Privacy policy

Cafédirect Roastery Limited ("we", "us" or "our") is committed to protecting and respecting your privacy. We collect and process personal information when you shop with us or interact with us online at www.cafedirect.co.uk ("our site").

Last updated: 30 September 2026

We use this information to make your shopping experience as easy and enjoyable as possible. We need it to process your order, inform you of any delays or problems and occasionally to send you offers and promotions, subject to any preference that you may indicate when submitting your personal information.

This policy, together with our terms and conditions of supply, our terms of website use, and our cookie policy, sets out the basis on which any personal information we collect from you, or that you provide to us, will be processed by us. Please read it carefully to understand how we treat your personal information.

We process your personal information in accordance with UK data protection law, including the UK General Data Protection Regulation (UK GDPR) as amended by the Data (Use and Access) Act 2025, and the Data Protection Act 2018.

In short: your information belongs to you. We'll be clear about what we collect and why, we'll only use it for the purposes set out below, and you're in control of your marketing preferences at any time — via your account, or the unsubscribe link in any email.

The data controller is Cafédirect PLC (Cafédirect Roastery Limited is a wholly owned subsidiary of Cafédirect PLC), whose registered address is 115 George Street, Edinburgh, Scotland, EH2 4JN, correspondence address: The Roastery, Bent Ley Industrial Estate, Bent Ley Road, Meltham, Huddersfield, HD9 4EP. If you have any questions about this policy or about how we handle your personal information, please contact us at privacy@cafedirect.co.uk.

Information we may collect from you

We may collect and process the following information about you:

• When you order or enquire about our products we will need your name, postal address, delivery address, email address and telephone number. Payment is processed securely by our payment provider; we do not collect or store your full payment card details. If you order products for a third party we will need their delivery address.
• Information that you provide by filling in forms on our site www.cafedirect.co.uk (our site). This includes information provided at the time of registering to use our site, subscribing to our service, posting material or requesting further services. We may also ask you for information when you enter a competition or promotion sponsored by Cafedirect Plc, and when you report a problem with our site.
• If you contact us, we may keep a record of that correspondence.
• We may also ask you to complete surveys that we use for research purposes, although you do not have to respond to them.
• Details of transactions you carry out through our site and of the fulfilment of your orders.
• Details of your visits to our site including, but not limited to, traffic data, location data, weblogs and other communication data, information about how you interact with our pages, whether this is required for our own billing purposes or otherwise, and the resources that you access.
• Identifiers and browser information stored on your device and sent to our analytics and server-side tracking provider when you visit, before you make a cookie choice, so that a later order can be measured and linked to your visit (see "Order measurement and attribution" below).

The lawful bases we rely on

We only use your personal information where the law allows us to. Depending on the activity, we rely on one or more of the following lawful bases:

• Performance of a contract — to process and fulfil your orders, manage your subscription, take payment, and provide customer service.
• Legal obligation — to keep records we are required by law to hold, such as tax and accounting records.
• Consent — for certain marketing communications, for non-essential cookies and similar technologies (including session recording tools and advertising technologies), and for sharing data with advertising platforms to build audiences and show you relevant ads. You can withdraw your consent at any time.
• Legitimate interests — to operate, secure and improve our site, understand how it is used (including through the limited, cookie-free signals described under "Google Consent Mode" below), prevent fraud, and market similar products to our existing customers. Where we rely on legitimate interests, we balance them against your rights and freedoms. We also rely on legitimate interests to measure completed orders and the performance of our shop and advertising, including where you have declined non-essential cookies (see "Order measurement and attribution" below).

Cookies and similar technologies

When you visit our site, we and our partners use cookies and similar technologies to make the site work, remember your preferences, measure how the site is used, and deliver advertising that is relevant to you. Some of these technologies collect information such as your IP address, device and browser type, and the pages you visit.

We use cookies and similar technologies for the following purposes:

• Strictly necessary — to run the site and enable core functions such as checkout and account login. These do not require your consent.
• Performance and analytics — to understand how visitors use the site so that we can improve it. This includes tools that measure traffic and, where you have consented, tools that show us how people interact with our pages (see "How we analyse how you use our site" below).
• Functionality — to remember your preferences and personalise your experience.
• Advertising — to measure our advertising and show you relevant ads on other sites and platforms.

We manage cookies through our consent management tool. When you first visit the site you can accept or reject non-essential cookies, and you can change your choice at any time using the cookie settings on our site. In line with current UK rules, certain low-risk analytics and functional technologies may be used without prior consent, but we still tell you about them and you can object. Session recording and advertising technologies are only used with your consent, apart from the limited, cookie-free Google signals described under "Google Consent Mode" below and the order measurement described under "Order measurement and attribution" below. Full details of the cookies and similar technologies we use, including who sets them and how long they last, are set out in our cookie policy, which we keep up to date.

Please note that any businesses or companies websites that we may provide links to on our site may also use cookies, over which we have no control.

How we analyse how you use our site

We use analytics tools to understand how visitors find and use our site, so that we can fix problems and improve the shopping experience. Where you have consented, we may also use tools that show us how people interact with our pages, such as session recordings and heatmaps. Examples include Google Analytics and Microsoft Clarity.

These tools may capture information such as the pages you view, where you click, tap and scroll, your device and browser type, and your approximate location. We configure them to mask sensitive information, such as details you type into forms and the information shown in your account pages.

Some providers of these tools act as independent controllers of the data they collect and may use it under their own privacy notices. For example, Microsoft is an independent controller for Clarity, and may use the data it collects to improve its products and for advertising purposes. You can read Microsoft's privacy statement at privacy.microsoft.com/en-us/privacystatement.

Advertising and marketing

Email and SMS marketing. If you are an existing customer, we may send you marketing about similar products unless you tell us not to. Otherwise, we send marketing only where you have consented. You can opt out at any time using the unsubscribe link in any message or by contacting us. We use a specialist email and SMS service provider to send these messages on our behalf.

Online advertising and measurement. We work with advertising platforms, such as Google and Meta (Facebook and Instagram), to measure the performance of our advertising and to show relevant ads to people who have shown an interest in our products, including our existing customers. This involves:

• Advertising cookies and tags which, with your consent, allow us to measure our advertising and show you ads after you have visited our site (remarketing).
• Sharing certain data with these platforms, including hashed identifiers such as your email address or telephone number, and information about your purchases and activity on our site, so that we can measure conversions and build and target advertising audiences. This uses the platforms' own audience-matching and conversion-measurement tools. Some of this sharing happens from your browser, and some happens server-side, from our systems or through a service provider acting on our behalf.

When we share data with advertising platforms in this way, they act as independent or joint controllers and also process the data under their own terms. We rely on your consent for advertising cookies, remarketing and building advertising audiences, and you can withdraw it at any time through our cookie settings. Measurement of completed orders is described under "Order measurement and attribution" below. For more information on how these platforms use data, please see their own privacy notices. The cookies and similar technologies involved are listed in our cookie policy, and you can ask us for details of the providers we use at privacy@cafedirect.co.uk.

Google Consent Mode. We use Google Consent Mode to pass your cookie choices to Google. Google tags on our site load when you arrive, before you make a choice, but until you accept they set no cookies. While you have not consented, or if you decline, they send limited signals to Google without using cookies: whether you have consented, that a page was viewed or an event such as a purchase took place, and the information your browser sends with any request, such as your IP address, browser and device type and the page you are on. Google uses these signals to model how our site and advertising perform. Once you accept, the tags work in full, as described above. We rely on our legitimate interests in measuring how our site and advertising perform for these limited signals, and you can object at any time by contacting us at privacy@cafedirect.co.uk.

Shopify Network Intelligence. Our store uses Shopify Network Intelligence. When enabled, Shopify may use your data together with data from other merchants and from Shopify itself to generate aggregated insights that support features across the Shopify platform, including for advertising and personalisation. This is described further in Shopify's Additional Services Terms. No other merchant can see your individual data.

Order measurement and attribution

To measure completed orders and subscription renewals, and to understand which of our marketing led to them, our analytics and server-side tracking provider stores a randomly generated identifier and related browser information on your device, and sends it to them when you visit our site, before you make a cookie choice. This information can include your basket reference, your cookie choice, the page or campaign that brought you to our site, your language, country, time zone, and device and browser details. Their systems also record your IP address and browser type from your request.

When you place an order, or a subscription renews, Shopify and our subscription system report it to our provider directly from their servers. The provider uses the basket reference to link the order to your earlier visit, and it can link the order to your customer account. It then sends details of the purchase to Google Analytics and Google Ads for measurement. This can include your IP address, device and browser details, any advertising click identifier, and your customer or order details in hashed or encrypted form.

This happens whether or not you accept non-essential cookies. If you decline, we do not set analytics or advertising cookies, and we do not send your browsing activity (such as the pages you view or the items you add to your basket) to our analytics and advertising tools, other than the limited cookie-free signals described under "Google Consent Mode" above.

Where you have declined non-essential cookies, we rely on our legitimate interests in measuring completed orders and the performance of our shop and advertising, having balanced them against your rights and freedoms. We keep basket and checkout records for about two weeks and, where an order is linked to your customer record, for up to one year. If you withdraw a consent you previously gave, information already stored in your browser by this tool may remain until you clear your browser data. You can object to this processing at any time by contacting us at privacy@cafedirect.co.uk.

Storing and transferring your information

Some of the service providers we use are based outside the United Kingdom, including in the United States. Where your personal information is transferred outside the UK, we make sure it is protected by appropriate safeguards, such as the UK Extension to the EU–US Data Privacy Framework (the "UK–US Data Bridge"), the UK's International Data Transfer Agreement, or standard contractual clauses.

All information you provide to us is stored on our secure servers. Any payment transactions will be encrypted using SSL technology. Where we have given you (or where you have chosen) a password which enables you to access certain parts of our site, you are responsible for keeping this password confidential. We ask you not to share a password with anyone.

Unfortunately, the transmission of information via the internet is not completely secure. Although we will do our best to protect your personal information, we cannot guarantee the security of your information transmitted to our site; any transmission is at your own risk. Once we have received your information, we will use strict procedures and security features to try to prevent unauthorised access.

How long we keep your information

We keep your personal information only for as long as we need it for the purposes set out in this policy, including to meet any legal, accounting or reporting requirements. The table below sets out our retention periods. Where a period is still being confirmed, it is marked "to be confirmed".

When we no longer need your personal information, we securely delete or anonymise it.

Uses made of the information

We use information held about you in the following ways:

• To ensure that content from our site is presented in the most effective manner for you and for your computer.
• To provide you with information, products or services that you request from us or which we feel may interest you, where you have consented to be contacted for such purposes.
• To carry out our obligations arising from any contracts entered into between you and us.
• To allow you to participate in interactive features of our service, when you choose to do so.
• To notify you about changes to our service.
• To help maintain the quality of our goods and services we may also use your information to contact you to request feedback on the products you have ordered and the service you have received.
• To measure completed orders and the performance of our shop and advertising.

If you are an existing customer, we will only contact you by electronic means (e-mail or SMS) with information about goods and services similar to those which were the subject of a previous sale to you.

If you are a new customer, we will contact you by electronic means only if you have consented to this.

Who we share your information with

We share your personal information with trusted service providers who process it on our behalf, and with other third parties where necessary. The types of provider we use are:

• our e-commerce platform and payment provider (such as Shopify and Shopify Payments);
• subscription management providers;
• email and SMS marketing providers;
• analytics, session recording, data warehousing and server-side tracking providers;
• advertising platforms, such as Google and Meta, and our paid media agency, which manages our advertising campaigns on our behalf;
• product review and customer feedback providers;
• cookie consent management providers; and
• order fulfilment and delivery partners (such as Royal Mail).

The specific providers we use change from time to time. The cookies and similar technologies they set are listed in our cookie policy, and you can ask us for details of the providers we use at privacy@cafedirect.co.uk.

We may also disclose your personal information in the following circumstances:

• We may disclose your personal information to any member of our group, which means our subsidiaries, our ultimate holding company and its subsidiaries, as defined in the UK Companies Act 2006.
• We may disclose your personal information to third parties:
  • In the unlikely event that we sell or buy any business or assets, in which case we may disclose your personal information to the prospective seller or buyer of such business or assets.
  • In the unlikely event that Cafedirect Plc or substantially all of its assets are acquired by a third party, in which case personal information held by it about its customers will be one of the transferred assets.
  • If we are under a duty to disclose or share your personal information in order to comply with any legal obligation, or in order to enforce or apply our terms of website use or terms and conditions of supply and other agreements; or to protect the rights, property, or safety of Cafedirect Plc, our customers, or others. This includes exchanging information with other companies and organisations for the purposes of fraud protection and credit risk reduction.

Your rights

Under UK data protection law you have the following rights in relation to your personal information:

• the right to be informed about how we use your information;
• the right to access the personal information we hold about you;
• the right to have inaccurate information corrected;
• the right to have your information erased in certain circumstances;
• the right to restrict or object to our processing in certain circumstances, including objecting to direct marketing at any time;
• the right to data portability;
• the right to withdraw your consent at any time where we rely on consent;
• the right not to be subject to a decision based solely on automated processing where it produces legal or similarly significant effects; and
• the right to complain to us and to the Information Commissioner's Office (see below).

To exercise any of these rights, please contact us at privacy@cafedirect.co.uk. We will respond within one month. There is normally no charge, although we may charge a reasonable fee or refuse to act on a request that is manifestly unfounded or excessive. We may need to verify your identity before we act.

Our site may, from time to time, contain links to and from the websites of our partner networks, advertisers and affiliates. If you follow a link to any of these websites, please note that these websites have their own privacy policies and that we do not accept any responsibility or liability for these policies. Please check these policies before you submit any personal information to these websites.

Data protection complaints

If you have a complaint about how we handle your personal information, please contact us at privacy@cafedirect.co.uk. We will acknowledge your complaint promptly, investigate it, and keep you informed of the outcome. If you are not satisfied with our response, you have the right to complain to the Information Commissioner's Office (ICO), the UK supervisory authority for data protection, at ico.org.uk. We would, however, appreciate the chance to address your concerns first.

Changes to our privacy policy

Any changes we may make to our privacy policy in the future will be posted on these pages. You are expected to check these pages from time to time to take notice of any changes we made, as they are binding on you. Some of the provisions contained in our privacy policy may also be superseded by provisions or notices published elsewhere on our site.

Our cookie policy is updated as the tools we use change. We will update this policy if the way we use your personal information changes in a way that affects you, for example if we start using your information for a new purpose.

Law and jurisdiction

This agreement and any dispute arising out of it will be governed by English Law. Any dispute or claim arising out of or in connection with this agreement or its formation (including non-contractual disputes or claims) shall be subject to the exclusive jurisdiction of the courts of England and Wales.

Contact

Questions, comments and requests regarding this privacy policy are welcomed and should be addressed to Cafédirect Roastery Limited, The Roastery, Bent Ley Industrial Estate, Bent Ley Road, Meltham, Huddersfield, HD9 4EP or privacy@cafedirect.co.uk.