Buraq Flash · Buraq Table

Privacy

Last updated 2 September 2026

This is the short, plain version of how BuraqHospitality Ltd handles your information when you order lunch from Buraq Flash or Buraq Table, message Mr Flash, or contact us.

Who we are

BuraqHospitality Ltd, company no. 17153833, registered office 30 Pennant Crescent, Cardiff CF23 6LN. We are the data controller. Contact for anything in this notice: admin@buraqhospitality.co.uk.

What we collect

To take your order: your name, email address, phone number, delivery address and postcode, and what you ordered.
Payment: whether an order is paid and the payment reference. Card, Apple Pay and Google Pay details go straight to SumUp; we never see or store card numbers.
Notes you add: including any allergy or dietary note, which we treat as health information you have chosen to give us so we can keep you safe.
Messages: what you type to Mr Flash, and WhatsApp messages you send us.
Buraq Table: your office code, and — if your employer pays — your name and order on that office's roster and invoice.
Technical: IP address and browser type, used for security, rate limits and cookie-free page counts.

Why we use it

To take, cook, deliver and confirm your order, and to send you the sign-in code for your account (performing our contract with you).
To act on allergy notes (your explicit consent, and our food-safety duties).
To keep order and invoice records (legal obligation — tax and food law).
To send you menus and offers by email, WhatsApp or push notification only if you opt in. Unsubscribe any time from the message or in the app (consent).
To keep the service secure and stop abuse (legitimate interest).
Mr Flash requests ("do you do X?") are logged so Hooria can read them. Mr Flash cannot issue discounts or vouchers.

Who processes it for us

Cloudflare — hosting, security and cookie-free analytics (page counts only).
Resend — sends our emails (sign-in codes, confirmations, receipts).
SumUp — takes card, Apple Pay and Google Pay payments under its own privacy notice.
Meta (WhatsApp) — if you message us on WhatsApp, Meta processes that message under its own terms.
Your employer's organiser (Buraq Table only) — sees names and orders on the office roster so the boxes can be labelled and invoiced.

We don't sell your information or share it with anyone else for marketing.

How long we keep it

Orders, payments and invoices: six years (HMRC records).
Your account details: while you have an account, then 12 months after your last order.
Mr Flash and WhatsApp messages: 12 months.
Sign-in codes: minutes. Push subscriptions: until you turn them off.

Cookies and storage

We don't use tracking cookies or a cookie banner. This site remembers the poster or link you came from for seven days (so we know which posters work), and the app stores your sign-in session and preferences on your device.

Your rights

You can ask for a copy of your information, have it corrected or deleted, restrict or object to how we use it, take it elsewhere, and withdraw consent at any time. Email admin@buraqhospitality.co.uk; we reply within one month. You can also complain to the Information Commissioner's Office at ico.org.uk.

Changes

If this notice changes in a way that matters, we'll say so on the site and in the app before it takes effect.