Privacy, without the mystery.

Who is responsible

RED HILL COFFEE LTD, company number 15396013, of 35 Furzeland Drive, Bryncoch, Neath SA10 7UG, trading as Red Hill Coffee, is responsible for deciding how customer information is used for this shop. Square hosts the secure checkout and processes order and payment information in accordance with its own buyer privacy notice and its agreement with us. Cloudflare helps deliver and protect this website.

What we collect

• This site keeps your bag on your device using local browser storage. When you start Square Checkout, it also keeps an encrypted order-checking reference on that device so the return page can confirm payment before clearing the bag. The reference can be used for up to 24 hours and is removed after successful verification, when you change or start another checkout, or when you clear this site's browser data.
• Our checkout endpoint accepts only product, size, colour and quantity selections. It rejects names, email addresses, postal addresses and other customer details.
• Square collects the contact and payment details needed to complete an order. For made-to-order clothing, this includes the recipient's name, phone number and delivery address. Card numbers and security codes do not pass through or remain on this website.
• Hosting and security systems may process technical information such as IP address, browser information, request time and security events.
• If you contact us, we use the information in your message to respond and resolve your request.

Why we use it

• To take payment, arrange production and delivery, prepare collection orders, and handle returns under our contract with you.
• To meet legal duties, including tax, accounting, fraud-prevention and consumer-protection requirements.
• For our legitimate interests in securing the site, preventing abuse and improving customer service, where those interests do not override your rights.
• For email marketing only when you have made a separate, affirmative choice to receive it. An order email address is not automatically a marketing opt-in.

Who receives it

We share only what is necessary with Square, our website hosting and security provider, professional advisers, and public authorities where the law requires it. For made-to-order clothing, Red Hill staff enter the recipient name, delivery address and phone number into Amazon so our production partner can make and dispatch the selected garment. Amazon does not receive the customer's Square card details from us. We do not sell customer information. Where a provider processes information outside the UK, we require an applicable lawful transfer mechanism and safeguards.

How long we keep it

Order and accounting records are retained for the period required by applicable tax, accounting and consumer law. Customer-service correspondence is kept only while it is needed to resolve the matter and meet legal obligations. Security records are kept for a limited period proportionate to detecting and investigating misuse. Your local bag stays on your device until you clear it or clear the site’s browser data. An expired encrypted order-checking reference may remain in browser storage until one of the removal events described above, but it can no longer be used to confirm an order after 24 hours.

We review retained information and delete or anonymise it when it is no longer needed, unless the law requires us to keep it.

Your choices and rights

Depending on the circumstances, you may ask for access to or correction of your information, deletion, restriction, portability, or object to certain uses. You can withdraw marketing consent at any time without affecting earlier lawful use. Some order and payment records cannot be deleted immediately where we must retain them by law.

Please contact us first so we can help. You also have the right to complain to the UK Information Commissioner’s Office at ico.org.uk.

Cookies and changes

The current shop does not use non-essential advertising cookies. If analytics, advertising or other non-essential tracking is introduced, we will update this notice and request consent where required. We may update this notice when our services or legal obligations change; the date above will show the latest version.