1. Who we are
Laura's Little Cafe is the data controller for personal information collected through this website and its online ordering service. This means we decide why and how that information is used.
Mark Battle is appointed as the Data Protection Officer for Laura's Little Cafe and is the contact point for questions about privacy, data protection rights and the handling of personal information.
2. Information we collect
Depending on how you use the website, we may collect:
- your name;
- telephone number;
- where you choose delivery, your delivery address, house number or house name and postcode;
- your delivery or collection choice, the items you order, prices, any delivery charge, receipt preference and order notes;
- order status, substitutions, cancellations and, for delivery orders, previous orders to the same delivery address;
- reviews you choose to submit, including your star rating, comment and the name used on the order;
- technical information needed to operate and secure the service, such as IP address, request identifiers, timestamps and limited server logs;
- if you choose the optional returning-customer feature, a random browser identifier stored on your device so we can recognise that the same browser has ordered before without requiring an account.
We do not take card payments through this website. Online delivery and collection orders are currently paid in cash.
The returning-customer feature is optional. The browser identifier does not create an account and is not used as proof of identity. You can turn recognition off at checkout, and clearing this website's browser data will remove the recognition preference from that device.
3. Why we use your information
| Purpose | Information used | Lawful basis |
|---|---|---|
| Checking whether we can deliver to your address and calculating the delivery charge | Address and postcode | Steps taken at your request before entering into a contract |
| Taking, preparing and fulfilling your delivery or collection order | Name, phone number, delivery address where applicable, order details, notes and receipt preference | Performance of a contract |
| Contacting you about substitutions, problems or cancellation | Name, phone number and order details | Performance of a contract and our legitimate interests in managing orders |
| Providing order tracking and recovery | Order details; delivery postcode and house number/name, or collection order number and phone number | Performance of a contract and our legitimate interests in customer service |
| Recognising returning customers without requiring an account, when you choose this feature | Random browser identifier and the number/date of previous orders linked to that browser | Your consent |
| Protecting the ordering system from abuse, fraud or technical problems | IP address, timestamps, request identifiers and security logs | Our legitimate interests in keeping the service secure and reliable |
| Responding to a message sent through the Contact page | Name, message and the email address and/or phone number you provide | Our legitimate interests in responding to customer enquiries and, where relevant, steps taken at your request before entering into a contract |
| Publishing a review that you choose to submit | Order name, rating and review comment | Your consent |
| Keeping records required for accounting, tax, dispute handling or legal obligations | Relevant order and financial records | Legal obligation and, where applicable, legitimate interests |
4. Allergen and health information
Please do not send medical or allergy information through the general order notes field. For allergen information, contact Laura's Little Cafe by telephone on 07901 399575 before placing an order.
5. Who can see your information
Customer information is available only where needed to run the service. This may include authorised cafe staff and, for delivery orders, delivery drivers who need the delivery details to complete an order.
We may also use trusted service providers for website hosting, server infrastructure, backups or technical support. Where a provider processes personal information for us, it should only do so for the agreed service and under appropriate data protection arrangements.
We do not sell customer personal information to advertisers or other organisations.
6. Reviews
If you choose to leave a review after delivery or collection, the name used on your order, your star rating and your comment may be displayed publicly on the Laura's Little Cafe website.
Leaving a review is optional. You may ask us to remove a published review by contacting the Data Protection Officer.
7. How long we keep information
We aim to keep personal information only for as long as it is needed for the purpose it was collected. Our intended retention approach is:
- order fulfilment and customer contact details: normally no longer than 12 months after the order unless needed for an unresolved complaint, dispute or legal reason;
- financial and accounting records: retained for the period required by applicable tax and accounting rules;
- published reviews: retained while they remain relevant to the website, unless you ask us to remove your review or there is another reason to remove it;
- contact form enquiries: normally retained only for as long as needed to respond and manage any follow-up, usually no longer than 12 months;
- security and technical logs: kept only for as long as reasonably needed for security and troubleshooting;
- where returning-customer recognition is enabled, the browser identifier remains on the device until recognition is switched off or site data is cleared; its server-side link to orders follows the same retention period as those orders.
Important: the ordering system is still being prepared for production use. Automated deletion and anonymisation controls will be completed before the service is relied on for long-term customer data retention. Until then, the business must ensure this retention policy is followed manually.
8. How we protect information
We use technical and organisational measures designed to protect customer information, including restricted staff access, protected staff sessions, server-side validation, rate limiting, HTTPS when deployed, security logging and backups. No internet service can be guaranteed to be completely secure, but we aim to use safeguards appropriate to the information being processed.
9. Your data protection rights
Depending on the circumstances, UK data protection law may give you rights to:
- ask for a copy of personal information we hold about you;
- ask us to correct inaccurate or incomplete information;
- ask us to delete information in certain circumstances;
- ask us to restrict how information is used;
- object to certain processing based on legitimate interests;
- receive certain information in a portable format where the law applies;
- withdraw consent at any time where we rely on consent, including for a published review.
To exercise a right, contact the Data Protection Officer using the details at the top of this notice. We may need to verify your identity before acting on a request.
10. Complaints
If you are unhappy with how we use your information, please contact our Data Protection Officer first so we can try to resolve the matter.
You also have the right to complain to the Information Commissioner's Office (ICO), the UK's data protection regulator. You can find current contact details and guidance at ico.org.uk.
11. Changes to this notice
We may update this privacy notice when the ordering system, our suppliers or our use of personal information changes. The latest version will always be published on this page with its updated date.