We take your privacy seriously. This Privacy Policy explains what personal information ANDREA Coffee Club collects, why we collect it, how we use it, who we share it with and the rights you have in relation to your information.
We aim to keep this policy clear, accessible and easy to understand. We will update it when our business or the way we process personal information changes.
Who we are
ANDREA Coffee Club is a specialty coffee and bakery concept preparing to launch its first physical location in London, United Kingdom.
For data protection purposes, the organisation responsible for your personal information will be:
We will replace the bracketed company details above with the final legal entity information before accepting live membership payments.
Information we collect
We only collect personal information that is reasonably necessary for the purposes described in this policy.
Information you provide
- Name.
- Email address.
- Other contact details you choose to provide.
- Membership tier and membership identifier.
- Information you provide when contacting customer support.
- Information you provide when making a refund, cancellation or other customer service request.
Payment and transaction information
Membership payments will be processed by our selected payment service provider. We do not intend to store your full payment card number or card security code on our own systems.
Depending on the payment service and transaction, we may receive information such as your name, email address, payment status, transaction identifier, amount paid, currency, payment method type and limited billing information.
Technical information
When you use our website, technical information may be processed, such as IP address, browser type, device type, operating system, approximate technical location and information about how you interact with the website.
The exact technical information collected will depend on the services and technologies actually enabled on the website.
How we use your information
Depending on the circumstances, we may use personal information to:
- Process and manage membership purchases.
- Create, maintain and authenticate digital membership records.
- Provide membership benefits and manage redemptions.
- Send purchase confirmations, membership information and important service updates.
- Respond to enquiries and provide customer support.
- Process refunds, cancellations and payment-related issues.
- Detect, investigate and prevent fraud, misuse and unauthorised transactions.
- Maintain the security and functionality of our website and systems.
- Understand website usage and improve our services, where the relevant analytics technology has been lawfully enabled.
- Send promotional communications where permitted and where the required consent or other lawful basis exists.
- Comply with legal, accounting, tax and regulatory obligations.
Our lawful bases
Under applicable UK data protection law, we need a lawful basis for processing personal information. Different activities may rely on different lawful bases.
We may process information where it is necessary to enter into or perform a contract with you, including processing a membership purchase, maintaining your membership and providing the benefits you purchased.
We may process information where necessary to comply with legal obligations, including accounting, tax, regulatory, fraud-prevention and record-keeping requirements.
Where appropriate, we may process information because it is necessary for our legitimate interests, such as operating, securing and improving the business, preventing fraud and responding to customer enquiries, provided those interests are not overridden by your rights and freedoms.
Where consent is required, we will ask for it separately and explain what you are agreeing to. You can withdraw consent at any time.
International transfers
Some service providers may process personal information outside the United Kingdom.
Where this happens, we will take appropriate steps to ensure that the transfer is lawful under applicable UK data protection law.
Depending on the destination and provider, this may include an adequacy decision, appropriate contractual safeguards or another lawful transfer mechanism.
Where required, further information about the relevant safeguard will be available on request.
How long we keep your information
We keep personal information only for as long as reasonably necessary for the purposes for which it was collected, including to meet legal, accounting, tax, fraud-prevention and reporting requirements.
We do not apply one universal retention period to every type of information. Different categories may need to be kept for different periods.
For example, membership and transaction records may need to be retained longer than marketing preferences because of legal, accounting, tax or fraud-prevention requirements.
When information is no longer required, we will securely delete it or anonymise it where appropriate.
Keeping your data safe
We use appropriate technical and organisational measures designed to protect personal information against accidental loss, unauthorised access, alteration, disclosure or destruction.
Access to personal information is limited to people and service providers who need it for legitimate business purposes.
Payment card details are intended to be handled by our payment service provider rather than stored as full card data in our own systems.
No online system can be guaranteed to be completely secure. If we become aware of a personal data breach that requires notification under applicable law, we will take the appropriate steps.
Your rights
Depending on the circumstances and applicable law, you may have rights including:
- The right to be informed about how your personal information is used.
- The right to request access to your personal information.
- The right to request correction of inaccurate or incomplete information.
- The right to request deletion in certain circumstances.
- The right to request restriction of processing in certain circumstances.
- The right to object to certain processing, including the right to object to direct marketing.
- Rights relating to data portability where applicable.
- The right to withdraw consent where processing is based on consent.
These rights are subject to legal conditions and exemptions. For example, we may need to retain certain information to comply with legal obligations.
To exercise your rights, contact us using the details at the end of this policy.
Marketing communications
We may send service-related communications that are necessary to manage your membership, such as purchase confirmations, membership information, opening updates, account notices and important service changes.
Promotional communications are separate from essential service communications. Where applicable law requires consent for electronic direct marketing, we will obtain the required consent before sending it.
You can unsubscribe from promotional communications at any time using the unsubscribe mechanism provided or by contacting us.
Unsubscribing from promotional marketing does not stop essential communications needed to administer an existing membership or transaction.
Children
ANDREA Coffee Club's membership purchase and account services are intended for adults.
We do not knowingly collect personal information from children for purposes where applicable law requires parental consent.
If you believe a child has provided us with personal information in circumstances where this was not appropriate, please contact us.
Automated decision-making
We do not currently make decisions about customers that produce legal or similarly significant effects based solely on automated processing or profiling.
If this changes in the future, we will update this Privacy Policy and provide the information required by applicable law.
Changes to this policy
We may update this Privacy Policy from time to time to reflect changes in our business, technology, legal requirements or how we process personal information.
When we make significant changes, we will take reasonable steps to bring them to your attention.
We recommend checking this page periodically for the latest version.
Contact us
If you have questions about this Privacy Policy or want to exercise your data protection rights, please contact us.
You also have the right to complain to the UK's data protection regulator, the Information Commissioner's Office (ICO), if you believe your personal information has been handled unlawfully.
Information about the ICO and how to make a complaint is available at: https://ico.org.uk/make-a-complaint/