Last updated: 6 October 2026
This explains how we use personal information when you browse our shop, place an order or choose to hear from us.
Who is responsible
Raphaella Ltd, trading as Raphie’s Coffee, is registered in England and Wales (company number 17456964). Our registered office and postal address is 8 Albion Court, Burnopfield, NE16 6LS. Email hello@raphiescoffee.co.uk.
Raphaella Ltd is the controller of the personal information described here. Contact us using the email above with privacy questions or requests.
What we collect and why
- Orders and accounts: contact details, delivery and billing addresses, purchases, account credentials and payment status to fulfil our contract with you. Payment providers process payment details; we do not receive your full card number.
- Customer support: your correspondence and order details to answer questions and resolve issues, under our legitimate interests in providing customer service.
- Records and security: transaction records for legal obligations, and technical information such as IP addresses and logs for our legitimate interests in protecting the shop and preventing fraud.
- Newsletters: your email address, subscription status and consent when you sign up. We use consent, with email confirmation. Buying coffee does not subscribe you.
- Basket reminders: only if you tick the optional checkout box, we keep your email, basket contents and consent time to send one reminder. This does not subscribe you to newsletters.
- Visitor analytics: with your consent, Google Analytics receives information about visits, pages and device/browser use. We do not intentionally send names, email addresses, delivery addresses or payment details to Analytics.
- Reviews: if you submit a review, its text and display name may appear publicly. Your email is not published. Please avoid including private information.
Order details are needed to complete a purchase; marketing and analytics choices are optional.
Who receives information
We share only what is needed for each service:
- Hostinger: website hosting and our business mailbox.
- WooCommerce: shop software and connected services used to operate orders.
- Stripe and Square: payment processing, authentication and fraud prevention for the payment method you choose. Their own privacy notices also apply: Stripe and Square.
- Royal Mail: delivery name, address and contact details needed for delivery.
- MailPoet / Automattic: newsletter subscription management and email sending when enabled. See Automattic’s privacy notice. Newsletter sending is subject to the service’s account approval.
- Google: consented visitor analytics and our Gmail mailbox. Messages received at hello@raphiescoffee.co.uk are forwarded to our business Gmail inbox, with a copy retained in Hostinger.
- Professional advisers or public authorities where necessary for legal obligations, claims or business administration.
Order and basket-reminder emails are sent through our Hostinger business email service. We do not sell your personal information.
International processing
Some providers operate internationally and may process information outside the UK. Their privacy notices explain their processing locations and transfer arrangements. Transfers that we arrange must use an applicable UK adequacy decision or appropriate contractual safeguards, such as approved international transfer terms. Contact us for information about the safeguards relevant to your data.
How long we keep information
- Order and accounting records: normally six years after the end of the relevant accounting period, and longer if required for a legal claim or obligation.
- Accounts: while used, then reviewed for deletion when closed, except records we must retain.
- Enquiries: while needed to resolve the matter; correspondence connected to orders, complaints or claims may be retained with the relevant records.
- Newsletter subscriptions: until you unsubscribe. Unconfirmed signups are scheduled for deletion after 30 days. We may retain a minimal suppression and consent record to respect your choice and demonstrate consent.
- Consented basket-reminder records: normally 30 days, with scheduled deletion. Unsubscribing stops further reminders.
- Reviews: while relevant to the product or until removed following a valid request, subject to moderation and legal requirements.
- Security and service logs: for troubleshooting, fraud prevention and any relevant investigation, according to the service’s retention arrangements.
- Cookie-consent records: normally 12 months. Google Analytics’ cookie durations are shown below; its reporting data is subject to the property’s retention controls.
Deletion from backups follows backup replacement schedules. A legal dispute or record-keeping duty may require limited information to be retained longer.
Cookies and similar storage
Essential storage keeps the basket, login, security and cookie choices working. Optional Google Analytics loads only after you accept analytics cookies. Rejecting optional cookies does not prevent shopping. Use Cookie choices or Cookie settings in the footer to change your choice; withdrawal stops future optional collection. Previously collected data is not automatically erased by changing cookies.
| Storage / provider | Purpose and category | Typical duration |
|---|---|---|
| woocommerce_cart_hash; woocommerce_items_in_cart | WooCommerce basket updates — essential | Browser session |
| wp_woocommerce_session_* | WooCommerce basket session — essential | Two days |
| wordpress_logged_in_*; wordpress_sec_*; wordpress_test_cookie | WordPress login and cookie checks — essential, where applicable | Session, or up to 14 days when login is remembered |
| surecookie_preferences and consent metadata | Remember cookie choices in browser storage — essential | Choice renewed after 365 days |
| _ga; _ga_NXJ1VT7TVF | Google Analytics visitor/session measurement — optional analytics | Up to two years, refreshed by visits |
| Payment-provider storage | Stripe or Square payment security, fraud prevention and authentication when using checkout | Varies by provider and payment flow |
Payment providers may set their own cookies or similar storage during payment. See Stripe’s cookie information and Square’s cookie notice for their details. The storage used may change with browser, login state and the service selected.
Email choices
Newsletter signup and basket reminders require separate choices. Unsubscribe using the link in an email or contact us. We will still send essential order and service messages. Newsletter engagement tracking is disabled in our MailPoet settings; necessary subscription, delivery and unsubscribe records remain. If you did not request a signup confirmation, ignore it and you will not be subscribed.
Your rights
Depending on the circumstances, you may ask to access, correct, erase or restrict your information, receive a portable copy, object to processing based on legitimate interests, or withdraw consent without affecting earlier lawful processing. Email hello@raphiescoffee.co.uk. We may need to verify your identity and normally respond within one month.
You can complain to the Information Commissioner’s Office, the UK data protection regulator. We would welcome the chance to resolve your concern first.
Security and changes
We use access controls and service security measures to protect personal information. Please do not email full card details or passwords. We may update this notice as our services change; the date above identifies this version.