Privacy Policy
Otta Coffee: 153 New Line, Bradford, BD10 0BU
Last updated: 29 September 2026
We collect only what we need to serve you, take your orders, keep our café safe and understand how our website is used. We never sell your data. You can ask us to see, correct or delete it at any time, and you can say no to marketing and non-essential cookies without losing access to anything.
This policy explains how Otta Coffee (“we“, “us“, “our“) looks after your personal data when you visit our coffee house, use our guest Wi-Fi, buy from us in store or online, contact us, or use ottacoffee.co.uk (the “Website“). It should be read with our Cookie Policy, Terms & Conditions and Refund & Cancellation Policy.
1. Who we are
We are the “data controller”, which means we decide why and how your personal data is used. We comply with the UK GDPR, the Data Protection Act 2018 and the Privacy and Electronic Communications Regulations 2003 (PECR).
| Business name | Otta Group Limited: COMPANY NUMBER. 17364097 |
| Address | 153 New Line, Bradford, BD10 0BU, United Kingdom |
| Privacy contact | hello@ottacoffee.co.uk |
We are a small business and have not appointed a Data Protection Officer. Privacy questions go to the email address above and are handled by a member of our management team.
2. What we collect, why, and our legal basis
UK law requires us to have a valid “lawful basis” for every use of your data. Here is each one, in plain terms.
| What we collect | Why we use it | Lawful basis |
| In-store purchases: items bought, time, amount, and the payment method type. We do not see or store your full card number; card payments are handled by Square. | To take payment, give you a receipt, handle refunds and keep sales and tax records. | Contract (serving you); legal obligation (accounting and tax). |
| Online orders and accounts (WooCommerce): name, email, phone number, billing and delivery address, order details, and account login details if you create an account. | To process, deliver or prepare your order, take payment, send order updates, handle returns, prevent fraud and keep tax records. | Contract; legal obligation; legitimate interests (fraud prevention). |
| Enquiries: your name, contact details and the content of your message, whether by email, phone, social media or (when introduced) a website contact form. | To reply to you and keep a record in case of follow-up questions or disputes. | Legitimate interests (answering enquiries and keeping records). |
| Guest Wi-Fi sign-in: your email address, device identifier (MAC address) and connection times. | To provide Wi-Fi access, keep our network secure and meet our legal obligations if misuse is reported. We do not use this email for marketing unless you tick a separate, optional box. | Legitimate interests (running a secure network); consent (only for the optional marketing tick-box). |
| CCTV images (no sound): video of the interior and entrance of our premises. | Safety of customers and staff, preventing and detecting crime, and dealing with insurance claims or incidents. | Legitimate interests. Our assessment of this is available on request. |
| Marketing emails: your name, email address and your preferences. | To send news, offers and updates you asked for. | Consent, or “soft opt-in” for existing customers (see section 4). |
| Website usage data: IP address, browser and device type, pages viewed, referring site, approximate location, and time and length of visit. | To understand how the Website is used and improve it. Collected only if you accept analytics cookies. | Consent. |
| Security and technical logs: IP address and request details. | To keep the Website secure and working. | Legitimate interests. |
| Feedback and reviews you choose to send us. | To improve our service and respond to you. | Legitimate interests. |
We do not knowingly collect “special category” data (such as health, religion or ethnicity) or criminal-conviction data. If you tell us about an allergy or dietary need when ordering, we use it only to prepare your order safely and do not keep it once the order is complete, unless it is recorded on the order itself.
We do not make decisions about you using automated profiling that has legal or similarly significant effects.
If we ever need to use your data for a new, unrelated purpose, we will tell you first and, where needed, ask for your consent.
3. How we collect your data
- From you directly: when you buy from us, create an account, sign in to the Wi-Fi, contact us or subscribe to emails.
- Automatically: through cookies and similar technologies on the Website (only non-essential ones if you consent), server logs, and CCTV in our premises.
- From service providers: for example, Square and our online payment provider tell us whether a payment succeeded, and our delivery carrier confirms delivery status.
4. Marketing and your choices
- Newsletter and promotions: we send these only if you have opted in (for example, by ticking an unticked box or signing up on the Website), or if you bought from us online and we are promoting similar products, in which case you were offered a clear opt-out when we collected your details (“soft opt-in”).
- Guest Wi-Fi: signing in does not subscribe you to marketing.
- Opting out: every marketing email has an unsubscribe link, or you can email hello@ottacoffee.co.uk at any time. Unsubscribing stops marketing only. We will still send essential messages about an order you have placed, such as confirmations, delivery updates and refund notices.
- We do not sell your data and we do not share it with other companies for their own marketing.
5. Who receives your data
We share personal data only with the people and organisations below, and only as much as they need to do their job. Providers acting on our behalf (“processors”) may use your data only on our instructions.
| Recipient | What they do | Data they receive | Location |
| Square (Block, Inc. / Squareup International Ltd) | In-store point-of-sale and card payment processing | Transaction details, payment card data (handled directly by Square) | UK |
| Datman | Processes online payments through our WooCommerce store | Name, billing details, order total, payment details (entered on the provider’s secure form) | UK |
| WooCommerce / WordPress (Automattic Inc. and open-source software running on our own hosting) | E-commerce software that runs our online shop | Order and account data stored in our shop database | Stored with our hosting provider |
| 20i | Hosts the Website and its database | All data held on the Website | Mansfield, Nottinghamshire, UK |
| Uber Eats, Deliveroo, JustEat | Delivers online orders | Name, delivery address, phone number and email for delivery updates | UK |
| Google LLC | Google Analytics (statistics), Google Tag Manager (manages our website tags) and Google Search Console (search performance) | Analytics: pseudonymous usage data and IP address, only if you accept analytics cookies. Tag Manager and Search Console do not receive your personal data directly from you. | UK / worldwide |
| TrickleUp | Sends our newsletter | Name and email address of subscribers | Leeds, UK |
| EE | Runs our guest Wi-Fi sign-in | Email address, device identifier, connection times | UK |
| Accountants, bookkeepers and professional advisers | Accounts, tax, legal and insurance advice | Financial and transaction records | UK |
| Police, courts, regulators, HMRC | Only when legally required or to prevent or investigate crime | Only what is legally required, which may include CCTV footage | UK |
| A buyer of our business | If we sell or restructure the business | Customer records, on the same terms as this policy | UK |
We may also share CCTV footage with our insurers if needed for a claim.
6. Transfers outside the UK
Some providers above, notably Google and possibly our payment, email and Wi-Fi providers, process data in the United States or other countries. We only allow this where one of these protections applies:
- the country is covered by UK “adequacy regulations” (including the UK Extension to the EU-US Data Privacy Framework, the “UK-US data bridge”, for certified US companies); or
- the provider has signed the UK International Data Transfer Agreement or the UK Addendum to the EU Standard Contractual Clauses, together with any extra safeguards needed.
You can ask us for details of the safeguards for a specific provider by emailing hello@ottacoffee.co.uk.
7. How long we keep your data
| Data | How long |
| Sales, invoices and payment records (in store and online) | 6 years from the end of the financial year, as required for tax and accounting |
| Online account details | Until you close your account, or 2 years after you last used it, then deleted (order records stay for 6 years as above) |
| Enquiries and correspondence | 2 years after the matter is closed |
| Newsletter subscription | Until you unsubscribe, or 2 years after you last opened or clicked an email, whichever is sooner |
| Guest Wi-Fi sign-in records | 12 months, then deleted |
| CCTV footage | Up to 30 days, unless needed for an incident, insurance claim or police request, in which case it is kept until the matter is resolved |
| Google Analytics data | 14 months, then automatically deleted |
| Cookie consent record | Up to 12 months |
We may keep data longer if the law requires it or if we need it to establish or defend a legal claim. When the time is up, we securely delete or anonymise it.
8. Security
We use appropriate technical and organisational measures, including encrypted (HTTPS) connections on the Website, password-protected systems with access limited to staff who need it, and payment processing by PCI-DSS-compliant providers so that we never store full card numbers. CCTV recordings are stored securely and viewed only by authorised managers.
If a data breach is likely to put your rights at risk, we will tell you and the Information Commissioner’s Office (ICO) as the law requires. No system is perfectly secure, so please use a strong, unique password for any account you create with us.
9. Your rights
Under UK data protection law you have the right to:
- Be informed about how we use your data (this policy).
- Access a copy of the personal data we hold about you.
- Correct data that is inaccurate or incomplete.
- Erase your data in certain circumstances.
- Restrict how we use your data in certain circumstances.
- Data portability: receive data you gave us in a common, machine-readable format.
- Object to processing based on legitimate interests, and to direct marketing at any time.
- Withdraw consent at any time where we rely on it (for example, analytics cookies or newsletters). Withdrawing does not affect anything we did before.
- Not be subject to solely automated decisions with significant effects (we do not make any).
To use any of these rights, email hello@ottacoffee.co.uk. We will reply within one month (extendable by up to two further months for complex requests, and we will tell you if so). There is no fee unless a request is clearly unfounded or excessive. We may ask you to confirm your identity so we do not give your data to the wrong person.
Asking for CCTV footage: please tell us the date, approximate time and what you were wearing. We may need to blur other people in the footage.
10. Complaints
Please contact us first at hello@ottacoffee.co.uk so we can put things right. We aim to acknowledge complaints within 30 days. You also have the right to complain at any time to the Information Commissioner’s Office: ico.org.uk/make-a-complaint, helpline 0303 123 1113.
11. Children
Our Website and online shop are not aimed at children under 13, and we do not knowingly collect their data online. If you think a child has given us personal data, email us and we will delete it. Children are of course welcome in our café, and CCTV may capture them as it does any visitor.
12. Links to other websites
Our Website and social media may link to other sites. We do not control them and this policy does not apply to them, so please read their privacy notices.
13. Changes to this policy
We may update this policy from time to time. The “Last updated” date at the top always shows the current version. If we make a significant change, such as a new type of use or a new category of recipient, we will notify you by a prominent notice on the Website or by email if we have your address, and where the law requires it we will ask for your consent again. Continuing to browse the Website does not count as agreeing to new uses of your data that need consent.
14. Contact
Otta Coffee, 153 New Line, Bradford, BD10 0BU Email: hello@ottacoffee.co.uk