Privacy, without the mystery.

Who is responsible

RED HILL COFFEE LTD, company number 15396013, of 35 Furzeland Drive, Bryncoch, Neath SA10 7UG, trading as Red Hill Coffee, is responsible for deciding how customer information is used for this shop. Square hosts the secure checkout and processes order and payment information in accordance with its own buyer privacy notice and its agreement with us. Cloudflare helps deliver and protect this website.

What we collect

• This site keeps your bag on your device using local browser storage. When you start Square Checkout, it also keeps an encrypted order-checking reference on that device so the return page can confirm payment before clearing the bag. The reference can be used for up to 24 hours and is removed after successful verification, when you change or start another checkout, or when you clear this site's browser data.
• Our checkout endpoint accepts only product, size, colour and quantity selections. It rejects names, email addresses, postal addresses and other customer details.
• Square collects the contact and payment details needed to complete an order. For delivered products, this includes the recipient's name, phone number and delivery address. Card numbers and security codes do not pass through or remain on this website.
• Hosting and security systems may process technical information such as IP address, browser information, request time and security events.
• If you contact us, we use the information in your message to respond and resolve your request. Our contact form collects your name, email, enquiry type and message. School Roadhouse enquiries also include your school, event outline and optional date. We keep a copy in our website database and use Brevo to notify our team by email. Submitting either form does not subscribe you to marketing. A day-specific derived network identifier helps limit repeated submissions.
• If you join our email list, we keep your email address together with the date, source and exact wording of your marketing choice. This record is held in the website's secure database and is available only to authorised Red Hill staff through Red Hill Ops.
• Where an existing Red Hill Rewards marketing choice is carried into our website, we retain the original source and consent evidence rather than treating membership of the rewards programme by itself as permission to email.

Your Hill and Red Hill Rewards

When you create a Your Hill account, we keep your email address, verification status, securely protected password and account records. Essential cookies keep you signed in. We use these details to provide your account, protect it and connect the correct Rewards card.

Loopy Loyalty runs our digital Rewards cards. To join, we send it your name, email, mobile number and date of birth. Your Hill keeps the card reference and the information needed to show your stamps, rewards and original joining date. We check your email before linking a card, and ask for help matching records where an email belongs to more than one card.

Email marketing is a separate choice. If you tick the email box, we record the wording, version and time of your choice and pass your email and first name to Brevo. You can unsubscribe through any marketing email. Unsubscribing does not cancel your Rewards card or Your Hill login. Account setup and password reset emails are sent only to help you use your account.

We keep account and Rewards information while needed to operate your membership and resolve queries. Contact us to correct details or close your account. We retain minimal consent and opt-out records where needed to honour your choices.

Why we use it

• To take payment, arrange production and delivery, prepare collection orders, and handle returns under our contract with you.
• To meet legal duties, including tax, accounting, fraud-prevention and consumer-protection requirements.
• For our legitimate interests in securing the site, preventing abuse and improving customer service, where those interests do not override your rights.
• For email marketing only when you have made a separate, affirmative choice to receive it. The email checkbox starts unticked, and an order email address is not automatically a marketing opt-in.

Who receives it

We share only what is necessary with Square, our website hosting and security provider, professional advisers, and public authorities where the law requires it. Red Hill uses the delivery details in Square to pack and dispatch stocked products. For made-to-order clothing, Red Hill staff enter the recipient name, delivery address and phone number into Amazon so our production partner can make and dispatch the selected garment. Amazon does not receive the customer's Square card details from us. Brevo receives the email address and information needed to send account emails and, when you opt in, Red Hill marketing emails and honour unsubscribes. We do not sell customer information. Where a provider processes information outside the UK, we require an applicable lawful transfer mechanism and safeguards.

How long we keep it

Order and accounting records are retained for the period required by applicable tax, accounting and consumer law. Customer-service correspondence is kept only while it is needed to resolve the matter and meet legal obligations. Security records are kept for a limited period proportionate to detecting and investigating misuse. Your local bag stays on your device until you clear it or clear the site’s browser data. An expired encrypted order-checking reference may remain in browser storage until one of the removal events described above, but it can no longer be used to confirm an order after 24 hours.

We review retained information and delete or anonymise it when it is no longer needed, unless the law requires us to keep it.

We keep a minimal suppression record after an unsubscribe, complaint or permanent delivery failure so that the address is not accidentally added back to marketing.

Your choices and rights

Depending on the circumstances, you may ask for access to or correction of your information, deletion, restriction, portability, or object to certain uses. Every marketing email will include an unsubscribe route, and you can withdraw marketing consent at any time without affecting earlier lawful use. Some order, payment and minimal suppression records cannot be deleted immediately where we must retain them by law or need them to honour your opt-out.

Please contact us first so we can help. You also have the right to complain to the UK Information Commissioner’s Office at ico.org.uk.

Cookies and changes

Essential cookies and browser storage support your bag, checkout and account. Optional Google Analytics loads only if you choose Allow analytics. It measures page visits, product views, checkout starts and confirmed purchases, including product details, order reference and value. Google receives technical browser and connection information when Analytics loads. We do not send names, email addresses, payment details, checkout tokens or URL query strings through our analytics events. Advertising storage and personalisation remain disabled. Your choice and Analytics cookies last up to six months. You can withdraw consent using Cookie settings at the bottom of every page; this stops future measurement and removes this site’s Analytics cookies. Square-confirmed purchase references are stored on your device after consent to avoid counting a purchase twice. Google Analytics is separate from essential order processing. See Google’s privacy policy for its processing of Analytics data.