Who we are
Masala Restaurants Ltd, trading as Masala (“we”, “us”, “our”), is an Irish takeaway business. We are the data controller for personal data collected when you place an order, contact us, or use our website or app.
Address: 14 Killiney Shopping Centre, Rochestown Avenue, Dún Laoghaire, Co. Dublin, A96 KV99
Email: admin@masala.ie
Phone: (01) 235 0099
This policy covers:
- our marketing website at masala.ie, including contact and catering forms;
- our ordering website at order.masala.ie; and
- the Masala Killiney customer app on iOS and Android.
There is no customer account or login. Orders are placed as a guest.
What we collect
When you browse masala.ie
masala.ie does not use advertising cookies, Google Analytics, or Vercel Analytics. The site is served through Cloudflare, which may load small security scripts (for example bot detection and email protection) and, if Web Analytics is enabled on our Cloudflare account, a cookieless performance beacon. These tools are not used to identify you or to advertise to you.
The site loads fonts from Google Fonts. Google may receive your IP address and browser details when those fonts are requested. The Contact page also embeds a Google Map so you can find the restaurant; Google may collect data according to its own policies if you interact with that map.
When you send a contact or catering enquiry
If you submit a form on the Contact or Catering pages, we collect what you provide:
- name and email address;
- phone number (required for catering enquiries; optional on the contact form);
- subject or event type, and your message;
- for catering: event date, guest count, and any venue or other details you include.
Forms are protected by Cloudflare Turnstile, a bot-detection service. Turnstile may process technical signals from your browser, including your IP address, to tell genuine visitors from automated abuse. We do not use Turnstile for advertising.
When you place an order
When you order through order.masala.ie or the app, we collect:
- name and phone number;
- email address, if you choose to provide one (used for order emails);
- order notes, if you add any;
- service type (delivery or collection) and scheduled time, if you select one;
- basket contents (items, options, quantities, and item notes);
- pricing (subtotal, delivery fee, discounts, tips, total);
- payment method (card, Apple Pay, Google Pay, or cash);
- whether the order came from the website, iOS app, or Android app.
For delivery orders we also collect the delivery address you enter, and an approximate location derived from that address so we can check delivery zones and charges. We do not use your device GPS.
If you use a coupon or promotion, we store the code and related discount against the order. A hashed version of your phone number may be checked against previous orders so we can apply “new or returning customer” discounts at checkout. We do not use this to send marketing messages.
How we use your data
We use personal data to:
- process, prepare, and fulfil your order (contract);
- check delivery areas and charges (contract);
- take payment securely through Stripe (contract);
- send order confirmation, updates, or rejection emails (contract);
- apply eligible checkout discounts, including new or returning customer offers (contract / legitimate interest);
- reply to contact and catering enquiries (legitimate interest or steps prior to a contract);
- keep business, tax, and accounting records (legal obligation /legitimate interest);
- protect our websites, forms, and ordering system from spam and abuse (legitimate interest);
- keep the ordering site reliable with privacy-friendly analytics and error monitoring, and understand how the marketing site is performing if Cloudflare Web Analytics is enabled (legitimate interest).
We do not sell your data. We do not use it for advertising or marketing unless you have asked us to (for example, by requesting catering information).
How orders are processed and tracked
- You submit checkout details to our ordering system.
- If you pay by card or wallet, Stripe processes the payment.
- Valid paid orders, and cash orders, are accepted for preparation. Some orders may be accepted automatically once they are valid and paid.
- The kitchen receives the order through HubRise for fulfilment.
- You can track status using the order link we send. That link includes a secret token — it is not a login, and we do not look orders up by email or phone on a public page.
Data stored on your device
The ordering website and app may store limited data locally, including:
- cart items;
- checkout details you have typed (name, phone, email, address);
- a last-order summary so you can return to tracking;
- cached menu data and display preferences (for example, light or dark theme).
This stays on your device. You can remove it by clearing site data in your browser, or by uninstalling the app / clearing app storage. Cart data on the website expires after a short period of inactivity. Checkout drafts on the website may remain until you complete an order or clear them.
masala.ie does not store checkout or order details in your browser.
How long we keep data
We keep personal data only while we need it for the purpose it was collected, or where the law requires us to keep it. We review this at least once a year.
- Completed orders: kept for tax, accounting, and to deal with disputes. Irish tax rules generally require business records for 6 years. We do not currently delete these records automatically after that. After each annual review we may delete or anonymise records that are no longer needed. You can still ask us to review your data (see Your rights).
- Abandoned, unpaid, or rejected orders: removed from the live ordering system, typically within about 24–48 hours.
- Short-lived technical records (for example checkout duplicate protection, and hashed rate-limit keys): deleted within about a day or two.
- Enquiry forms: kept while we reply and for a reasonable follow-up period. We review enquiry records at least once a year. You can ask us to delete them sooner, unless we still need them for a booking, complaint, or legal duty.
- Error and performance logs: kept only as long as needed to fix problems and understand site performance, then discarded under each provider’s settings.
- Payment records: retained by Stripe under their policies.
- Device storage: under your control, as described above.
International transfers
Some providers (including Stripe, Google, Vercel, Cloudflare, Resend, Sentry, Upstash, and Supabase) may process data outside the European Economic Area, including the United States. Where that happens, they rely on appropriate safeguards such as the EU-US Data Privacy Framework (where a provider is certified) and Standard Contractual Clauses. ZeptoMail is used via an EU endpoint.
Security
- data is transmitted over HTTPS;
- payments are handled by a PCI-compliant provider (Stripe);
- access to our systems is restricted to authorised staff;
- order tracking links use secret tokens;
- website forms and checkout are protected by Cloudflare Turnstile.
No system is completely secure, but we follow industry practice to protect your data.
Your rights
Under GDPR you may have the right to:
- access your personal data;
- correct inaccurate data;
- ask us to delete data, where that is legally possible;
- restrict processing;
- object to processing based on legitimate interests;
- withdraw consent, where we rely on consent;
- receive data you provided in a portable format.
Email admin@masala.ie with the subject line “Privacy request — Masala”. Include your name, the phone number and/or email you used, and approximate dates of any orders or enquiries. We may need to verify your identity.
We do not currently rely on consent for advertising or analytics. If that changes, you would be able to withdraw consent at any time without affecting earlier lawful processing. Objecting to legitimate-interest processing is done through the same email request.
We aim to respond within 30 days. We may keep some records where we must, for example for tax, accounting, payment, or dispute purposes.
You can also contact the Irish Data Protection Commission atdataprotection.ie.
Children
Our website, ordering system, and app are not intended for children under 16. We do not knowingly collect data from children.
Changes to this policy
We may update this policy from time to time. The latest version will always be on this page, with the “Last updated” date at the top.
Contact us
Masala Restaurants Ltd
14 Killiney Shopping Centre, Rochestown Avenue, Dún Laoghaire, Co. Dublin, A96 KV99
admin@masala.ie · (01) 235 0099
Related: Terms & Conditions