I don't usually read privacy policy updates in detail, but they've just sent out a headsup that they've amended their privacy policy. It now includes (not sure what it said before re Facebook):
"Facebook - Ocado Retail may share customers' personal data (mobile numbers and email addresses) with Facebook Ireland for the purposes of:
Identifying customers who use Facebook so we can advertise products we think would be of interest to them based on their Facebook profile.
Serving non Ocado Retail customers targeted marketing about our products and services on Facebook. This is done if we think that they are likely to be interested in our goods and services based on whether their profile matches those of our Customers.
Ocado Retail and Facebook Ireland are Joint Data Controllers for this processing and both parties have entered into a written agreement that sets out their respective responsibilities for carrying out the processing in a GDPR compliant manner. This includes a requirement for Ocado Retail to provide our customers with details of the processing we carry out (as detailed above) and an acknowledgment that Facebook Ireland will be responsible for enabling Data Subjects' GDR rights for any Personal Data it stores after the Joint Processing.
For further information about how Facebook Ireland processes your personal data, including the legal basis they rely on and the ways you can exercise your rights over the data they hold about you please visit www.facebook.com/about/privacy."
I assume the phone number is because Facebook can hold users' phone numbers (if they elect to give it to FB, which I don't).