Privacy & Cookie Policy
How we use and protect your information
This policy explains what personal information MASA Tortillas collects, why we collect it, how we use it, who we may share it with and the choices and rights you have.
One policy for both MASA websites
This policy applies to both our retail website at masa-tortillas.co.uk and our wholesale website at wholesale.masa-tortillas.co.uk.
Who we are
MASA Tortillas is a trading name of The Little Tortilleria Ltd.
For the purposes of UK data protection law, The Little Tortilleria Ltd is the controller of the personal information described in this policy unless otherwise stated.
The Little Tortilleria Ltd
Trading as MASA Tortillas
Company number: 13808662
Unit 5, Lawrence Hill Industrial Estate
Russell Town Avenue
Bristol
BS5 9LT
Email: hola@masa-tortillas.co.uk
Information we collect
1. Orders and purchases
When you place an order with us, we may collect information including:
- Your name
- Billing and delivery addresses
- Email address
- Telephone number
- Products ordered
- Order value and payment status
- Delivery method and delivery information
- Order history
- Notes or information you provide with your order
We use this information to process your order, take or verify payment, produce and dispatch your products, communicate with you about your order and deal with problems, returns, refunds or freshness issues.
2. Customer accounts
If you create an account, we store information needed to provide and manage that account, such as your contact details, saved addresses, order history and account information.
Account passwords are handled through our website systems and are not available to MASA staff as readable passwords.
3. Wholesale customers
For wholesale customers we may also process business information such as:
- Business or trading name
- Business address
- Contact person and job role
- Wholesale account information
- Standing or recurring order information
- Payment and Direct Debit information
- Order and account history
- Communications concerning your account
We use this information to manage our commercial relationship with you, fulfil orders, administer payments and provide customer support.
4. Subscriptions
If you purchase products on subscription, we process information needed to manage your recurring orders.
This may include your subscription status, products, frequency, renewal dates, payment status, delivery information and subscription history.
You can manage or cancel eligible subscriptions through your My Account page or by contacting us.
5. Contacting us
If you contact us by email, through a website form, by telephone or through another communication channel, we may retain the information you provide and our correspondence with you.
We use this information to respond to your enquiry, provide customer service and maintain appropriate records of our communications.
6. Website and technical information
When you use our websites, certain technical information may be collected automatically.
This may include:
- IP address
- Browser and device information
- Pages visited
- Date and time of visits
- Referring website or source
- Website interactions
- Login and security information
- Error, server and security logs
We use this information where appropriate to operate, secure, troubleshoot and improve our websites and to understand how they are used.
Why we use your information
UK data protection law requires us to have a lawful basis for processing personal information. Depending on what we are doing, we may rely on:
| What we use information for | Typical lawful basis |
|---|---|
| Processing and delivering orders, managing subscriptions and providing services you request | Performance of a contract or taking steps at your request before entering a contract |
| Accounting, tax and other records we are legally required to maintain | Legal obligation |
| Website security, fraud prevention, troubleshooting and protecting our business | Legitimate interests and, where applicable, legal obligations |
| Responding to enquiries and providing customer service | Contractual necessity and/or legitimate interests, depending on the circumstances |
| Understanding and improving our websites and services | Legitimate interests or consent where required |
| Email marketing and other promotional communications | Consent or another lawful basis permitted by applicable electronic marketing rules |
Who we share information with
We do not sell your personal information.
We do use trusted companies and service providers to operate our business. Personal information may therefore be shared with them where necessary.
These may include:
- Payment providers, including Stripe and other payment services offered through our websites
- Delivery companies, including Royal Mail for retail deliveries and APC and its delivery network for wholesale deliveries
- WooCommerce and associated ecommerce services used to operate our online shops, accounts, orders and subscriptions
- Mailchimp, where used for email marketing and related customer communications
- Google services, which may include Google Analytics, Google Tag Manager, Google Merchant Center and Google for WooCommerce
- Website hosting, security and infrastructure providers, including services used to host, protect and deliver our websites
- Email and communications providers used to send transactional and customer-service emails
- Professional advisers such as accountants, legal advisers or insurers where necessary
- Government bodies, regulators, law enforcement or other organisations where disclosure is required or permitted by law
We only share information that is reasonably necessary for the relevant purpose.
Payments
Online payments are processed using third-party payment providers such as Stripe and other payment services made available through our websites.
Payment providers may collect and process payment-card, banking, fraud-prevention and transaction information in accordance with their own privacy policies and legal obligations.
MASA does not normally receive or store your complete payment card number when a payment is processed through these providers.
Delivery information
To deliver an order we need to share certain information with the relevant delivery provider.
This will normally include your name, delivery address and information necessary to identify and deliver the parcel. Where required for delivery notifications or delivery management, it may also include your email address and/or telephone number.
Retail orders are generally delivered by Royal Mail and wholesale courier orders are generally delivered through APC. We may use other delivery providers where appropriate.
Email marketing
If you have subscribed to receive marketing communications, or where we are otherwise permitted to contact you under applicable electronic marketing rules, we may send you information about MASA products, offers and news.
We may use a service such as Mailchimp to manage marketing lists and send these communications.
You can unsubscribe from marketing emails at any time by using the unsubscribe link included in the email.
Unsubscribing from marketing does not prevent us from sending service messages that are necessary to manage an order, subscription or customer account.
Cookies & similar technologies
What are cookies?
Cookies are small files or pieces of information stored on or accessed from your device when you visit a website.
Websites can also use similar technologies such as pixels, tags, scripts and browser storage. In this policy we refer to these collectively as cookies and similar technologies.
How we use them
Our websites may use cookies and similar technologies for purposes including:
| Type | What they do |
|---|---|
| Essential | Help the website function correctly, including shopping baskets, checkout, customer accounts, security, payments and other services you request. |
| Preferences / functionality | Remember relevant choices or settings and provide website functionality. |
| Analytics | Help us understand how visitors use our websites and how the websites perform so that we can improve them. This may include Google Analytics or similar services. |
| Marketing and measurement | Where used and permitted, help us understand the effectiveness of advertising and marketing and measure interactions with our websites. |
Your cookie choices
Some technologies are necessary for the website or services you request to function and may be used without consent where the law permits.
Where consent is legally required for a cookie or similar technology, we will ask for that consent and provide an appropriate way to make or change your choice.
Google services
Our websites may use Google services including Google Analytics, Google Tag Manager, Google Merchant Center and Google for WooCommerce.
Depending on the services enabled and your cookie choices, these technologies may process information about your device, browser and interactions with our websites.
Google Tag Manager is used to manage website tags. The individual services or tags loaded through it may themselves collect or process information.
Managing cookies through your browser
Most browsers allow you to view, delete or block cookies through their settings.
Blocking essential cookies may prevent parts of our websites, including baskets, checkout or customer accounts, from working correctly.
Website security
We use security measures and services to help protect our websites, customer accounts and business systems.
This can involve processing technical information such as IP addresses, login attempts, browser information, security events and other activity associated with suspected malicious or fraudulent behaviour.
We may retain security and system logs for a reasonable period where necessary to investigate problems, protect our websites or establish, exercise or defend legal rights.
How long we keep your information
We do not intend to keep personal information for longer than we reasonably need it.
Different information needs to be kept for different periods. For example, we may retain:
- Order and transaction records for the period required for accounting, tax and legal purposes
- Customer account information while the account remains active and for an appropriate period afterwards
- Customer-service correspondence for as long as reasonably necessary to deal with the enquiry and maintain appropriate business records
- Subscription records for as long as necessary to administer the subscription and maintain appropriate transaction records
- Marketing information until you unsubscribe, withdraw consent where applicable, or we no longer need it
- Security and technical logs for an appropriate period based on their purpose
We may retain information for longer where required by law or where reasonably necessary in connection with a legal claim, dispute, fraud investigation or regulatory requirement.
International data transfers
Some of the service providers we use are international organisations or may process information outside the UK.
Where personal information is transferred internationally, we require appropriate protections to be used where required by UK data protection law. These may include adequacy regulations or approved contractual safeguards.
Your data protection rights
Depending on the circumstances, UK data protection law may give you rights in relation to your personal information, including the right to:
- Ask for access to personal information we hold about you
- Ask us to correct inaccurate or incomplete information
- Ask us to delete information in certain circumstances
- Ask us to restrict certain processing
- Object to certain processing
- Receive certain information in a portable format
- Withdraw consent where processing is based on consent
These rights do not apply in every circumstance and there may be legal reasons why we need to retain or continue processing certain information.
To exercise a data protection right, contact us at hola@masa-tortillas.co.uk .
Complaints
If you have a concern about how we use your personal information, please contact us first and we will try to resolve it.
You also have the right to complain to the UK's data protection regulator, the Information Commissioner's Office (ICO).
More information is available at ico.org.uk .
Changes to this policy
We may update this Privacy & Cookie Policy from time to time to reflect changes to our websites, services, suppliers or legal requirements.
The latest version will be published on this page.
Contact us about privacy
If you have any questions about this policy or how we handle your personal information, please contact:
The Little Tortilleria Ltd trading as MASA Tortillas
Unit 5, Lawrence Hill Industrial Estate
Russell Town Avenue
Bristol
BS5 9LT
Email: hola@masa-tortillas.co.uk
Last updated: September 2026.