Privacy Policy

Last updated: [Insert Date]

1. Introduction Quiet City Coffee ("we", "us", "our") operates as a coffee shop in England. This Privacy Policy explains how we collect, use, store, share, and protect your personal information when you visit our premises, use our website (if applicable), follow or interact with our social media, or otherwise communicate with us.

We are committed to complying with applicable data protection laws, including the UK General Data Protection Regulation (UK GDPR) and the Data Protection Act 2018.

By using our services or providing any personal information to us, you acknowledge that you have read and understood this Privacy Policy.

2. Data Controller The data controller is: Quiet City Coffee [Insert Postal Address] [Insert Email Address] [Insert Phone Number]

3. Information We Collect We may collect and process the following types of personal data:

3.1 Information you provide directly

• Contact details (e.g., name, email address, phone number)
• Payment information (e.g., card details processed through a secure payment provider – we do not store full card details)
• Billing and delivery address if you order products for takeaway or delivery (where offered)
• Account details (e.g., username, password) if you create an online account or loyalty account
• Communication content (e.g., emails, messages, feedback, reviews, and survey responses)

3.2 Information collected automatically When you visit our website or use our online services, we may automatically collect:

• Technical information (e.g., IP address, browser type and version, device identifiers, operating system)
• Usage data (e.g., pages visited, time spent on pages, links clicked, referring pages)
• Cookie data and similar technologies (for preferences, analytics, and security)

3.3 In-store information When you visit our coffee shop, we may collect:

• CCTV footage for security and safety purposes (where CCTV is in operation and clearly signposted)
• Information related to in-person payments and receipts

3.4 Social media information If you interact with us via social media platforms (e.g., by liking, following, commenting, messaging, or tagging us), we may see and process information you choose to share publicly or directly with us on those platforms in accordance with the platforms’ own privacy settings.

4. Legal Bases for Processing We only process your personal data where we have a lawful basis to do so under UK data protection laws. These bases may include:

   • Contract: where processing is necessary to provide you with products or services you have requested.
   • Legitimate interests: for example, ensuring the security of our premises and systems, improving our services, and marketing to existing customers in a proportionate way.
   • Consent: where you have given us clear consent to process your data for a specific purpose (e.g., to receive marketing emails).
   • Legal obligation: where we are required to comply with laws and regulations.

5. How We Use Your Information We may use your personal data for the following purposes:

   • To process and fulfill your orders (in-store or online, where available)
   • To respond to your enquiries, requests, and complaints
   • To manage any accounts or loyalty schemes you register for
   • To process payments and issue receipts or invoices
   • To send you service-related communications (e.g., order updates, changes to our terms or policies)
   • To send you marketing communications with your consent or where otherwise permitted by law
   • To personalise and improve your experience with us (e.g., tailoring offers or content)
   • To manage, operate, maintain, and secure our website, systems, and premises
   • To conduct analytics, research, and service improvements
   • To comply with legal and regulatory obligations and to establish, exercise, or defend legal claims

6. Cookies and Similar Technologies Our website (if applicable) may use cookies and similar technologies to:

   • Remember your preferences and settings
   • Improve website functionality and performance
   • Analyse how visitors use our website
   • Support security and fraud prevention

You can manage cookies through your browser settings and, where applicable, through any cookie banner or preference centre on our website. Disabling certain cookies may affect the functionality of the website.

7. How We Share Your Information We may share your personal data with:
   • Service providers and business partners who perform services on our behalf (e.g., payment processors, website hosting, email services, IT support, delivery services where offered, marketing platforms)
   • Professional advisors (e.g., accountants, legal advisors, insurers)
   • Law enforcement, regulatory bodies, or public authorities where required by law or necessary to protect our legal rights or those of others
   • Third parties in connection with a business transaction, such as a merger, acquisition, or sale of assets, in which case we will take steps to ensure your privacy rights continue to be protected

We require all third-party service providers to respect the security of your personal data and to process it only in accordance with our instructions and applicable law.

8. International Transfers If we transfer your personal data outside the United Kingdom (for example, where our service providers host data on servers outside the UK), we will ensure that an adequate level of protection is in place, such as:

   • An adequacy decision by the UK government, or
   • Appropriate safeguards, such as the UK International Data Transfer Agreement or other approved contractual clauses.

9. Data Retention We retain personal data only for as long as necessary to fulfil the purposes described in this Privacy Policy, including meeting legal, accounting, or reporting requirements. The retention period may vary depending on the type of data and our legal obligations.

When we no longer need your personal data, we will securely delete or anonymise it.

10. Data Security We take appropriate technical and organisational measures to protect your personal data against accidental or unlawful destruction, loss, alteration, unauthorised disclosure, or access. These measures may include encryption, access controls, secure networks, staff training, and regular review of our security practices.

However, no method of transmission or storage is completely secure, and we cannot guarantee absolute security.

11. Your Rights Under UK data protection law, you have certain rights regarding your personal data, which may include:
    • Right of access: to obtain a copy of your personal data and information about how we process it.
    • Right to rectification: to have inaccurate or incomplete personal data corrected.
    • Right to erasure: to request deletion of your personal data in certain circumstances.
    • Right to restriction of processing: to limit how we use your data in certain circumstances.
    • Right to data portability: to receive your personal data in a structured, commonly used, machine-readable format and to transmit it to another controller where technically feasible and lawful.
    • Right to object: to object to our processing of your data where we rely on legitimate interests or for direct marketing.
    • Right to withdraw consent: where we rely on your consent, you can withdraw it at any time. This will not affect the lawfulness of processing prior to withdrawal.

To exercise any of these rights, please contact us using the details in the "Contact Us" section below. We may need to confirm your identity before responding to your request.

12. Marketing Communications We may send you marketing communications (such as news, offers, events, or promotions) if you:
    • Have opted in to receive them, or
    • Are an existing customer and we have a lawful basis to do so under applicable law.

You can opt out of marketing at any time by following the unsubscribe instructions in our emails or by contacting us directly. Even if you opt out of marketing, we may still send you non-marketing communications (such as order confirmations or legal notices).

13. Children’s Privacy Our services are not intended for children under 13 years of age, and we do not knowingly collect personal data from children under 13. If you believe that a child under 13 has provided us with personal data, please contact us so that we can delete it where required.

14. Third-Party Websites and Services Our website or communications may contain links to third-party websites, plug-ins, or services. We are not responsible for the privacy practices or content of these third parties. We encourage you to read the privacy policies of any third-party sites or services you visit or use.

15. Changes to This Privacy Policy We may update this Privacy Policy from time to time to reflect changes in our practices, services, or legal requirements. The updated version will be indicated by a revised "Last updated" date at the top of this page. We encourage you to review this Privacy Policy periodically.

16. Contact Us If you have any questions, concerns, or requests regarding this Privacy Policy or our handling of your personal data, please contact us at:

Quiet City Coffee [Insert Postal Address] Email: [Insert Email Address] Phone: [Insert Phone Number]

You also have the right to lodge a complaint with the UK data protection authority:

Information Commissioner’s Office (ICO) Website: https://ico.org.uk Phone: 0303 123 1113 Address: Wycliffe House, Water Lane, Wilmslow, Cheshire, SK9 5AF, United Kingdom.