1. Who we are
Laura's Little Cafe is the data controller for personal information collected through this website and its online ordering service. This means we decide why and how that information is used.
Mark Battle is appointed as the Data Protection Officer for Laura's Little Cafe and is the contact point for questions about privacy, data protection rights and the handling of personal information.
2. Information we collect
Depending on how you use the website, we may collect:
- your name;
- telephone number;
- delivery address, house number or house name and postcode;
- the items you order, prices, delivery charge, receipt preference and order notes;
- order status, substitutions, cancellations and previous orders to the same delivery address;
- reviews you choose to submit, including your star rating, comment and the name used on the order;
- technical information needed to operate and secure the service, such as IP address, request identifiers, timestamps and limited server logs.
We do not take card payments through this website. Online delivery orders are currently paid in cash.
3. Why we use your information
| Purpose | Information used | Lawful basis |
|---|---|---|
| Checking whether we can deliver to your address and calculating the delivery charge | Address and postcode | Steps taken at your request before entering into a contract |
| Taking, preparing and delivering your order | Name, phone number, address, order details, notes and receipt preference | Performance of a contract |
| Contacting you about substitutions, problems or cancellation | Name, phone number and order details | Performance of a contract and our legitimate interests in managing orders |
| Providing order tracking and showing previous orders for the same delivery address | Order details, postcode and house number/name | Performance of a contract and our legitimate interests in customer service |
| Protecting the ordering system from abuse, fraud or technical problems | IP address, timestamps, request identifiers and security logs | Our legitimate interests in keeping the service secure and reliable |
| Publishing a review that you choose to submit | Order name, rating and review comment | Your consent |
| Keeping records required for accounting, tax, dispute handling or legal obligations | Relevant order and financial records | Legal obligation and, where applicable, legitimate interests |
4. Allergen and health information
Please do not send medical or allergy information through the general delivery notes field. For allergen information, contact Laura's Little Cafe by telephone on 07901 399575 before placing an order.
5. Who can see your information
Customer information is available only where needed to run the service. This may include authorised cafe staff and delivery drivers who need the delivery details to complete an order.
We may also use trusted service providers for website hosting, server infrastructure, backups or technical support. Where a provider processes personal information for us, it should only do so for the agreed service and under appropriate data protection arrangements.
We do not sell customer personal information to advertisers or other organisations.
6. Reviews
If you choose to leave a review after delivery, the name used on your order, your star rating and your comment may be displayed publicly on the Laura's Little Cafe website.
Leaving a review is optional. You may ask us to remove a published review by contacting the Data Protection Officer.
7. How long we keep information
We aim to keep personal information only for as long as it is needed for the purpose it was collected. Our intended retention approach is:
- delivery and customer contact details: normally no longer than 12 months after the order unless needed for an unresolved complaint, dispute or legal reason;
- financial and accounting records: retained for the period required by applicable tax and accounting rules;
- published reviews: retained while they remain relevant to the website, unless you ask us to remove your review or there is another reason to remove it;
- security and technical logs: kept only for as long as reasonably needed for security and troubleshooting.
Important: the ordering system is still being prepared for production use. Automated deletion and anonymisation controls will be completed before the service is relied on for long-term customer data retention. Until then, the business must ensure this retention policy is followed manually.
8. How we protect information
We use technical and organisational measures designed to protect customer information, including restricted staff access, protected staff sessions, server-side validation, rate limiting, HTTPS when deployed, security logging and backups. No internet service can be guaranteed to be completely secure, but we aim to use safeguards appropriate to the information being processed.
9. Your data protection rights
Depending on the circumstances, UK data protection law may give you rights to:
- ask for a copy of personal information we hold about you;
- ask us to correct inaccurate or incomplete information;
- ask us to delete information in certain circumstances;
- ask us to restrict how information is used;
- object to certain processing based on legitimate interests;
- receive certain information in a portable format where the law applies;
- withdraw consent at any time where we rely on consent, including for a published review.
To exercise a right, contact the Data Protection Officer using the details at the top of this notice. We may need to verify your identity before acting on a request.
10. Complaints
If you are unhappy with how we use your information, please contact our Data Protection Officer first so we can try to resolve the matter.
You also have the right to complain to the Information Commissioner's Office (ICO), the UK's data protection regulator. You can find current contact details and guidance at ico.org.uk.
11. Changes to this notice
We may update this privacy notice when the ordering system, our suppliers or our use of personal information changes. The latest version will always be published on this page with its updated date.