Privacy Policy

Last updated: 3 August 2025

1. About this privacy policy

This privacy policy explains how The Proper Coffee Co
collects, uses, stores and shares personal information when you:

  • visit or use our website;
  • create an account;
  • place an order;
  • purchase or receive a gift subscription;
  • subscribe to marketing communications;
  • contact us; or
  • otherwise interact with our business.

We process personal information in accordance with applicable UK data
protection law, including the UK General Data Protection Regulation,
the Data Protection Act 2018 and, where relevant, the Privacy and
Electronic Communications Regulations.

2. Who is responsible for your information?

The data controller responsible for personal information processed through
this website and our business is:

The Proper Coffee Co
c/o Five Geckos Ltd
34 Great Queen Street
London
WC2B 5AA
United Kingdom

Email:

hello@propercoffeeco.com

ICO registration number: ZA376874

Five Geckos Ltd provides the correspondence address shown above. It is not
the data controller for The Proper Coffee Co unless expressly stated
otherwise in relation to a separate service.

3. Personal information we collect

The information we collect depends on how you use the website and interact
with us. It may include the following categories.

Identity information

  • name;
  • account username;
  • the name used when sending or receiving a gift; and
  • other identifying information you choose to provide.

Contact and delivery information

  • email address;
  • telephone number;
  • billing address;
  • delivery address; and
  • delivery instructions.

Account information

  • account login information;
  • saved addresses;
  • order history;
  • subscription information; and
  • account preferences.

Passwords are stored in protected form by the website platform. We do not
have access to your password in readable form.

Order and transaction information

  • products ordered;
  • coffee, grind, pouch-size and subscription selections;
  • order number;
  • order value;
  • payment status;
  • delivery and fulfilment status;
  • refund, cancellation or replacement information; and
  • customer-service correspondence relating to an order.

Payment information

Payments are processed using Stripe and WooPayments. Payment providers may
collect payment-card details, billing information, device information,
fraud-prevention information and transaction identifiers.

We do not ordinarily receive or store your full payment-card number or
card-security code. We may receive limited payment information such as the
payment status, transaction reference, card type and the final digits of
the card.

Gift-subscription information

When somebody purchases a gift subscription, we may collect:

  • the gift recipient’s name;
  • the gift recipient’s email address;
  • the gift recipient’s delivery address;
  • the purchaser’s or gift giver’s name;
  • a personal gift message;
  • gift-subscription product and delivery details;
  • the notification email subject and content;
  • the date and time the notification was sent;
  • the order status that triggered the notification; and
  • whether the email was successfully passed to our email system.

Where you are the gift recipient, this information will normally have been
provided to us by the person purchasing the gift.

Please do not include sensitive personal information, payment-card details,
passwords, medical information or other confidential information in a gift
message or other free-text field.

Communications information

  • emails and other messages sent to or received from you;
  • customer-service enquiries;
  • complaints;
  • reviews and feedback;
  • requests to exercise data-protection rights; and
  • records of consent, unsubscription and marketing preferences.

Website and technical information

When you use our website, we and our service providers may collect:

  • IP address;
  • browser type and version;
  • device type;
  • operating system;
  • approximate location derived from an IP address;
  • pages visited;
  • referring website or campaign;
  • dates and times of visits;
  • shopping-basket and checkout activity;
  • cookie identifiers;
  • advertising identifiers;
  • security and firewall events; and
  • website-performance and diagnostic information.

4. How we collect personal information

We may collect personal information:

  • directly from you when you order, register, subscribe or contact us;
  • automatically when you use the website;
  • from somebody purchasing a gift for you;
  • from payment providers;
  • from delivery and fulfilment providers;
  • from analytics and advertising providers, where permitted;
  • from fraud-prevention and website-security services; and
  • from publicly available sources where lawful and relevant.

5. How and why we use personal information

Processing and fulfilling orders

We use identity, contact, payment, transaction and delivery information to:

  • accept and process orders;
  • take or confirm payment;
  • prepare and dispatch products;
  • provide delivery updates;
  • manage subscriptions;
  • process cancellations, refunds and replacements; and
  • communicate with you about an order.

Our lawful basis is that the processing is necessary to perform our
contract with you or to take steps at your request before entering into a
contract.

Managing customer accounts

We use account, identity and order information to create and administer
customer accounts, show order history, save preferences and provide
account-related services.

Our lawful basis is performance of a contract and our legitimate interest
in providing and administering customer accounts.

Gift subscriptions and recipient notifications

We use gift-recipient information to:

  • fulfil and deliver the gift;
  • tell the recipient who the gift is from;
  • provide the purchaser’s gift message;
  • explain what the subscription includes;
  • administer future deliveries;
  • respond to questions about the gift;
  • prevent duplicate notifications; and
  • maintain a limited transactional audit record.

Our lawful basis is our legitimate interest in fulfilling gift purchases,
administering the service requested by the purchaser and providing the
recipient with clear information about the gift.

A recipient’s email address is used only for the gift and related
transactional administration. A gift recipient is not added to our
marketing list unless they separately and actively choose to subscribe.

Customer service and enquiries

We use contact, order and communications information to answer enquiries,
resolve problems, manage complaints and provide customer support.

Our lawful basis is performance of a contract where the enquiry relates to
an order, or our legitimate interest in responding to customers and
administering our business.

Tax, accounting and legal compliance

We use order, payment, refund and customer information to:

  • maintain accounting records;
  • prepare tax returns;
  • respond to lawful requests from regulators or public authorities;
  • comply with court orders and legal obligations; and
  • establish, exercise or defend legal claims.

Our lawful basis is compliance with legal obligations and, where relevant,
our legitimate interest in protecting our legal rights.

Fraud prevention, security and service protection

We may use payment, technical, account and transaction information to:

  • prevent fraudulent transactions;
  • protect customer accounts;
  • detect malicious website activity;
  • investigate security incidents;
  • enforce our terms; and
  • protect our business, customers and website.

Our lawful basis is our legitimate interest in operating a safe and secure
ecommerce service and, where applicable, compliance with legal obligations.

Improving our website, products and services

We may use aggregated, statistical, technical and customer-feedback
information to understand website performance, identify errors, improve
products and plan our services.

Where this involves non-essential cookies or tracking technologies, we rely
on your consent. For other limited internal analysis, we may rely on our
legitimate interest in improving our business, provided your rights and
interests do not override that interest.

Marketing

If you subscribe or where we are otherwise permitted by law, we may use
your name, email address, order history and marketing preferences to send
information about our coffee, products, subscriptions and offers.

We may send marketing using WooCommerce and Sender.net.

Our lawful basis will normally be your consent. In limited circumstances,
we may rely on our legitimate interests where electronic-marketing rules
permit us to contact an existing customer and the required opt-out choices
have been provided.

You can unsubscribe at any time by:

Withdrawing consent does not affect processing that was lawful before the
withdrawal.

6. Cookies and similar technologies

Cookies are small files or pieces of information stored on or accessed from
your device. Similar technologies include pixels, tags, local storage and
other device-identification technologies.

We use these technologies for the following purposes.

Strictly necessary technologies

These are required for the website and online shop to function. They may be
used to:

  • remember basket contents;
  • operate checkout;
  • process payments;
  • keep customer accounts secure;
  • remember cookie choices;
  • prevent fraud;
  • protect the website; and
  • provide caching and website-performance functions.

These technologies may be provided through WooCommerce, Stripe,
WooPayments, Wordfence, LiteSpeed and our website hosting environment.

Analytics technologies

We use Google Analytics to understand how visitors use the website,
measure traffic and identify areas that may need improvement.

Analytics technologies are non-essential and are activated only after the
required consent has been given through our cookie controls.

Advertising and conversion technologies

We use Google Ads and Meta Pixel to measure advertising performance,
understand whether advertisements result in visits or purchases and, where
permitted, build or measure advertising audiences.

Google Tag Manager helps us manage website tags. Technologies deployed
through Google Tag Manager may include Google Analytics, Google Ads and
Meta Pixel.

Advertising and conversion technologies are non-essential and are activated
only after the required consent has been given.

Managing your cookie choices

You can accept, reject or customise non-essential cookies using the cookie
controls displayed on our website. You can change or withdraw your choices
at any time using the cookie-settings control.

You can also manage cookies through your browser. Blocking strictly
necessary cookies may prevent the basket, checkout, payment or account
features from working correctly.

The individual cookies, providers, purposes and durations currently in use
are shown in our website cookie controls. This information may change when
services are added, removed or updated.

7. Who we share personal information with

We do not sell personal information.

We may share information with the following recipients where necessary.

Payment providers

Stripe and WooPayments process payments, payment confirmations,
fraud-prevention information, refunds and transaction data.

Ecommerce and website providers

WooCommerce and associated service providers support our online shop,
customer accounts, orders and website functions.

Email providers

Sender.net and our website email systems may process customer and recipient
email addresses, message content, sending records, delivery events and
marketing preferences.

Hosting, security and performance providers

Krystal provides website hosting. Wordfence supports website and firewall
security. LiteSpeed provides caching and website-performance functions.
These providers may process IP addresses, technical information and
security or diagnostic logs.

Analytics and advertising providers

Where you have given the required consent, information may be processed by
Google in connection with Google Analytics, Google Ads and Google Tag
Manager, and by Meta in connection with Meta Pixel and related advertising
services.

Delivery providers

We share the information needed to deliver orders with DPD and Royal Mail.
This may include the recipient’s name, delivery address, email address,
telephone number, delivery instructions and order reference.

Professional advisers and authorities

We may share relevant information with accountants, legal advisers,
insurers, banks, public authorities, regulators, courts, law-enforcement
bodies or other parties where necessary to comply with law, protect our
rights or manage a legal claim.

Business transfers

If all or part of our business is sold, transferred or reorganised,
relevant information may be disclosed to advisers, prospective purchasers
and the new owner, subject to appropriate confidentiality and data
protection requirements.

Some service providers may act as independent data controllers for certain
processing. Their own privacy notices explain how they use information for
those purposes.

8. International transfers

Some of our service providers operate or use systems outside the United
Kingdom. This may result in personal information being accessed or
processed in another country.

Where UK data-protection law treats this as a restricted transfer, we take
steps intended to ensure that an appropriate transfer mechanism is in
place. Depending on the provider and destination, this may include:

  • UK adequacy regulations;
  • the UK International Data Transfer Agreement;
  • the UK Addendum to approved standard contractual clauses; or
  • another transfer mechanism permitted by UK law.

You can contact us for further information about the safeguards relevant to
a particular service provider.

9. How long we keep personal information

We keep personal information only for as long as reasonably needed for the
purpose for which it was collected, including legal, tax, accounting,
security and dispute-resolution requirements.

Our normal retention periods are:

  • Orders, payments, refunds and accounting records:
    normally six years from the relevant transaction or accounting period.
  • Customer-account information:
    while the account remains active and afterwards where needed for order,
    tax, fraud-prevention or legal records.
  • Gift-recipient notification audit history:
    365 days from the date the notification is sent or attempted.
  • General enquiries and customer-service correspondence:
    normally up to 24 months after the last substantive contact, unless the
    communication relates to an order, complaint or legal issue requiring a
    longer period.
  • Marketing information:
    until you unsubscribe, withdraw consent or we determine that the
    information is no longer current.
  • Marketing suppression records:
    a minimal record may be retained after unsubscription so that we can
    respect the request and avoid sending further marketing.
  • Security and fraud-prevention logs:
    for as long as reasonably necessary to protect the website, investigate
    an incident or establish a pattern of malicious activity.
  • Cookie information:
    for the period stated in the applicable cookie controls or until the
    cookie is deleted or expires.

We may keep information for longer where required by law, where an enquiry
or dispute is ongoing, or where it is needed to establish, exercise or
defend legal claims.

Information held in backups may remain until the relevant backup is
securely overwritten or deleted through the normal backup cycle.

10. Security

We use reasonable technical and organisational measures intended to protect
personal information against unauthorised access, alteration, disclosure,
loss or destruction.

These measures may include:

  • encrypted website connections;
  • restricted administrative access;
  • password protection and account controls;
  • website firewall and malware protection;
  • software updates and security monitoring;
  • payment processing through specialist payment providers;
  • backups; and
  • limiting access to people who need the information for their work.

No website, transmission method or storage system can be guaranteed to be
completely secure. Please take care when sending information online and
contact us promptly if you believe your account or information has been
compromised.

11. Automated processing

We do not ourselves make decisions about you based solely on automated
processing that produce legal or similarly significant effects.

Payment and fraud-prevention providers may use automated tools to assess
transactions or security risks under their own privacy notices and legal
responsibilities.

12. Your data-protection rights

Depending on the circumstances and the lawful basis used, you may have the
following rights:

  • Right to be informed:
    to receive information about how your personal information is used.
  • Right of access:
    to request a copy of personal information we hold about you.
  • Right to rectification:
    to ask us to correct inaccurate or incomplete information.
  • Right to erasure:
    to ask us to delete information in certain circumstances.
  • Right to restrict processing:
    to ask us to limit how information is used in certain circumstances.
  • Right to data portability:
    to receive certain information in a structured, commonly used and
    machine-readable format where this right applies.
  • Right to object:
    to object to processing based on legitimate interests and to object at
    any time to direct marketing.
  • Right to withdraw consent:
    to withdraw consent at any time where consent is the lawful basis.

These rights are not absolute. For example, we may need to retain certain
order and accounting records to comply with legal obligations or manage a
legal claim.

To exercise a right, email:

hello@propercoffeeco.com
.

Please provide enough information for us to identify the relevant records.
We may ask for reasonable evidence of identity before disclosing or changing
personal information.

We normally respond to valid data-protection requests within one month.
Where a request is complex or numerous, the law may allow additional time.
We will explain if this applies.

13. Complaints

Please contact us first if you have a concern about how we have used your
personal information:

Email:

hello@propercoffeeco.com

Address:
The Proper Coffee Co
c/o Five Geckos Ltd
34 Great Queen Street
London
WC2B 5AA

You also have the right to complain to the Information Commissioner’s
Office, the UK regulator for data protection.


Make a complaint to the Information Commissioner’s Office

14. External websites

Our website may link to websites operated by other organisations. We do not
control how those organisations process personal information. You should
read the privacy notice on the relevant external website before providing
personal information.

15. Terms and conditions

Information about purchases, subscriptions, deliveries, cancellations and
other contractual matters is available in our

Terms and Conditions
.

16. Changes to this privacy policy

We may update this policy when our services, technology, providers or legal
obligations change. The latest version will be published on this page and
the date at the top will be updated.

Where a change has a significant effect on how we use personal information,
we may provide an additional notice by email, through the website or by
another appropriate method.