Privacy policy.
What we collect, why we collect it, and how to make us stop. Short, because we do not collect much.
The short version: we hold your name, address, email and order history so we can roast and post your coffee. We do not sell your data, we do not track you around the internet, and this site sets no analytics or advertising cookies.
Who is responsible
Rosso Coffee is the data controller for the personal data described here. For any question about your data, or to exercise any of the rights below, email hello@rossocoffee.co.uk.
What we collect
- Order details — your name, delivery address, email address, chosen grind, and what you ordered.
- Payment information — collected and held by GoCardless, not by us. We receive a payment reference and whether a payment succeeded. We never see or store your account number or sort code.
- Correspondence — emails you send us and our replies.
We do not collect special category data, we do not profile you, and we do not make automated decisions about you.
Why we hold it, and on what basis
- To take payment, roast your order and deliver it — because it is necessary to perform our contract with you.
- To answer your emails and handle problems — our legitimate interest in running a business people can talk to.
- To keep records of sales for tax and accounting — a legal obligation.
If we ever want to email you marketing, we will ask you to opt in first, and every such email will carry a one-click unsubscribe.
Who we share it with
- GoCardless Ltd — to set up your Direct Debit and take payment.
- Our delivery carrier — your name and address, so the parcel arrives.
- Our accountant and HMRC — sales records, where required.
That is the complete list. We do not sell, rent or trade personal data, and we do not share it for advertising.
Cookies and tracking
This site sets no analytics, advertising or third-party tracking cookies, which is why you are not being asked to dismiss a consent banner. Fonts, images, styles and scripts are all served from this domain.
If you go through checkout, GoCardless will set cookies on their own pages under their own privacy policy.
How long we keep it
Order and payment records are kept for six years, which is the retention period UK tax law requires. Email correspondence is kept for two years. Subscription details are deleted once you cancel and the retention period above has passed.
Where it is held
Your data is held on servers in the UK and the EU. Where a supplier processes data outside the UK, that transfer is covered by the appropriate safeguards under UK GDPR.
Your rights
Under UK GDPR you can ask us to: give you a copy of your data; correct it if it is wrong; delete it; restrict or object to how we use it; or send it to another provider. Email hello@rossocoffee.co.uk and we will respond within one month. There is no charge.
If you are not happy with how we have handled your data you can complain to the Information Commissioner's Office at ico.org.uk — though we would appreciate the chance to fix it first.
Changes
If this policy changes we will update the date at the top, and we will email active subscribers about anything material.