Last updated: 11 November 2025

 

This Privacy Notice explains how we collect, use, and protect your personal data when you visit our website, make a purchase, or contact us. We comply with the UK General Data Protection Regulation (UK GDPR), the Data Protection Act 2018, and PECR (for cookies and marketing).

 

 

1) Who we are (Data Controller)

 

Hurley Village Shop and Cafe (“we”, “us”, “our”) is the data controller for information processed via our website and in connection with our services.

Contact: shop@hurleyshop.co.uk • High Street, Hurley, Sl6 5NB

 

If you have questions about this notice or your data, please contact us using the details above.

 

 

2) The data we collect

 

• Identity & contact data: name, email, phone number, billing/delivery address.

• Order & account data: items purchased, booking details, transaction history.

• Payment data: processed securely by our payment providers (we do not store full card details).

• Technical data: IP address, device/browser type, approximate location, and cookies.

• Marketing preferences: your choices for email or other marketing communications.

 

 

3) How we collect data

 

• Directly from you: when you place an order, make a booking, create an account, subscribe to updates, or contact us.

• Automatically: via cookies and similar technologies when you browse our site.

• From third parties: payment providers and analytics/anti-fraud tools (where used).

 

 

4) Why we use your data (lawful bases)

 

• To provide our services and fulfil orders/bookings (performance of a contract).

• To respond to enquiries and provide customer support (legitimate interests / contract).

• To take payment and prevent fraud (legitimate interests / legal obligation).

• To send service messages such as order confirmations or policy changes (legal obligation / contract).

• To send marketing you’ve asked for or that we think is relevant to you (consent or legitimate interests — you can opt out anytime).

• To improve our website and offerings using aggregated analytics (legitimate interests).

• To meet legal and tax requirements (legal obligation).

 

 

5) Cookies and analytics

 

We use:

 

• Essential cookies to make the site work (e.g., basket, security, login).

• Optional cookies for analytics and performance (only if you consent).

 

You can manage cookies via our banner and your browser settings at any time. For detailed information, see our Cookie Notice [link to your cookie policy].

 

 

6) Sharing your data

 

We share personal data only with trusted service providers, for example:

 

• Website hosting/platform providers

• Payment processors (e.g., your chosen provider such as PayPal/Stripe/Wix Payments)

• Email/communication tools (for order updates and marketing, where used)

• IT/security and analytics providers

 

These suppliers process data under written contracts and only according to our instructions. We do not sell your personal data.

 

 

7) International transfers

 

Some providers may process data outside the UK/EEA. Where this happens, we rely on appropriate safeguards (e.g., UK Addendum to the EU Standard Contractual Clauses, or an adequacy decision) to protect your information.

 

 

8) Data retention

 

We keep your data only as long as necessary for the purposes above:

 

• Orders/bookings and related records: generally up to 6 years to meet tax and accounting obligations.

• Accounts and preferences: until you ask us to delete or after a reasonable period of inactivity.

• Marketing data: until you unsubscribe or withdraw consent.

  When data is no longer needed, we securely delete or anonymise it.

 

 

9) Your rights

 

Under UK GDPR you have the right to:

 

• Access your data and obtain a copy

• Rectify inaccurate or incomplete data

• Erase your data (where applicable)

• Restrict or object to certain processing, including direct marketing

• Data portability (for information you provided to us)

• Withdraw consent at any time where processing is based on consent

 

To exercise your rights, contact us using the details in section 1.

 

 

10) Marketing preferences

 

You can opt out of marketing emails at any time by clicking “unsubscribe” in our emails or contacting us. Service emails about orders or bookings will still be sent.

 

 

11) Security

 

We apply technical and organisational measures to keep your data secure, including encryption in transit, access controls, and staff awareness. No method is 100% secure, but we work to protect your information and review measures regularly.

 

 

12) Complaints

 

If you’re unhappy with how we handle your data, please contact us first so we can put things right. You also have the right to complain to the Information Commissioner’s Office (ICO) at www.ico.org.uk or by calling 0303 123 1113.

 

 

13) Changes to this notice

 

We may update this notice from time to time. The latest version will always be posted on our website with the “last updated” date above.