Legal

Privacy Policy

Last updated: 4 August 2026

1. The data we collect

We only collect what we need to run the shop and serve you well:

• Order & account details — your name, email, delivery and billing address, phone number, order history and any account you create.
• Payment information — card payments are processed by Stripe and PayPal. We receive confirmation of payment and the last few digits/card type, but never your full card number or security code.
• Communications — messages you send us, and your marketing and email preferences.
• Technical data — basic information your browser sends automatically, such as your IP address, device and browser type, and how you move through the site. See our Cookie Policy for detail.

2. Why we use it, and our lawful basis

• To fulfil your order — taking payment, roasting, delivering and supporting your purchase, and managing subscriptions and your account. Lawful basis: performance of a contract.
• To meet our legal duties — keeping accounting and tax records. Lawful basis: legal obligation.
• To run and protect the site — keeping it secure, preventing fraud, and improving how it works. Lawful basis: our legitimate interests.
• To send marketing — newsletters and offers, only where you have asked to receive them. Lawful basis: consent. You can unsubscribe at any time.

3. Who we share it with

We do not sell your personal data. We share it only with the service providers who help us operate the business, and only as far as they need it:

• Our e-commerce platform and hosting provider (Medusa), which stores order and account data;
• Payment providers Stripe and PayPal, to take and secure your payment;
• Delivery partners (such as Royal Mail and couriers), to deliver your order;
• Email providers, to send order confirmations and — where you have opted in — newsletters;
• Our accounting software, to raise invoices and keep required financial records.

We may also disclose data where the law requires it, or to protect our rights. Each provider is bound to keep your data secure and to use it only on our instructions.

4. Where your data is held

We aim to keep your data within the UK and European Economic Area. Some of our providers (for example, payment processors) may process data in other countries. Where that happens, we rely on appropriate safeguards recognised under UK data protection law — such as a UK adequacy decision or standard contractual clauses — so your data stays protected.

5. How long we keep it

• Order and transaction records: kept for 6 years to meet HMRC and accounting requirements.
• Account details: kept while your account is open; closed accounts are deleted or anonymised.
• Marketing preferences: kept until you unsubscribe or ask us to remove them.

6. Keeping your data secure

We use appropriate technical and organisational measures to protect your data, including encrypted connections (HTTPS), access controls, and trusted providers for payment and hosting. No method of transmission over the internet is completely secure, but we take reasonable steps to protect the information you share with us.

7. Your rights

Under UK data protection law you have the right to:

• ask for a copy of the personal data we hold about you (free of charge);
• have inaccurate data corrected;
• ask us to delete your data, or restrict how we use it;
• object to processing based on our legitimate interests, and to direct marketing at any time;
• ask us to transfer your data to another provider; and
• withdraw any consent you have given, without affecting earlier processing.

To exercise any of these, email info@buxtonroastery.co.uk. We will respond within one month.

8. Complaints

We hope to resolve any concern directly, so please contact us first. You also have the right to complain to the UK’s data protection regulator, the Information Commissioner’s Office (ICO), at ico.org.uk or on 0303 123 1113.

9. Changes to this policy

We may update this policy from time to time. Any changes will be posted here with a revised “last updated” date.