Privacy notice
What we collect when you join Club Carva, why, and what you can ask us to do with it.
1. Who we are
Cafe Carva Limited (“Café Carva”, “we”, “us”) is the controller of your personal data. We are registered in England and Wales under company number 16163696. Our registered office is 85 Newman Square, Shirley, Solihull, B90 4DZ.
For anything about your data, email hola@cafecarva.com. We are registered with the Information Commissioner’s Office under number [ICO registration number].
2. What we collect
- Your details: email address first, then first and last name.
- Your coffee answers: how you make coffee, beans or ground, cups a day, where you buy coffee, what matters to you, your connection to Colombia, your age range and how you heard about us. Every one of these questions is optional.
- Your choices: which permissions you ticked, the exact wording you saw, and when.
- Membership details: your member number and whether you confirmed your email.
- Technical data: basic server logs such as IP address and browser type, kept by our hosting provider for security. We also keep your IP address for up to one day to stop the sign-up being flooded. On the last step of the sign-up, Cloudflare Turnstile checks that you’re not a bot; it doesn’t set cookies or track you across sites.
- Visit statistics: only if you accept cookies: pages viewed, sign-up steps reached, device and rough location, collected by Google Analytics.
3. Why we use it, and on what legal basis
| What we do | Legal basis (UK GDPR) |
|---|---|
| Create and run your membership: member number, digital card, your 10% discount | Contract: you asked to join |
| Keep the email of an unfinished sign-up, so you can pick up where you left off. We don’t send it marketing. | Legitimate interests. Deleted after 30 days. |
| Keep the details of a sign-up whose email isn’t confirmed yet, so the confirmation link works | Steps you asked for before joining. Deleted after 30 days if never confirmed. |
| Email you drop dates and club news | Consent: only if you tick the email box. Withdraw any time. |
| Send service emails, such as confirming your address or changes to these terms | Contract |
| Understand our members from your coffee answers, to choose coffees, grinds and bag sizes | Legitimate interests. You choose whether to answer. |
| Keep a record of your permissions and of anyone who unsubscribed | Legal obligation and legitimate interests (proving consent, respecting opt-outs) |
| Keep the website secure | Legitimate interests |
| Count visits and see where the sign-up loses people (Google Analytics) | Consent: only if you accept cookies. Change it any time on the cookies page. |
We do not sell your data, and we do not use it for automated decisions that affect you.
4. Who we share it with
Only with companies that help us run Club Carva, under contracts that oblige them to protect your data:
- Website hosting, member database and the bot check: Cloudflare, Inc.
- Website photos and texts: Sanity (sanity.io). Your browser loads photos from Sanity’s servers, which see your IP address. Your membership details are never stored there.
- Visit statistics, only with your consent: Google Ireland Limited (Google Analytics)
- Email sending and the drop mailing list: Brevo (France)
- Our email inboxes, when you write to us or reply to our emails: Microsoft (Microsoft 365) and Google (Google Workspace)
- Our professional advisers, and authorities where the law requires it.
5. Transfers outside the UK
Some of these providers store data outside the UK, for example in the United States. Where they do, we rely on UK adequacy regulations or the UK International Data Transfer Agreement or Addendum to keep your data protected to UK standards.
6. How long we keep it
- Membership details: while you are a member. When you leave, we delete your name, address and coffee answers straight away, and our email provider deletes your contact.
- After you leave: we keep your email address, member number, join dates and permission records, so we never email you again by mistake and never give your number to anyone else.
- Email from an unfinished sign-up, and sign-ups never confirmed: 30 days.
- Coffee answers: 24 months, then deleted.
- IP addresses used to stop sign-up floods: one day.
- Visit statistics in Google Analytics: 2 months.
- Permission records: for as long as we rely on them, plus 6 years.
7. Your rights
You can ask us to:
- give you a copy of your data
- correct it
- delete it
- restrict or object to how we use it
- send it to you or another company in a common format
- stop emails: use the unsubscribe link in any drop email, the “Manage your membership” link in your welcome email, or email us
We reply within one month. If you are unhappy with how we handle your data, you can complain to the Information Commissioner’s Office at ico.org.uk or on 0303 123 1113. We’d appreciate the chance to fix it first.
8. Age
Club Carva is for people aged 18 or over. We do not knowingly collect data from children.
9. Changes
If we change this notice in a way that matters, we’ll email members before it takes effect.