Privacy.

The short version

We collect what we need to take your order and get coffee to your door — nothing more. No advertising trackers, no analytics scripts, and we never see your card number. We do run one newsletter, and you only ever join it by asking and then confirming; we never add buyers to it automatically, and we never sell or share the list. The data controller is N25 Coffee & Bar, London, United Kingdom; for anything in this policy, write to orders@n25coffeebar.com.

What we collect, and why

When you order: your name, email, delivery address, phone number (optional) and what you bought — because we need them to fulfil the contract with you. When you create an account: your email and a password, stored only as a cryptographic hash. Verification and password-reset links expire, and we never keep a usable copy of one: our records hold only a one-way hash of the link, and while a message is still waiting to be sent its contents are stored encrypted and are decrypted only at the moment of sending. Payment card details go directly to Stripe, our payment processor; they never touch our servers. We keep order records for six years, as UK tax law requires; accounts we keep until you ask us to delete yours.

The newsletter

The newsletter is opt-in twice over: you enter your address, we email you a confirmation link, and nothing is ever sent unless you click it. Buying from us does not subscribe you, and creating an account does not either — the tick box on the sign-up form starts unticked and stays that way unless you choose otherwise. Our lawful basis is your consent.

Against each subscription we store the address, when it was requested and confirmed, which form it came from and the exact wording you agreed to — that record is how we can show consent was real. Every newsletter carries a one-click unsubscribe link that works without signing in and keeps working; your mail app’s own unsubscribe button works too. After you unsubscribe we keep the address marked as unsubscribed rather than deleting the row, precisely so nothing can add you back by accident. Ask us and we will erase it outright.

Cookies

We use essential cookies only: one to keep you signed in to your account, and local storage in your browser to remember your basket. Nothing follows you around the internet, so there is no cookie banner to click.

Who else touches your data

Four processors, each doing one job: Stripe (payments), Resend (email — order confirmations, invoices, account verification and password resets, and the newsletter if you subscribed), Cloudflare (hosting and database), and Royal Mail (delivery). Some of these providers process data outside the UK under appropriate safeguards such as the UK Extension to the EU–US Data Privacy Framework and standard contractual clauses. We never sell or share your data for marketing.

Your rights

UK GDPR gives you the right to see the data we hold about you, correct it, ask us to delete it, restrict or object to its use, and take it elsewhere. Email us and we’ll act on it within a month. If you’re unhappy with how we’ve handled something, you can complain to the Information Commissioner’s Office at ico.org.uk.