privacy policy
What we do with your details when you send an enquiry, book a job or simply read this page — and how to get any of it back, changed or deleted.
Last updated: 26 July 2026
This policy explains what we do with personal data collected through woldcoffee.co.uk and when you book us for a job. It is written to the UK GDPR and the Data Protection Act 2018.
Who is responsible for your data
The data controller is Wold Coffee Limited, a company registered in England and Wales, company number 17253477, registered office 2 Kings Head Court, Chipping Norton, England, OX7 5LP.
There is no data protection officer — we are too small to be required to appoint one. Data protection questions come to the same address as everything else: milly@woldcoffee.co.uk or 07494 893379.
What we collect
When you send an enquiry. Your name, the company or production you are enquiring for if you give one, your email address, your phone number, the type of work, the dates, the location or postcode, the headcount and whatever you write in the message. If you tell us about dietary requirements or allergies, that is health data, and we only hold it for as long as it takes to cater the job safely.
When you book. The details above, plus site or venue contact details, the running order or schedule if you send one, and the billing address and payment reference for the invoice.
When you visit the site. Our host records standard server log data, including your IP address, the pages requested and your browser's user agent. When you submit the enquiry form, your IP address is held briefly in memory to count submissions and stop the form being used to send bulk mail. It is not written to a database and it is not stored with your enquiry.
Analytics, only if you agree to it. If you accept analytics cookies we receive aggregated statistics from Google Analytics 4 about how the site is used — pages viewed, approximate location at city level, device type, and how you arrived. IP addresses are not stored by Google Analytics 4, and we have not enabled Google Signals or advertising features. See the cookie policy for the detail.
We do not run a mailing list, we do not buy or sell contact data, and we do not make automated decisions or profile anyone.
Why we are allowed to hold it
| Purpose | Lawful basis |
|---|---|
| Answering an enquiry and preparing a quotation | Legitimate interests — you have asked us to price a job, and it cannot be answered without your details |
| Delivering a booking you have confirmed | Performance of a contract |
| Handling dietary and allergen requirements | Explicit consent, which you give by telling us; and our legal obligation to provide accurate allergen information |
| Keeping invoices and accounting records | Legal obligation under the Companies Act 2006 and HMRC record-keeping rules |
| Analytics cookies | Consent, which you can withdraw at any time |
| Keeping the site and the form secure | Legitimate interests |
Where we rely on legitimate interests, we have considered whether the processing is necessary and whether it overrides your rights. Answering the enquiry you sent us does not, in our view, do that — but you can object, and we will stop.
How long we keep it
- Enquiries that do not become bookings — up to 24 months from your last contact with us, so we can pick up a conversation about a date that moved.
- Booking records and correspondence — six years after the end of the financial year the booking falls in.
- Invoices and accounting records — six years after the end of the relevant accounting period, as the law requires.
- Dietary and allergen details — deleted once the job is finished, unless the same client has a standing account and asks us to keep them.
- Server logs — retained by our host for a short period as part of its normal operation.
Who else sees it
We use a small number of suppliers who process personal data on our instructions. Each is bound by a contract that limits what they may do with it.
| Processor | What it does | Where |
|---|---|---|
| Resend (Resend, Inc.) | Delivers the enquiry form to our inbox | United States |
| Amazon Web Services (AWS Amplify Hosting) | Hosts and serves this website | United Kingdom, London region |
| Google (Google Ireland Limited) | Google Analytics 4, only with your consent | European Union, with transfers to the United States |
We will also share data where the law requires it, or with our insurer, accountant or professional advisers where there is a genuine need — for example if a claim is made about a job we worked.
Transfers outside the UK
Resend processes data in the United States, and Google may transfer data to the United States. Those transfers rely on the UK extension to the EU–US Data Privacy Framework where the recipient is certified under it, and otherwise on the UK International Data Transfer Addendum to the EU standard contractual clauses, together with the supplier's technical safeguards. You can ask us for the detail of the safeguards that apply to your data.
Your rights
Under the UK GDPR you have the right:
- To be informed about how your data is used — this policy is how we do that.
- Of access to the personal data we hold about you.
- To rectification of anything inaccurate or incomplete.
- To erasure where we no longer have a good reason to hold it.
- To restrict processing while a dispute about accuracy or lawfulness is resolved.
- To data portability for data you gave us, where processing is by consent or contract.
- To object to processing based on legitimate interests.
- Not to be subject to automated decision-making or profiling — we do not do either.
You can also withdraw consent at any time, including analytics consent, which you can change from the cookie settings link in the footer of every page.
To exercise any of these, email milly@woldcoffee.co.uk. We will respond within one month, as the law requires, and there is no charge. We may ask you to confirm who you are before we send personal data anywhere.
Complaints
If you think we have handled your data badly, tell us first — it is usually quicker. You also have the right to complain to the Information Commissioner's Office at any time:
Information Commissioner's Office, Wycliffe House, Water Lane, Wilmslow, Cheshire, SK9 5AF. Helpline 0303 123 1113. ico.org.uk/make-a-complaint
Changes to this policy
If we change how we handle personal data we will update this page and the date at the top of it. Material changes will be flagged on the page for a reasonable period.