This policy explains what personal data Cycle Bros ("we", "us") collects when you use our website, place an order or join our mailing list, how we use it, and your rights over it. For any privacy question, email hello@cyclebros.co.uk.
Who we are
Cycle Bros is a trading name of UFMedia Ltd, a company registered in England and Wales (company no. 09610233), registered office Church View, Sydenham Damerel, Tavistock, Devon PL19 8PU. UFMedia Ltd is the data controller for the personal data described below. Any questions about this policy or your data, email hello@cyclebros.co.uk.
What we collect
- Order details: your name, email address and shipping address, which you provide at checkout so we can process and deliver your order.
- Payment information: card payments are handled entirely by Stripe on Stripe's own checkout. We never see or store your full card details.
- Order emails: we use your email address to send your order confirmation and dispatch notice, and to contact you about your order. Placing an order does not sign you up to our mailing list.
- Mailing list: if you join our list, we keep your email address, the date you joined, where on the site you signed up, and a private code that powers the unsubscribe link in each email.
- Mailing list engagement: for emails sent to our list, we record whether each email was opened and which links were clicked (see "Our mailing list" below). We don't do this for order emails.
- Analytics: anonymous, aggregated usage statistics (see "Analytics and cookies" below).
- How you found us: when you place an order, we note how your visit started (the website you came from, any campaign tag on the link, and the first page you landed on) alongside the order, so we know which posts and links bring in customers.
- Café suggestions: if you nominate a café through our form, we receive what you enter, plus your name and email if you choose to give them so we can follow up. These submissions are handled by Netlify Forms.
How we use it and our legal basis
- To fulfil your order (process payment, deliver coffee, send confirmations). Legal basis: performance of our contract with you.
- To keep records required for accounting and tax. Legal basis: legal obligation.
- To understand site usage through privacy-friendly analytics. Legal basis: our legitimate interest in improving the site, using only aggregated data.
- To understand which links and posts lead to orders, by keeping how your visit started with your order. Legal basis: our legitimate interest in knowing what works for a small business.
- To send our mailing list emails and to see which ones get opened and clicked. Legal basis: your consent, given when you sign up. You can withdraw it at any time by unsubscribing.
- To make sure we never email you after you unsubscribe, by keeping a record that you opted out. Legal basis: our legitimate interest in respecting your choice (and our duty not to send marketing you've refused).
Our mailing list
We only add you to our mailing list if you sign up yourself. We'll email you about things we think you'll want to hear about: new coffees and seasons, new café stops, stories from our journal, and news about Cycle Bros. We send these emails through Mailgun from hello@cyclebros.co.uk, and our list is kept in our own database; we don't use a third-party newsletter service or share the list with anyone else.
To see which emails are worth sending, our list emails contain a small invisible image that tells us when an email is opened, and links that pass briefly through Mailgun so we can count clicks. This shows us whether you opened an email and which links you clicked, along with the approximate time and the type of device or email app. We only use it to understand which emails and topics work, never to build a profile of you or share it with others. Many email apps let you block images, which stops the open tracking. Links back to our website also carry a campaign tag, so if you go on to order we can see which email brought you to us.
Every email has a one-click unsubscribe link. Unsubscribing stops all mailing list emails, and with them the tracking described above. You can also unsubscribe by emailing hello@cyclebros.co.uk.
Who we share it with
We only share data with the service providers that help us run the shop:
- Stripe: payment processing and order/customer records.
- Mailgun: sending our emails (order confirmations, dispatch notices and mailing list emails) from its EU region, and recording opens and clicks for mailing list emails only.
- Netlify: website hosting, our site's server functions, and the café suggestion form.
- Hostinger: hosting the database that holds our working copy of orders and our mailing list.
- Limini Coffee: our roastery and fulfilment partner in Yorkshire, who receive your name and delivery address to roast and ship your order.
- Plausible Analytics: privacy-friendly website analytics, an EU-based service with data hosted in the EU.
- OpenStreetMap: the maps on our café pages load map images from OpenStreetMap's servers.
Loading a map, like loading any web page, means OpenStreetMap receives your device's IP address and basic browser information so it can send the map images back. We don't send it anything else about you. Our fonts are hosted on our own website, so they don't involve anyone else.
We never sell your personal data.
International transfers
Some of the providers above, including Stripe, Netlify and Mailgun, are based in or process data in the United States. Where your personal data leaves the UK, it is protected by the safeguards UK law requires, such as the UK-US data bridge or the standard contractual clauses approved for UK transfers.
Analytics and cookies
We use Plausible Analytics, a privacy-friendly analytics tool. It does not use cookies, does not collect any personal or identifiable information, and does not track you across websites or over time. It only produces aggregated statistics such as page views and referrers. Because of this, our site does not require a cookie consent banner for analytics. Note that Stripe may set cookies on its own checkout pages as part of processing your payment.
To record how your visit started, our site keeps a small note in your browser's session storage: the website you came from, any campaign tag on the link, and your landing page. It contains nothing that identifies you, is never used to track you across sites, and is deleted when you close the tab. If you go on to order, it is sent with your order so we can see which links bring in customers.
Your basket is saved in your browser's local storage so it's still there when you come back. Now and then we may run a "still in your basket" offer. While it's on, your browser sends us a random basket number and the products and quantities in your basket, so we can tell when a basket has been waiting a while and offer a one-off discount code on the site. It contains no name, email address or anything else that identifies you, we never email you about it, and baskets nobody has touched for 60 days are deleted.
Our café maps don't set cookies or store anything in your browser. The open and click tracking in our mailing list emails is described under "Our mailing list" above.
How long we keep it
We keep order and transaction records for as long as needed to fulfil your order and to meet our legal and accounting obligations (in the UK, financial records are generally retained for six years). Analytics data is aggregated and not tied to you.
We keep your mailing list details until you unsubscribe. After that we keep only your email address, marked as unsubscribed, with the date, so we can make sure you're never emailed again; if you'd rather we erase even that, email us and we will (just bear in mind we then can't check you against the list if you're re-added by mistake). Open and click records are kept by Mailgun for a limited period and then deleted. Café suggestions are kept only as long as we need them to look into the café and follow up with you.
Your rights
Under UK data protection law you have the right to access, correct, or request deletion of your personal data, to object to or restrict its processing, and to data portability. Where we rely on your consent (our mailing list), you can withdraw it at any time, which doesn't affect anything we did before you withdrew it. To exercise any of these, email hello@cyclebros.co.uk. You also have the right to complain to the Information Commissioner's Office (ICO) at ico.org.uk.
Changes to this policy
We may update this policy from time to time. The "last updated" date at the top shows when it last changed.