Islay Coffee Roasters

Privacy

Privacy Policy

Last updated: 4 October 2026

Islay Coffee Roasters respects your privacy and is committed to protecting your personal information.

This Privacy Policy explains what personal information we collect, why we collect it, how we use and protect it, who we may share it with, how long we retain it, and the rights you have in relation to your information.

1. Who we are

Islay Coffee Roasters is [full registered company name], registered in Scotland under company number [company number], with its registered office at [registered address].

For data protection purposes, Islay Coffee Roasters is the data controller responsible for the personal information described in this policy.

If you have questions about this policy or about how we use your personal information, you can contact us at:

Email: [privacy/contact email]
Postal address: [postal address]

2. Information we collect

The personal information we collect depends on how you interact with us.

It may include:

  • your name;
  • email address and telephone number;
  • billing and delivery addresses;
  • information about orders, purchases, returns and refunds;
  • information about your customer or wholesale account;
  • communications you have with us;
  • marketing preferences and records of any consent you give or withdraw;
  • technical information associated with use of our website, such as IP address, browser and device information, where this is collected;
  • information needed to prevent fraud, protect our systems or resolve payment and order problems; and
  • other information you choose to provide to us.

When you make a card or other electronic payment, payment information is processed by our payment provider, Stripe. We do not need to receive or store your complete payment card details.

3. How we collect your information

We generally collect personal information directly from you when you:

  • register for news or updates;
  • place an order;
  • create or use a customer or wholesale account;
  • contact us;
  • subscribe to a service or regular order;
  • respond to a communication from us; or
  • otherwise provide information through our website.

We may also receive information from service providers involved in completing a transaction or providing our services, such as our payment and delivery providers.

Where we receive personal information from another source, we will use it only where we have a lawful basis for doing so.

4. Why we use your information

Providing products and services

We use the information needed to:

  • process and fulfil orders;
  • take and reconcile payments;
  • arrange delivery;
  • manage customer and wholesale accounts;
  • administer subscriptions or regular orders where these are offered;
  • process cancellations, refunds and returns;
  • provide customer service; and
  • communicate with you about an order, account or service.

We generally process this information because it is necessary to enter into or perform a contract with you.

Registration and launch updates

If you register to hear about Islay Coffee Roasters, product availability, launches or similar updates, we use the information you provide for the purposes described when you register.

Where we ask for your consent, you can withdraw that consent at any time.

Marketing

Where permitted, we may send you information about Islay Coffee Roasters, our coffee, products, events, offers or other news that we think may interest you.

We will use consent where consent is required by law.

Where the law permits us to contact an existing customer without obtaining separate consent, we may do so in accordance with the applicable electronic marketing rules. You can object to or opt out of direct marketing at any time.

Every marketing email we send will provide a straightforward way to unsubscribe.

Operating and protecting our business

We may process personal information where necessary for our legitimate interests, including:

  • maintaining and securing our website and systems;
  • detecting or preventing fraud and misuse;
  • maintaining appropriate business and transaction records;
  • understanding and improving our services;
  • responding to enquiries and complaints; and
  • establishing, exercising or defending legal claims.

Where we rely on legitimate interests, we consider those interests against your rights and interests before processing your information.

Legal and regulatory obligations

We may process and retain information where necessary to comply with legal obligations, including accounting, taxation, company, consumer protection and other regulatory requirements.

5. Payment information

Online payments are processed using Stripe.

Stripe processes payment information in accordance with its own privacy and security arrangements. Islay Coffee Roasters receives the information necessary to identify and manage your payment, such as the payment status, amount, transaction identifiers and limited payment-method information.

We do not store your complete payment card number or card security code in our systems.

6. Email and communications

We use third-party services to operate our email and website communications.

These may include:

  • Fastmail for ordinary business email; and
  • Mailgun for transactional emails and, where applicable, marketing communications.

Information such as your name, email address, message content and delivery information may therefore be processed through these services where necessary to communicate with you.

We limit the information supplied to service providers to what is reasonably required for the service they provide.

7. Hosting and website services

Our website and business systems are operated using WholeSpace and hosting infrastructure administered on our behalf by Aptigence.

Our hosting, software, email, payment and other technology providers may process personal information on our behalf where this is necessary to provide their services.

Where another organisation processes personal information on our behalf, we require appropriate data protection and security arrangements.

8. Sharing your information

We do not sell your personal information.

We may share personal information where reasonably necessary with organisations such as:

  • payment providers;
  • website and hosting providers;
  • email and communications providers;
  • delivery, postal and fulfilment providers;
  • professional advisers, accountants and insurers;
  • technology and security providers;
  • government, regulatory or law-enforcement bodies where required by law; and
  • other organisations where necessary to establish, exercise or defend legal rights.

We provide only the information reasonably necessary for the relevant purpose.

9. International transfers

Some of the service providers we use may process or store personal information outside the United Kingdom or European Economic Area.

Where personal information is transferred internationally, we take appropriate steps to ensure that the transfer complies with applicable data protection law.

Depending on the destination and provider, this may include relying on:

  • a UK or European adequacy decision or regulation;
  • approved contractual safeguards, such as standard contractual clauses or the UK International Data Transfer Agreement or Addendum; or
  • another lawful transfer mechanism.

You may contact us if you would like further information about the safeguards applying to a particular international transfer.

10. How long we keep information

We keep personal information only for as long as it is reasonably required for the purpose for which it was collected, including to meet legal, accounting, taxation and regulatory requirements.

Different information is therefore retained for different periods.

For example:

  • order, payment and accounting records may be retained for the period required by applicable financial and tax laws;
  • customer account information may be retained while the account remains active and for an appropriate period afterwards;
  • enquiries and correspondence may be retained for as long as reasonably necessary to deal with the matter and maintain an appropriate business record;
  • marketing information is retained while we have an appropriate basis to contact you; and
  • records of consent, withdrawal of consent and marketing suppression may be retained where necessary to demonstrate your preferences and ensure that we respect them.

When information is no longer required, we will delete or anonymise it where reasonably practicable.

11. Marketing choices

You can ask us to stop using your personal information for direct marketing at any time.

You can do this by:

  • using the unsubscribe facility included in our marketing emails; or
  • contacting us using the details in this policy.

Withdrawing marketing consent or unsubscribing from marketing does not prevent us from sending communications that are necessary to fulfil an order, administer an account, provide a service you have requested or meet a legal obligation.

We may retain a minimal suppression record after you unsubscribe so that we can ensure that your marketing preference continues to be respected.

12. Cookies and similar technologies

Our website may use cookies and similar technologies.

Some are strictly necessary for the website to operate, provide security, maintain a shopping cart, remember privacy choices or provide a service you request.

Where we use non-essential cookies or similar technologies — for example for analytics, advertising or other optional purposes — we will provide information about their use and obtain consent where required before they are activated.

Where applicable, you can change or withdraw your cookie choices through the website's cookie controls.

Further details about the technologies actually in use may be provided in our Cookie Policy or cookie settings.

13. Security

We use appropriate technical and organisational measures designed to protect personal information against unauthorised access, alteration, disclosure, loss or destruction.

These measures include appropriate access controls, secure communications, system maintenance and security practices appropriate to the nature of the information being processed.

No internet-based system can be guaranteed to be completely secure, but we take reasonable measures to protect the information entrusted to us.

14. Your data protection rights

Depending on the circumstances and applicable law, you may have the right to:

  • access the personal information we hold about you;
  • correct information that is inaccurate or incomplete;
  • ask us to erase your personal information;
  • ask us to restrict how your information is processed;
  • object to certain processing;
  • receive certain information in a portable format and have it transferred to another organisation;
  • withdraw consent at any time where processing is based on your consent; and
  • complain to a data protection supervisory authority.

These rights are subject to circumstances and exemptions provided by law, so they do not apply in exactly the same way to every type of processing.

Your right to object

You have the right to object at any time to our use of your personal information for direct marketing. If you object, we will stop using your information for that purpose.

Where we rely on legitimate interests for other processing, you may also have a right to object because of your particular circumstances.

To exercise any of your rights, contact us using the details in section 1.

We may need to verify your identity before responding to a request.

15. Complaints

If you have a concern about how we use your personal information, we would appreciate the opportunity to address it first. Please contact us using the details in section 1.

You also have the right to complain to the Information Commissioner's Office (ICO), the UK's data protection regulator.

Information about making a complaint is available from the ICO.

If EU data protection law applies to you, you may also have the right to complain to the data protection supervisory authority in the EU country where you live or work, or where you believe an infringement occurred.

16. Automated decision-making

We do not currently use personal information to make decisions about individuals based solely on automated processing that produce legal or similarly significant effects.

If this changes, we will update this policy and provide the information required by applicable data protection law.

17. Children

Our products and website are intended for a general adult consumer audience and are not designed to collect personal information from children.

If we become aware that we have collected personal information from a child in circumstances where we should not have done so, we will take appropriate steps to delete it.

18. Changes to this policy

We may update this Privacy Policy when our business, website, services or legal obligations change.

The current version will be published on our website with the date on which it was last updated.

Where a change materially affects how we use personal information we have already collected, we will take appropriate steps to bring the change to the attention of affected individuals before beginning the new processing where required.

19. Contact us

Questions about this Privacy Policy or the way Islay Coffee Roasters handles personal information can be sent to:

Islay Coffee Roasters
[registered or correspondence address]
[privacy/contact email]