This Privacy Policy explains how beantocupofficecoffeemachines.co.uk handles personal information, including information provided through enquiries and newsletter subscriptions. This is a draft for legal review only: it must not be published until the site owner has confirmed the actual processing activities, completed the marked details and obtained legal approval.
Who is responsible for your information?
The data controller is the person or organisation that decides why and how your personal information is used.
[CHECK: data controller details supplied by the site, including full legal name, trading name where relevant, postal address and privacy contact email. Confirm whether a data protection officer or UK representative is required and add their contact details if applicable.]
In this policy, “we”, “us” and “our” mean that controller.
Information collected and why it is used
The following is a proposed processing schedule, not a verified description of the site’s systems.
[CHECK: the site owner must confirm each activity against the website, hosting configuration, forms, email systems and supplier contracts. Remove unused activities and add any missing processing before publication.]
| Activity | Information involved | Purpose and proposed UK GDPR lawful basis |
|---|---|---|
| Answering enquiries | Name, email address, message and any information voluntarily supplied | Responding and keeping relevant correspondence: legitimate interests in managing enquiries, subject to a documented assessment |
| Operating and protecting the website | IP address, request times, browser information and security logs | Delivering the website and preventing abuse: legitimate interests in reliable, secure operation, subject to assessment |
| Sending a subscribed newsletter | Email address, optional name, subscription preferences and consent records | Sending the requested newsletter: consent |
| Recording privacy choices | Cookie preferences, consent records and newsletter objections | Recording choices and demonstrating compliance: identify the applicable legal obligation or assessed legitimate interest for each record |
| Measuring website use | Information collected by any analytics tools actually enabled | Understanding use of the site: confirm the lawful basis after checking the tool, configuration and applicable PECR requirements |
[CHECK: confirm whether comments, accounts, advertising, affiliate tracking, embedded media, supplier referrals, profiling or information obtained from third parties are involved. Describe any that apply, including their sources and purposes.]
[CHECK: identify which form fields are optional or required, whether providing any information is a statutory or contractual requirement, and what happens if it is not provided.]
The legal framework
Personal information is governed by the UK GDPR and the Data Protection Act 2018, as amended, including by the Data (Use and Access) Act 2025.
A UK GDPR lawful basis explains why personal information may be processed. The Privacy and Electronic Communications Regulations 2003, known as PECR, impose separate requirements for electronic marketing and storing or accessing information on a device. Relying on legitimate interests under the UK GDPR does not remove a PECR consent requirement.
Newsletter subscriptions
The proposed newsletter arrangement is an opt-in subscription based on consent. You can withdraw that consent at any time using the unsubscribe facility in a newsletter or by contacting the privacy contact above. Withdrawal does not affect the lawfulness of processing before consent was withdrawn.
[CHECK: confirm that the subscription form, consent wording, consent records and working unsubscribe facility support this arrangement. Identify the newsletter provider and disclose any open tracking, click tracking or tracking pixels separately, including the applicable permissions.]
After unsubscribing, a limited suppression record may be needed to prevent further marketing. It must not be used to continue sending promotional messages.
[CHECK: confirm the suppression process, its lawful basis and retention criteria.]
Cookies and similar technologies
Cookies and similar technologies can store information on, or access information from, your device. PECR generally requires consent unless a specific exception applies. Some exceptions have conditions, including providing information and a simple way to object; analytics tools are not automatically exempt.
[CHECK: the site owner must supply the live cookie policy URL and insert a working cookie policy link here. The linked policy must identify the technologies actually used, their providers, purposes, durations and available controls.]
[CHECK: confirm that the site’s consent and objection controls work as described, including for third-party embeds and newsletter tracking where relevant.]
Service providers and international transfers
[CHECK: list the actual hosting, email, newsletter, security, analytics and other providers receiving personal information. Explain what each receives and why, and distinguish processors acting on our instructions from independent or joint controllers.]
[CHECK: confirm processor contracts and relevant subprocessors. Do not state that information is never sold, shared or used for advertising unless the actual arrangements support that statement.]
[CHECK: establish whether personal information is transferred outside the UK, including through overseas support access. Where relevant, identify destinations, applicable UK adequacy regulations or other transfer safeguards, and how readers can obtain information about or a copy of those safeguards. Confirm any required transfer assessment.]
How long information is kept
The proposed retention criteria are:
- Enquiries: until the matter and necessary follow-up are complete, with longer retention only for an identified legal or dispute-related need.
- Newsletter records: while the subscription remains active, with consent evidence retained for a justified compliance period.
- Suppression records: for as long as needed to honour the objection and prevent unintended re-subscription through future imports.
- Security logs: for a defined period justified by security monitoring and incident investigation.
- Cookie records and backups: according to verified technology durations and documented deletion or backup rotation schedules.
[CHECK: approve these criteria and insert the actual periods where established. Confirm deletion from providers, archives and backups. Replace vague or unsupported retention arrangements before publication.]
Your rights
Depending on the circumstances, you can ask to access your personal information, correct inaccuracies, have information erased, restrict its use or receive eligible information in a portable format. These rights have conditions and exemptions.
You can object to processing based on legitimate interests. You have an absolute right to object to the use of your personal information for direct marketing. Where processing relies on consent, you can withdraw it at any time.
Contact the privacy contact above to exercise your rights. The usual response period is one month, subject to applicable rules on identity verification, clarification and extensions.
[CHECK: confirm whether any solely automated decisions with legal or similarly significant effects occur. If they do, explain the processing and applicable safeguards; otherwise insert a verified statement that they do not.]
Questions and complaints
You can raise a privacy question or complaint using the controller’s contact details above. We will acknowledge a data protection complaint within 30 days, investigate without undue delay, keep you informed and communicate the outcome.
You also have the right to complain to the UK’s data protection regulator, the ICO. Its website provides guidance and the complaint route: complain to the ICO.
[CHECK: confirm the responsible complaint handler and a functioning complaints process before publication.]
Changes to this policy
The final policy should be reviewed whenever processing changes and at least annually. Any new purpose must be assessed and the relevant privacy information updated before that processing begins.
[CHECK: insert the approved effective date after legal review. A research date is not an approval or publication date.]
Sources
- ICO, “What privacy information should we provide?”, current guidance retrieved November 2026. Covers controller details, purposes, lawful bases, recipients, retention and required privacy information. The page carries a notice that it is under review following the 2025 Act. Source
- Department for Science, Innovation and Technology, “Data (Use and Access) Act 2025: data protection and privacy changes”, 2025. Explains that the Act amends rather than replaces the existing framework. Source
- Department for Science, Innovation and Technology, “Data Use and Access Act 2025: plans for commencement”, updated October 2026. Provides the staged commencement position, including later regulator reforms. Source
- ICO, “Guidance on direct marketing using electronic mail”, updated April 2026. Covers consent, withdrawal, suppression and the relationship between PECR and data protection law. Source
- ICO, “What are the exceptions?”, current storage and access technologies guidance, 2026. Explains the conditional PECR exceptions. Source
- ICO, “A brief guide to international transfers”, 2026. Covers adequacy, safeguards, transfer assessments and exceptions. Source
- ICO, “Your data protection rights”, current guidance retrieved November 2026. Summarises individual rights, their conditions and the usual response period. Source
- ICO, “How to deal with data protection complaints”, updated May 2026. Explains complaint handling, acknowledgement and communication requirements. Source
This draft was researched using official government and ICO material; the site’s actual processing, supplier contracts and technical configuration have not been examined and require owner confirmation and legal review.
Last checked: November 2026