Privacy policy

This policy explains how Cupped (“Cupped”, “we”, “us”) handles your personal data when you visit our website, buy coffee from the independent roasters on our marketplace, or subscribe to our Coffee Club. We are the “data controller” for the personal data described here under the UK GDPR and the Data Protection Act 2018.

If you have any questions about this policy or your data, contact us at hello@cuppedcoffee.co.uk.

Who we are and how the marketplace works

Cupped is a marketplace that connects you with independent UK coffee roasters. When you place an order, the roaster fulfils and ships it to you, and payments are processed securely by Stripe. This means that, depending on what you do, your data may be shared with the relevant roaster (so they can fulfil your order) and with Stripe (so your payment can be taken). We explain this in more detail below.

The data we collect

We collect and use the following categories of personal data:

• Account details — your name, email address and password (stored only as a secure hash) when you create an account.
• Order and delivery details — your shipping and billing addresses, the items you buy, order history and any delivery notes.
• Payment details — handled by Stripe. We never see or store your full card number; we keep a Stripe customer reference and limited details such as the card brand and last four digits so you can manage saved payment methods.
• Subscription details — the coffees, frequency and delivery preferences for any Coffee Club subscription.
• Reviews and content — any reviews, ratings or messages you submit.
• Technical and usage data — IP address, browser type, device information and how you interact with the site, collected through cookies and similar technologies (see our Cookie policy).

How and why we use your data

We only use your personal data where the law allows us to. Our lawful bases are:

• To perform our contract with you — to create and manage your account, process and fulfil orders and subscriptions, take payment, and provide customer support.
• For our legitimate interests — to run, secure and improve the marketplace, prevent fraud and abuse, and respond to your enquiries, provided your rights don’t override these interests.
• To comply with a legal obligation — for example, keeping records for tax, accounting and consumer-law purposes.
• With your consent — for non-essential cookies and any marketing emails. You can withdraw consent at any time.

Who we share your data with

We share personal data only where necessary, with:

• Roasters — when you buy from a roaster, we share the details they need to fulfil and ship your order (such as your name, delivery address and the items ordered). Each roaster is an independent business responsible for its own use of that data.
• Stripe — our payment processor, to take payment and manage saved payment methods and subscriptions. See Stripe’s own privacy policy for how they handle data.
• Service providers — hosting, email delivery, error monitoring and analytics providers who process data on our behalf under contract.
• Authorities or advisers — where required by law, or to establish, exercise or defend legal claims.

We do not sell your personal data.

International transfers

Some of our service providers (for example payment and hosting providers) may process data outside the UK. Where they do, we rely on appropriate safeguards such as UK adequacy regulations or the International Data Transfer Agreement to keep your data protected to UK standards.

How long we keep your data

We keep your personal data only for as long as we need it for the purposes set out above. Order and transaction records are typically retained for at least six years to meet tax and accounting obligations. If you close your account, we delete or anonymise data we no longer need to keep.

Your rights

Under UK data protection law you have the right to:

• access a copy of the personal data we hold about you;
• ask us to correct inaccurate or incomplete data;
• ask us to delete your data in certain circumstances;
• object to, or ask us to restrict, certain processing;
• request your data in a portable, machine-readable format; and
• withdraw consent where we rely on it.

To exercise any of these rights, email hello@cuppedcoffee.co.uk. We’ll respond within one month. You also have the right to complain to the Information Commissioner’s Office (ICO) at ico.org.uk, though we’d appreciate the chance to address your concerns first.

Keeping your data secure

We use appropriate technical and organisational measures to protect your data, including encryption in transit, hashed passwords and restricted access. Payment card data is handled entirely by Stripe’s PCI-DSS compliant systems and never touches our servers.

Children

Cupped is intended for adults and is not directed at children. We do not knowingly collect personal data from anyone under 16.

Changes to this policy

We may update this policy from time to time. When we make material changes we’ll update the “last updated” date above and, where appropriate, let you know by email.

Contact us

For any privacy question or request, email hello@cuppedcoffee.co.uk.