Privacy Policy

Introduction

This privacy policy applies between you, the User of this Website and CAFFE MILANO DD LTD, the owner and provider of this Website. CAFFE MILANO DD LTD takes the privacy of your information very seriously. This privacy policy applies to our use of any and all Data collected by us or provided by you in relation to your use of the Website.

This privacy policy should be read alongside, and in addition to, our Terms and Conditions, which can be found at: www.caffemilanoukltd.co.uk/terms-and-conditions.

Definitions & Interpretation

Scope & Data Collected

For purposes of the applicable Data Protection Laws, CAFFE MILANO DD LTD is the "data controller". We may collect the following Data from you:

• Full Name — to identify you and personalise our communications.
• Email Address — to respond to your enquiry and, where separately consented to, to send marketing communications.
• Company Name — where provided, to understand your business context and to assess eligibility for wholesale or trade accounts.
• Phone Number — where provided, to facilitate direct communication regarding your enquiry or, where separately consented to, for marketing purposes in accordance with PECR.
• Message Content — the details you provide in your enquiry to enable us to respond appropriately.
• IP address, web browser type, operating system, and activity on this Website (automatically collected via cookies and server logs).

Lawful Bases for Processing

We process personal data under the following lawful bases:

• Contract: Processing is necessary for the performance of a contract with you, such as processing orders, managing payments, and delivering goods.
• Legal Obligation: Processing is necessary for compliance with our legal obligations under UK law, including tax, accounting, and corporate reporting requirements.
• Consent: You have given us clear consent to process your personal data for a specific purpose, such as analytical cookies or marketing subscriptions.
• Legitimate Interests: Processing is necessary for our legitimate business interests, including maintaining security, preventing fraud, and optimizing website usability.

How We Use Data & Cookies

Data is required to provide you with the best possible service, including:

• Running your online shopping cart and processing your orders.
• Authenticating your B2B or B2C session and managing your account.
• Handling enquiries submitted via the Contact Form — including General Enquiries, Wholesale & Trade requests, and Machine Technical Support requests — on the lawful basis of legitimate interests and, where applicable, pre-contractual steps taken at your request (UK GDPR Article 6(1)(b) and 6(1)(f)).
• Monitoring site performance and resolving technical issues.

Before the Website places Analytics or Performance Cookies on your computer, you will be presented with a modern Cookie Banner requesting your explicit consent. You can deny or change this consent at any time via the banner interface. Denying consent does not affect strictly necessary cookies (such as the shopping basket and user login).

Contact Form Data & Marketing Communications

Processing of Contact Enquiries

When you submit the Contact Form on our Website, we collect the following personal data: Full Name, Email Address, and Message (mandatory); and, where voluntarily provided, your Company Name and Phone Number. We also collect your selected Reason for Contact (General Enquiry, Wholesale & Trade, or Machine Technical Support).

This data is processed solely to respond to and manage your enquiry. The lawful basis for this processing is our legitimate interests in providing customer support and managing business relationships (UK GDPR Article 6(1)(f)), and, where your enquiry relates to a potential commercial arrangement, the taking of pre-contractual steps at your request (UK GDPR Article 6(1)(b)).

By ticking the mandatory privacy acceptance checkbox on the Contact Form, you acknowledge that you have read and understood this Privacy Policy and consent to us contacting you in connection with your specific enquiry. This acknowledgement does not constitute consent to marketing communications.

Marketing Communications

We will only send you marketing communications — including updates, promotional offers, exclusive wholesale benefits, and commercial information — by email or telephone where you have given your freely given, specific, informed, and unambiguous consent to do so, by ticking the optional marketing opt-in checkbox on our Contact Form.

This opt-in checkbox is presented separately from the mandatory privacy acknowledgement, is not pre-ticked, and is entirely voluntary. Declining to tick it will not affect the processing of your enquiry in any way.

In accordance with the Privacy and Electronic Communications Regulations 2003 (PECR) and UK GDPR, you have the right to withdraw your marketing consent at any time, without detriment. To do so, you may:

• Click the unsubscribe link included in any marketing email we send you; or
• Send a written withdrawal request to support@caffemilanoukltd.co.uk.

We will process your withdrawal request promptly and within a reasonable period, after which no further marketing communications will be sent to you on the basis of that consent.

International Data Transfers

Some of our third-party processors (such as Stripe Inc., Intuit Inc., Google LLC, and Microsoft Corporation) process and store data outside the United Kingdom, specifically in the United States. Where such international data transfers occur, we ensure that appropriate safeguards are in place, including standard contractual clauses (SCCs) approved by the UK Information Commissioner's Office (ICO).

Data Retention

We retain personal data only for as long as necessary to fulfill the purposes outlined in this policy:

• Orders & Financials: Retained for 6 years from the end of the financial year, in compliance with UK tax and company laws.
• Account Details: Retained for the duration of your account registration, until you request its deletion.
• Technical Logs: Kept for 30 to 90 days for technical debugging and security analysis.

Data Security and Disaster Recovery

We implement strict technical, administrative, and organizational safety measures to safeguard your Data against unauthorized access, loss, or cyber threats:

• Credential Encryption: Access to your personal or corporate dashboard is securely locked behind individualized credentials encrypted using industry-standard hashing algorithms (such as bcrypt/argon2). No raw passwords are ever stored on our servers.
• Payment Security: All financial transactions are handled via end-to-end tokenized processes through Stripe. No raw credit or debit card data ever breaches or is stored within our primary database or hosting environment.
• Automated Redundant Backups: To guarantee data integrity and compliance with UK GDPR recovery requirements, we maintain an automated backup strategy. The database is backed up daily, with encrypted copies stored securely in isolated, off-site cloud repositories separate from the main website server. This ensures rapid data restoration capabilities in the event of a technical failure or cyber incident.

Your Rights

Under the UK GDPR, you have the right to access, correct, erase, or restrict our use of your Data. To exercise these rights, please contact us at info@caffemilanoukltd.co.uk. If unsatisfied, you have the right to refer your complaint to the Information Commissioner’s Office (ICO) at https://ico.org.uk/.

Cookie Policy & Web Analytics

We use cookies to make our site work and to optionally improve your experience. Our Cookie Banner allows you to select between "Accept All" (enables essential + analytics cookies) and "Essential Only" (enables only strictly necessary cookies — no analytics scripts are loaded or activated).

Your preference is stored in your browser's localStorage under the key caffemilano_cookie_consent. This preference is respected on every subsequent page load — analytics scripts are only initialised if you have actively consented. You can reset your preference by clearing your browser site data.

For a full schedule of every cookie we use (including PHPSESSID, auth_token, caffemilano_source, Stripe cookies, Microsoft Clarity, and Google Analytics), see our full Cookie Policy at: /cookie-policy.

Coffee Plan Subscriptions

When you enrol in our recurring Coffee Plan, we process your personal and billing details on the lawful basis of performance of a contract (UK GDPR Article 6(1)(b)).

Recurring charges are processed automatically at the frequency you select (weekly, fortnightly, or monthly) via our secure payment gateway, Stripe Payments UK Ltd. Card details are handled via end-to-end tokenisation directly with Stripe — we do not store raw card numbers in our database. Stripe retains a secure payment token linked to your account to facilitate future subscription charges.

You can view, modify, pause, or cancel your subscription at any time from your account dashboard under "My Profile → Subscriptions". Cancellation takes effect at the end of the current billing cycle. No partial refunds are issued for cancelled billing cycles unless required by UK consumer law.

For questions about subscription billing, contact us at info@caffemilanoukltd.co.uk.