need it, who helps us, and your rights.
Last updated: 16 October 2026
Who we are
Moza Maas Ltd (company no. 15846070, registered office: 15 Grafton Road, Newport, Wales, NP19 0AS) owns and operates the YO! Sushi kiosks at Tesco Extra, Accrington and Tesco, Padiham, and the Panku kiosk at Asda, Colne, under licence.
Under our franchise agreements, the franchisor, Wonderfield Group (Asian Counters UK Ltd for the YO! Sushi kiosks and Taiko Foods Ltd for the Panku kiosk), is the data controller for customer details, such as your name, contact details and orders. We collect and use them on the franchisor's behalf. Moza Maas Ltd is the data controller for its own accounting, payment and tax records, and for delivery hand-over photos.
Questions about your data? Email us at mozamaasltd@gmail.com. Come to us first. We'll answer, and if your request is for the franchisor, Wonderfield Group, we'll pass it on.
What we collect
| Information | When we get it |
|---|---|
| Your name | On the payment page |
| Email address | On the payment page, so Stripe can send your receipt |
| Phone number | On the payment page, so we can reach you about the order |
| Workplace or organisation | On the payment page, if you give it |
| Allergy notes | On the payment page or in an email, if you give them |
| Order details: kiosk, items, date and time, collection or delivery, any offer code, amount paid | When you order |
| Delivery postcode | On the order page, when you check whether we deliver to you |
| Delivery address | On the payment page, for delivery orders only |
| A photo of the person receiving a delivery | At hand-over, taken by our delivery driver, for delivery orders only |
| Card billing address or postcode | On the payment page, if Stripe asks for it |
| Whether you ticked the box to hear about offers | On the order page |
| Messages you send us | If you email us |
| Your IP address and browser details | When you visit this website (see "Who helps us") |
Card details. Your card details go straight to Stripe. We never see your card number or security code, and we don't store card details.
Why we use it
| What we do | Information used | Lawful basis |
|---|---|---|
| Make your order, hand it over or deliver it, and send your receipt | Name, email, phone, workplace, order details, delivery postcode and address | Contract: we need it to do what you asked |
| Confirm a delivery was handed over, and deal with any dispute about it | Hand-over photo | Legitimate interests: showing that we delivered your order |
| Prepare food safely for anyone with an allergy | Allergy notes | Your explicit consent, given when you tell us. Allergy information is health information, so we treat it with extra care. |
| Keep tax and accounting records | Order and payment records | Legal obligation |
| Keep payments secure and prevent fraud | Payment and order details | Legitimate interests (Stripe does this) |
| Run this website securely | IP address and browser details | Legitimate interests |
| Tell you about kiosk pre-order offers by email | Name, email | Your consent: the tick box on the order page |
Marketing. We only send pre-order offers if you tick the box on the order page. It is never ticked for you. Use the unsubscribe link in any email, or tell us, and we'll stop. Saying no doesn't affect your orders.
Allergy notes. We use them only to make that order safely. You don't need to tell us who has the allergy: "one person, no sesame" is enough.
Delivery photos. When we deliver, our driver takes a photo of the person receiving the food at hand-over. We take it only to confirm delivery and to deal with any dispute about it, which is in our legitimate interests. We only share it if a delivery or payment is disputed, for example with Stripe and your card issuer. We keep it for 30 days and then delete it. We never use it for marketing. The person in the photo can ask for a copy or object to it: email mozamaasltd@gmail.com.
Who helps us
These companies process data for us to run the ordering service.
| Company | What they do | What they receive |
|---|---|---|
| Stripe | Takes your card payment, emails your receipt and checks for fraud | Your name, email, phone, workplace, allergy notes, delivery and billing address, order details and card details. Stripe is also responsible for some data itself, for example for fraud prevention. See stripe.com/gb/privacy. |
| Supabase | Runs the ordering function behind the Pay button and the kiosk team's order list. It checks your basket against the menu, prices and notice rules, checks a delivery postcode is in range, and opens your Stripe payment page. When the kiosk team looks up paid orders, it fetches them from Stripe to show them. It doesn't keep its own database of orders. | From the Pay button: your basket (kiosk, items, date, time, any offer code, whether you ticked the offers box) and delivery postcode, plus your IP address. For the kiosk team's order list: the paid order details held by Stripe, including your name, contact details, workplace and allergy notes. |
| postcodes.io | Looks up a delivery postcode so we can check the distance from the kiosk | The postcode you enter and your IP address. Not your name or other details. |
| GitHub Pages (GitHub, Inc.) | Hosts this website | Your IP address and browser details, which GitHub logs for security |
| Google Fonts (Google) | Supplies the typefaces this website uses | Your IP address and browser details, when your browser loads the fonts |
We also use everyday business tools, such as email and messaging services, to deal with orders and messages, and to send paid orders to the kiosk team. They act only on our instructions.
The franchisor, as data controller, can access customer details under our franchise agreement. Each month we tell the franchisor the total value of online payments. Those totals don't include your personal details.
We never sell your data. Apart from the companies above and the franchisor, we only share it if the law requires it, for example with HMRC.
Data stored outside the UK
Stripe, Supabase, GitHub and Google, and some of the email and messaging services we use, are international companies. They may store or access data outside the UK, including in the United States. Where they do, they use safeguards recognised under UK data protection law, such as the UK International Data Transfer Addendum or the UK–US data bridge.
How long we keep it
| Information | How long |
|---|---|
| Order and payment records | 6 years, for tax |
| Allergy notes | Kept only with that order's record. We never copy them into a contact or marketing list or use them for another order. You can ask us to delete them once your order is complete. |
| Delivery hand-over photos | 30 days, then deleted |
| Your marketing choice | Until you opt out. After that we keep a note of your opt-out so we don't contact you again. |
| Messages you send us | As long as we need them to deal with your order or question |
| Website logs | As set by GitHub and Google for security |
Your rights
Under UK data protection law (UK GDPR and the Data Protection Act 2018) you can ask us to:
- give you a copy of the information we hold about you
- correct anything that's wrong
- delete your information, unless we have to keep it (for example, tax records)
- limit how we use it, or object to us using it
- give you your information in a format you can take elsewhere
- stop marketing, or withdraw any consent, at any time
To use any of these rights, email mozamaasltd@gmail.com. There's no charge. We'll reply within one month.
Complaints
If you're unhappy with how we've handled your information, please tell us first at mozamaasltd@gmail.com. We'll acknowledge your complaint within 30 days and reply as soon as we can.
You can also complain to the UK's data protection regulator, the Information Commissioner's Office (ICO): ico.org.uk/make-a-complaint or 0303 123 1113.
Changes to this notice
If we change this notice, we'll update the date at the top of this page.