Privacy policy
What we collect when you order coffee from us, why we hold it, and how to get it back or have it deleted.
[SQUARE BRACKET] below is a blank the business needs to fill, and the whole document should be checked by someone qualified before the store takes real orders.
Who we are
This site is operated by [REGISTERED COMPANY NAME], a company registered in [ENGLAND AND WALES] under number [COMPANY NUMBER], with its registered office at [REGISTERED ADDRESS].
For the purposes of UK GDPR we are the data controller for the information described below. Our registration with the Information Commissioner's Office is [ICO REGISTRATION NUMBER].
Our data protection contact is [NAME OR ROLE], reachable at [PRIVACY EMAIL].
What we collect
We collect the following when you buy from us or create an account:
- Name, delivery address, billing address, email address and telephone number.
- Order history, subscription frequency, and the brewing equipment you tell us you use.
- Payment card details are handled entirely by our payment provider, [PAYMENT PROVIDER]. We never see or store full card numbers.
- Technical data: IP address, browser and device type, and pages visited on this site.
- Any messages you send us by email, contact form or social media.
Why we use it
We rely on the following lawful bases under UK GDPR:
- Contract — to take payment, roast and dispatch your order, and manage your subscription.
- Legitimate interests — to prevent fraud, to improve the site, and to answer your questions.
- Consent — to send marketing email, which you can withdraw at any time using the unsubscribe link in any message.
- Legal obligation — to keep records required by tax and company law.
Who we share it with
We share the minimum necessary with the suppliers who make the service work: [PAYMENT PROVIDER] for payments, [DELIVERY CARRIER] for delivery, [EMAIL PLATFORM] for order and marketing email, and [HOSTING PROVIDER] for hosting.
We do not sell your personal data, and we do not share it for anyone else's marketing.
Where a supplier processes data outside the UK, that transfer is covered by [TRANSFER MECHANISM, e.g. UK International Data Transfer Agreement].
How long we keep it
Order and payment records are kept for [NUMBER] years to meet HMRC requirements. Account details are kept while your account is open and for [NUMBER] months afterwards. Marketing consent records are kept until you withdraw consent, plus [NUMBER] months.
Your rights
You have the right to ask for a copy of the data we hold on you, to have it corrected or deleted, to object to or restrict how we use it, and to receive it in a portable format.
To exercise any of these, write to [PRIVACY EMAIL]. We will respond within one month.
If you are unhappy with our response you can complain to the Information Commissioner's Office at ico.org.uk, or on 0303 123 1113.
Cookies
Cookies are covered separately in our cookie policy, which explains what each one does and how to turn the optional ones off.
Changes to this policy
If we change how we handle your data we will update this page and, where the change is significant, tell you by email.
Questions about this page
Write to [SUPPORT EMAIL], or by post to [REGISTERED COMPANY NAME], [REGISTERED ADDRESS].
Back to the coffee
Tell us how you make it and we will match the grind to your kit.