We take your privacy seriously. This Privacy Policy explains what personal information ANDREA Coffee Club collects, why we collect it, how we use it, who we share it with and the rights you have in relation to your information.
We aim to keep this policy clear, accessible and easy to understand. This notice may be updated when our business, technology or legal obligations change.
Who we are
ANDREA Coffee Club is a specialty coffee and modern artisan bakery concept preparing to launch its first physical location in London, United Kingdom.
The data controller is FLR HOLDINGS UK LIMITED, trading as ANDREA Coffee Club, a private limited company registered in England and Wales under company number 16970627, with registered office at 3rd Floor, 86-90 Paul Street, London, England, EC2A 4NE.
Information we collect
Depending on how you interact with ANDREA, we may collect the following categories of personal information.
Information you provide
- Name.
- Email address.
- Other contact details you choose to provide.
- Membership tier and membership identifier.
- Account information, such as your login credentials in protected form and profile information.
- Your birthday day and month where you provide it for birthday membership benefits. We do not require your birth year for this purpose.
- Information you provide when contacting customer support.
- Information you provide when making a refund, cancellation, event, product-testing or account request.
Membership and verification information
We may create and maintain a unique Member ID and a unique QR-related identifier or token for your membership account. QR codes may be used at ANDREA locations to verify membership status and eligibility for benefits.
We may also record benefit redemptions, event bookings and attendance, product-testing participation, member votes and relevant membership activity so that we can administer the Club and provide the benefits attached to your tier.
Payment and transaction information
Membership payments are processed by our payment service provider. We do not intend to store your full payment card number or security code on our own systems.
Depending on the payment service and transaction, we may receive information such as your name, email address, payment status, transaction identifier, amount paid, currency, payment method type and limited billing information.
Technical information
When you use our website, technical information may be processed, such as IP address, browser type, device type, operating system, approximate technical location and information about how you interact with the website. The exact information collected depends on the technologies actually enabled on the website.
How we use your information
Depending on the circumstances, we may use personal information to:
- Process and manage membership purchases.
- Create, maintain and authenticate your member account.
- Generate and manage your Member ID and QR-related identifier.
- Verify membership status and apply membership benefits at ANDREA locations.
- Record and manage birthday benefits and related redemptions.
- Provide membership benefits, events, testing sessions and other member experiences.
- Manage product voting, location-specific voting and product-testing participation.
- Send purchase confirmations, account notices, membership information, opening updates and other essential service communications.
- Respond to enquiries and provide customer support.
- Process refunds, cancellations and payment-related issues.
- Detect, investigate and prevent fraud, misuse and unauthorised transactions.
- Maintain the security and functionality of our website and systems.
- Understand website and product usage and improve our services where the relevant analytics technology has been lawfully enabled.
- Send promotional communications where permitted and where the required consent or other lawful basis exists.
- Comply with legal, accounting, tax and regulatory obligations.
Our lawful bases
Under applicable UK data protection law, different processing activities may rely on different lawful bases.
Processing membership purchases, maintaining your account and providing the benefits you purchased.
Accounting, tax, regulatory, fraud-prevention and record-keeping requirements.
Operating, securing and improving the business, administering the Club, preventing fraud and responding to customer enquiries, provided those interests are not overridden by your rights and freedoms.
Where consent is required, we will ask for it separately and explain what you are agreeing to. You can withdraw consent at any time.
International transfers
Some service providers may process personal information outside the United Kingdom. Where this happens, we will take appropriate steps to ensure that the transfer is lawful under applicable UK data protection law, using an adequacy decision, appropriate contractual safeguards or another lawful transfer mechanism where required.
How long we keep your information
We keep personal information only for as long as reasonably necessary for the purposes for which it was collected, including legal, accounting, tax, fraud-prevention and reporting requirements.
Membership, transaction and redemption records may need to be retained longer than marketing preferences. Account and membership data may be retained for the lifetime of the membership and for an appropriate period afterwards where needed for legal, accounting, fraud-prevention or dispute purposes.
When information is no longer required, we will securely delete it or anonymise it where appropriate.
Keeping your data safe
We use appropriate technical and organisational measures designed to protect personal information against accidental loss, unauthorised access, alteration, disclosure or destruction.
QR codes and membership identifiers are designed to identify membership records rather than expose unnecessary personal information. Staff access to membership information is limited to what is reasonably needed to verify benefits and operate the Club.
Payment card details are intended to be handled by our payment service provider rather than stored as full card data in our own systems.
No online system can be guaranteed to be completely secure. If we become aware of a personal data breach that requires notification under applicable law, we will take the appropriate steps.
Your rights
Depending on the circumstances and applicable law, you may have rights including:
- The right to be informed about how your personal information is used.
- The right to request access to your personal information.
- The right to request correction of inaccurate or incomplete information.
- The right to request deletion in certain circumstances.
- The right to request restriction of processing in certain circumstances.
- The right to object to certain processing, including direct marketing.
- Rights relating to data portability where applicable.
- The right to withdraw consent where processing is based on consent.
These rights are subject to legal conditions and exemptions.
To exercise your rights, contact us using the details at the end of this policy.
Marketing communications
We may send service-related communications necessary to manage your membership or purchase, including purchase confirmations, account information, opening updates and important service changes.
Promotional communications are separate from essential service communications. Where applicable law requires consent for electronic direct marketing, we will obtain the required consent before sending it.
You can unsubscribe from promotional communications at any time using the unsubscribe mechanism provided or by contacting us. Unsubscribing from marketing does not stop essential communications needed to administer an existing membership or transaction.
Children
ANDREA Coffee Club's membership purchase and account services are intended for adults.
We do not knowingly collect personal information from children for purposes where applicable law requires parental consent.
If you believe a child has provided us with personal information in circumstances where this was not appropriate, please contact us.
Automated decision-making
We do not currently make decisions about customers that produce legal or similarly significant effects based solely on automated processing or profiling.
Changes to this policy
We may update this Privacy Policy from time to time to reflect changes in our business, technology, legal requirements or how we process personal information.
When we make significant changes, we will take reasonable steps to bring them to your attention. We recommend checking this page periodically.
Contact us
If you have questions about this Privacy Policy or want to exercise your data protection rights, please contact us.
You also have the right to complain to the UK's data protection regulator, the Information Commissioner's Office (ICO), if you believe your personal information has been handled unlawfully.