Last updated: 28 August 2026

Crosby Coffee Ltd (“Crosby Coffee”, “we”, “us” or “our”) respects your privacy and is committed to protecting your personal data.

This Privacy Policy explains how we collect and use personal data when you visit our website, purchase from us, use our Crosby Coffee app or loyalty programme, subscribe to our services or marketing, contact us, visit one of our locations, deal with us as a wholesale customer or supplier, or apply to work with us.

Crosby Coffee Ltd is the controller responsible for your personal data.

Crosby Coffee Ltd

Company number: 09069546

13 Glegg Street

Liverpool

L3 7DX

United Kingdom

For privacy-related enquiries, please contact info@crosbycoffee.live.

We have not appointed a statutory Data Protection Officer. Responsibility for data protection compliance sits with the Directors of Crosby Coffee Ltd.

1. The personal data we collect

The information we collect depends on how you interact with us.

Website and online store

When you visit our website or shop online, we may collect:

• 
  your name;
  
• 
  email address;
  
• 
  telephone number;
  
• 
  billing and delivery address;
  
• 
  account information;
  
• 
  order and purchase history;
  
• 
  subscription information;
  
• 
  correspondence with us;
  
• 
  IP address;
  
• 
  browser and device information;
  
• 
  website usage and interaction information;
  
• 
  cookie and similar technology information; and
  
• 
  marketing preferences.
  

Our ecommerce store is operated using Shopify.

Payment information is processed by specialist payment providers. Crosby Coffee does not store your full payment-card details.

Subscriptions and recurring payments

If you purchase or manage a coffee subscription, we may process your contact details, delivery information, subscription preferences, payment status and transaction history.

We use services including Recharge for subscription administration and GoCardless where direct-debit payments are used.

Crosby Coffee app and loyalty programme

If you create an account through the Crosby Coffee app or participate in our loyalty programme, we may collect:

• 
  your name;
  
• 
  email address;
  
• 
  telephone number;
  
• 
  date of birth, where you choose to provide it;
  
• 
  account information;
  
• 
  purchase and transaction history;
  
• 
  loyalty activity and points; and
  
• 
  marketing preferences.
  

Date of birth is optional.

The Crosby Coffee app uses Goodies technology integrated within our SumUp environment.

In-store purchases

When you make a purchase at one of our locations, payment and transaction information is processed through SumUp.

We do not store customers' full card details ourselves.

Marketing

If you choose to receive marketing from us, we may collect your:

• 
  name;
  
• 
  email address;
  
• 
  marketing preferences;
  
• 
  consent information;
  
• 
  interaction with our emails; and
  
• 
  relevant purchase or customer information used to tailor communications.
  

Our email marketing is principally managed through Klaviyo.

You may join our marketing list through our website, when making a purchase where you actively select the marketing option, or through our app.

We do not currently use SMS or WhatsApp for direct marketing.

Customer service and enquiries

If you contact us, including through our website contact forms, email, social media or directly at one of our locations, we may collect your contact details and the information contained within your enquiry.

Website enquiries are generally sent to info@crosbycoffee.live.

Wholesale customers and business contacts

If you deal with Crosby Coffee as a wholesale customer, prospective customer, supplier or other business contact, we may hold your:

• 
  name;
  
• 
  job title;
  
• 
  business email address;
  
• 
  telephone number;
  
• 
  business contact details; and
  
• 
  correspondence with us.
  

We may also hold transaction, order and account information relating to your organisation.

Job applicants

If you apply to work with Crosby Coffee, we may collect information including:

• 
  your name and contact details;
  
• 
  CV;
  
• 
  employment history;
  
• 
  qualifications;
  
• 
  application information;
  
• 
  interview notes; and
  
• 
  references where applicable.
  

Applications may be received directly by email, through social media or through recruitment services such as Indeed.

CCTV

We operate CCTV at our premises for the security and safety of our customers, employees, visitors, premises and property.

CCTV is currently operated at our Roastery, Waterloo, Lark Lane and Hightown locations. Our Southport location will also operate CCTV when it opens.

CCTV records video only. No audio is recorded.

Access to CCTV is restricted to authorised management personnel. CCTV footage is normally retained for approximately 30 days, unless footage needs to be retained for longer in connection with an incident, investigation, insurance matter or legal claim.

Accidents and incidents

If you are involved in an accident or other incident at one of our premises, we may record your name, contact details, details of the incident and relevant injury or health information.

Where this includes sensitive health information, we only process it where permitted by data protection law, including where necessary to comply with our legal obligations or establish, exercise or defend legal claims.

2. How we collect your personal data

We collect personal data:

• 
  directly from you when you purchase from us, create an account, subscribe, complete a form, contact us or apply for a job;
  
• 
  automatically when you use our website, subject to our use of cookies and similar technologies;
  
• 
  through our app, loyalty and payment systems;
  
• 
  from service providers involved in providing services to you;
  
• 
  from recruitment platforms such as Indeed where you use them to apply to us; and
  
• 
  through social-media platforms where you communicate with us through those services.
  

3. How and why we use your personal data

UK data protection law requires us to have a lawful basis for processing your personal data.

Depending on the circumstances, we rely on one or more of the following.

Contract

We process information where it is necessary to perform a contract with you or take steps at your request before entering into one.

This includes:

• 
  processing and delivering orders;
  
• 
  taking and administering payments;
  
• 
  operating subscriptions;
  
• 
  administering customer accounts;
  
• 
  operating the Crosby Coffee app and loyalty service;
  
• 
  dealing with refunds and customer-service matters; and
  
• 
  processing job applications where appropriate.
  

Legal obligations

We process certain information where necessary to comply with legal obligations, including:

• 
  accounting and taxation requirements;
  
• 
  employment and payroll obligations;
  
• 
  health and safety requirements;
  
• 
  fraud prevention and regulatory requirements; and
  
• 
  responding to lawful requests from authorities.
  

Legitimate interests

We process information where necessary for our legitimate business interests, provided those interests are not overridden by your rights and freedoms.

Our legitimate interests include:

• 
  operating and improving our business;
  
• 
  providing customer service;
  
• 
  managing relationships with wholesale customers and suppliers;
  
• 
  maintaining the security and integrity of our systems;
  
• 
  preventing and investigating fraud;
  
• 
  protecting our employees, customers, premises and property;
  
• 
  operating CCTV;
  
• 
  responding to complaints and disputes; and
  
• 
  understanding and improving the performance of our services.
  

Consent

Where required, we rely on your consent, particularly for:

• 
  email marketing; and
  
• 
  non-essential cookies and similar technologies used for analytics or advertising.
  

Where we rely on consent, you can withdraw it at any time.

4. Marketing

We will only send direct email marketing to you where we have an appropriate lawful basis to do so.

You can unsubscribe from our marketing emails at any time by using the unsubscribe link contained within the email.

Unsubscribing from marketing does not affect transactional emails that we may still need to send you in connection with an order, account or subscription.

We may retain limited information about people who have unsubscribed so that we can ensure their marketing preference continues to be respected.

5. Cookies and analytics

Our website uses cookies and similar technologies.

Some cookies are necessary for our website and online store to operate. Others may be used for analytics, functionality and advertising.

We use services including Google Analytics to understand how our website is used and to improve its performance.

Where consent is legally required for a cookie or similar technology, it should only be used after you have provided the relevant consent.

Further information is available in our separate Cookie Policy.

6. Who we share your personal data with

We only share personal data where necessary for the operation of our business, provision of our services, compliance with law or protection of our legitimate interests.

Our principal service providers include:

Shopify and Shopify Payments – our ecommerce store and online payment processing.

SumUp – in-store payments and our app and loyalty environment.

Goodies – the underlying technology used for the Crosby Coffee app.

Recharge – management of recurring subscriptions.

GoCardless – direct-debit payment processing.

Klaviyo – email marketing and marketing preferences.

Google Workspace – email and business document storage.

Google Analytics – website analytics.

Quirky Digital – our external SEO, ecommerce and analytics support provider. Their authorised access may include relevant information held within our Shopify environment where necessary to provide their services.

Xero – accounting and financial administration.

APC and Royal Mail – delivery and fulfilment of customer orders.

Indeed – recruitment where you apply through its platform.

We may also share relevant information with:

• 
  banks and other payment providers;
  
• 
  accountants, legal advisers, insurers and other professional advisers;
  
• 
  IT and technology providers;
  
• 
  law enforcement agencies, regulators or public authorities where legally required;
  
• 
  social-media and advertising platforms where applicable and subject to relevant consent requirements; and
  
• 
  other suppliers where necessary to provide the service you have requested.
  

Some of these organisations act as processors on our behalf. Others may act as independent controllers of the personal data they receive and will process it under their own privacy policies and legal obligations.

We do not sell your personal data.

7. Social media

If you communicate with us through social-media services such as Instagram, Facebook, TikTok, LinkedIn or X, both Crosby Coffee and the relevant platform may process information about your interaction.

The social-media provider processes information in accordance with its own privacy policy and terms.

8. How long we keep your personal data

We do not keep personal data indefinitely simply because it may be useful in the future.

Our principal retention periods include:

• 
  online orders and financial transaction records: generally 6 years;
  
• 
  customer account information: generally while the account is active and for up to 24 months after inactivity where it is no longer required for another purpose;
  
• 
  subscriptions: for the duration of the subscription and generally up to 24 months afterwards, with financial transaction records retained for 6 years where required;
  
• 
  app and loyalty accounts: while active and generally for up to 24 months after inactivity or closure;
  
• 
  email marketing information: until you withdraw consent or, ordinarily, after 24 months of inactivity;
  
• 
  customer enquiries: normally up to 2 years after the matter is closed, unless connected with an order, contract, complaint or dispute requiring longer retention;
  
• 
  wholesale contact information: normally for the duration of the relationship and for up to 2 years afterwards, with relevant contractual and accounting records retained for 6 years;
  
• 
  unsuccessful job applications: normally 6 months after the recruitment process has concluded;
  
• 
  website analytics information: generally up to 14 months where it remains identifiable or pseudonymous; and
  
• 
  ordinary CCTV footage: approximately 30 days.
  

We may retain information for longer where necessary because of a legal obligation, ongoing dispute, investigation, insurance matter or actual or potential legal claim.

When information is no longer required, we delete, destroy or anonymise it as appropriate.

9. International data transfers

Some of the technology and service providers we use operate internationally and may process personal data outside the United Kingdom.

Where personal data is transferred outside the UK, we take reasonable steps to ensure that an appropriate lawful transfer mechanism or safeguard is used.

Depending on the country and provider, this may include:

• 
  UK adequacy regulations;
  
• 
  approved contractual safeguards; or
  
• 
  other transfer mechanisms permitted under UK data protection law.
  

You can contact us if you would like further information about the safeguards applying to a particular service provider.

10. Security

We use reasonable technical and organisational measures designed to protect personal data against loss, misuse, unauthorised access, disclosure, alteration or destruction.

These measures include restricting access to personal data according to business need and using established third-party technology and payment providers.

No method of transmission or electronic storage is completely secure, but we take appropriate steps to protect the information under our control.

11. Automated processing and fraud prevention

Our ecommerce and payment providers may use automated tools to identify potentially fraudulent or suspicious transactions.

Crosby Coffee does not intentionally make decisions about individuals based solely on automated processing where the decision would produce legal effects or similarly significantly affect them.

12. Your data protection rights

Depending on how and why we use your personal data, you may have the right to:

• 
  ask us for a copy of the personal data we hold about you;
  
• 
  ask us to correct inaccurate or incomplete information;
  
• 
  ask us to delete your personal data in certain circumstances;
  
• 
  ask us to restrict the way we use your personal data;
  
• 
  object to certain uses of your personal data;
  
• 
  receive certain personal data in a portable format;
  
• 
  withdraw consent at any time where our processing is based on consent; and
  
• 
  complain about the way we use your personal data.
  

These rights are not absolute and some apply only in particular circumstances.

Your right to object

You have the right to object to our processing of your personal data where we rely on legitimate interests.

You also have an absolute right to object to your personal data being used for direct marketing.

If you unsubscribe from our direct marketing, we will stop using your information for that purpose.

To exercise any of your rights, contact us at info@crosbycoffee.live.

We may need to ask for information to confirm your identity before responding to a request.

13. Complaints

If you have a concern about how we use your personal data, please contact us first at info@crosbycoffee.live so that we can investigate.

You also have the right to complain to the Information Commissioner's Office (ICO), the UK's data protection regulator.

Further information about making a complaint is available on the ICO website.

14. Children

Our website, marketing activities and loyalty services are not intended to knowingly collect personal data from children for marketing purposes.

If you believe that a child has provided personal data to us in circumstances where it should not have been collected, please contact us so that we can investigate and, where appropriate, delete it.

15. Changes to this Privacy Policy

We may update this Privacy Policy from time to time to reflect changes to our business, systems, service providers or legal obligations.

The latest version will always be published on this page and the date at the top of the policy will show when it was last updated.

16. Contact us

For questions about this Privacy Policy, how we use your personal data or your data protection rights, please contact:

Crosby Coffee Ltd

13 Glegg Street

Liverpool

L3 7DX

United Kingdom

Email: info@crosbycoffee.live