Privacy Policy

Peak Coffee Co ("we", "us", or "our") is committed to protecting your privacy and ensuring the security of your personal information. This Privacy Policy explains how we collect, use, disclose, and safeguard your data when you visit our website or make a purchase from us.

We are registered in England and Wales under Company Number 15384230 with VAT Number 341409132.

By using our website, you consent to the data practices described in this policy.

We use the information we collect to:

• Process your orders: Fulfill purchases, manage subscriptions, and handle payments
• Communicate with you: Send order confirmations, shipping updates, and respond to inquiries
• Improve our service: Analyze website usage to enhance user experience and product offerings
• Personalize your experience: Remember your preferences and provide tailored recommendations
• Manage your account: Maintain your loyalty rewards, referral credits, and subscription settings
• Marketing communications: Send promotional emails (only if you've opted in)
• Prevent fraud: Detect and prevent fraudulent transactions and abuse
• Legal compliance: Comply with legal obligations including tax and accounting requirements

We use cookies and similar tracking technologies to track activity on our website and store certain information. Cookies are small data files stored on your device.

You can instruct your browser to refuse cookies or alert you when cookies are being sent. However, some parts of our website may not function properly without cookies.

We may share your personal information with trusted third parties who assist us in operating our website and conducting our business:

• Payment Processors: Stripe processes all payments securely (we do not store card details)
• Delivery Partners: Shipping companies need your delivery address to fulfill orders
• Email Service Providers: Resend helps us send transactional and marketing emails
• Analytics Providers: Services like Google Analytics help us understand website usage
• Cloud Hosting: Our website and database are hosted on secure cloud platforms

We ensure all third parties are contractually obligated to protect your data and comply with GDPR. We do not sell your personal information to third parties.

Under UK GDPR, you have the following rights:

• Right to Access: Request a copy of the personal data we hold about you
• Right to Rectification: Request correction of inaccurate or incomplete data
• Right to Erasure: Request deletion of your personal data (subject to legal obligations)
• Right to Restrict Processing: Request limitation on how we use your data
• Right to Data Portability: Receive your data in a structured, machine-readable format
• Right to Object: Object to processing based on legitimate interests or direct marketing
• Right to Withdraw Consent: Withdraw consent for marketing communications at any time

To exercise any of these rights, please contact us at hello@peakcoffee.co.uk. We will respond within 30 days.

We implement appropriate technical and organizational measures to protect your personal data against unauthorized access, alteration, disclosure, or destruction. This includes:

• Secure HTTPS encryption for all data transmission
• Regular security audits and vulnerability assessments
• Access controls and authentication requirements
• Secure cloud infrastructure with industry-leading providers
• Regular backups and disaster recovery procedures

However, no method of transmission over the internet is 100% secure. While we strive to protect your data, we cannot guarantee absolute security.

We retain your personal information only for as long as necessary to fulfill the purposes outlined in this policy:

• Account Data: Retained while your account is active, plus 3 years after account closure for legal compliance
• Order History: Retained for 7 years to comply with UK tax and accounting requirements
• Marketing Data: Retained until you unsubscribe or request deletion
• Analytics Data: Anonymized after 26 months

After the retention period, we securely delete or anonymize your personal data.

Our website is not intended for children under the age of 16. We do not knowingly collect personal information from children. If you believe we have inadvertently collected data from a child, please contact us immediately.

We may update this Privacy Policy from time to time to reflect changes in our practices or legal requirements. We will notify you of significant changes by posting a notice on our website or sending you an email. The "Last updated" date at the top indicates when the policy was last revised.

We encourage you to review this policy periodically to stay informed about how we protect your data.