Privacy Policy

Cafédirect Roastery Limited (“we”, “us” or “our”) is committed to protecting and respecting your privacy. We collect and process personal information when you shop with us or interact with us online at www.grumpymule.co.uk (“our site”).

We use this information to make your shopping experience as easy and enjoyable as possible. We need it to process your order, inform you of any delays or problems and occasionally to send you offers and promotions, subject to any preference that you may indicate when submitting your personal information.

This policy, together with our terms and conditions of supply, our terms of website use, and our cookie policy, sets out the basis on which any personal information we collect from you, or that you provide to us, will be processed by us. Please read it carefully to understand how we treat your personal information.

We process your personal information in accordance with UK data protection law, including the UK General Data Protection Regulation (UK GDPR) as amended by the Data (Use and Access) Act 2025, and the Data Protection Act 2018.

The data controller is Cafédirect PLC (Cafédirect Roastery Limited is a wholly owned subsidiary of Cafédirect PLC), whose registered address is 115 George Street, Edinburgh, Scotland, EH2 4JN, correspondence address: The Roastery, Bent Ley Industrial Estate, Bent Ley Road, Meltham, Huddersfield, HD9 4EP. If you have any questions about this policy or about how we handle your personal information, please contact us at privacy@cafedirect.co.uk.

Information we may collect from you

We may collect and process the following information about you:

When you order or enquire about our products we will need your name, postal address, delivery address, email address and telephone number. Payment is processed securely by Shopify Payments; we do not collect or store your full payment card details. If you order products for a third party we will need their delivery address.
Information that you provide by filling in forms on our site www.grumpymule.co.uk (our site). This includes information provided at the time of registering to use our site, subscribing to our service, posting material or requesting further services. We may also ask you for information when you enter a competition or promotion sponsored by Cafedirect Plc, and when you report a problem with our site.
If you contact us, we may keep a record of that correspondence.
We may also ask you to complete surveys that we use for research purposes, although you do not have to respond to them.
Details of transactions you carry out through our site and of the fulfilment of your orders.
Details of your visits to our site including, but not limited to, traffic data, location data, weblogs and other communication data, whether this is required for our own billing purposes or otherwise and the resources that you access.

The lawful bases we rely on

We only use your personal information where the law allows us to. Depending on the activity, we rely on one or more of the following lawful bases:

Performance of a contract — to process and fulfil your orders, manage your subscription, take payment, and provide customer service.
Legal obligation — to keep records we are required by law to hold, such as tax and accounting records.
Consent — for certain marketing communications, for non-essential cookies, and for sharing data with advertising platforms to show you relevant ads. You can withdraw your consent at any time.
Legitimate interests — to operate, secure and improve our site, understand how it is used, prevent fraud, and market similar products to our existing customers. Where we rely on legitimate interests, we balance them against your rights and freedoms.

Cookies and similar technologies

When you visit our site, we and our partners use cookies and similar technologies to make the site work, remember your preferences, measure how the site is used, and deliver advertising that is relevant to you. Some of these technologies collect information such as your IP address, device and browser type, and the pages you visit.

We use cookies and similar technologies for the following purposes:

Strictly necessary — to run the site and enable core functions such as checkout and account login. These do not require your consent.
Performance and analytics — to understand how visitors use the site so that we can improve it.
Functionality — to remember your preferences and personalise your experience.
Advertising — to measure our advertising and show you relevant ads on other sites and platforms.

We manage cookies through our consent tool, Cookiebot. When you first visit the site you can accept or reject non-essential cookies, and you can change your choice at any time using the cookie settings on our site. In line with current UK rules, certain low-risk analytics and functional technologies may be used without prior consent, but we still tell you about them and you can object. Full details of the cookies we use are set out in our cookie declaration.

Please note that any businesses or companies websites that we may provide links to on our site may also use cookies, over which we have no control.

Advertising and marketing

Email and SMS marketing. If you are an existing customer, we may send you marketing about similar products unless you tell us not to. Otherwise, we send marketing only where you have consented. You can opt out at any time using the unsubscribe link in any message or by contacting us. Our email and SMS marketing is managed using Klaviyo.

Online advertising and measurement. We work with Google and Meta (Facebook and Instagram) to measure the performance of our advertising and to show relevant ads to people who have shown an interest in our products. This involves:

Advertising cookies and tags (such as the Google Ads tag and the Meta Pixel) which, with your consent, allow us to show you ads after you have visited our site (remarketing).
Sharing certain data — including hashed identifiers such as your email address or telephone number — with Google and Meta so that we can measure conversions and build and target advertising audiences. On Google this uses Customer Match and Enhanced Conversions; on Meta it uses Custom Audiences and the Conversions API. Some of this sharing happens server-side and is enabled by our analytics provider, Littledata.

When we share hashed identifiers with Google and Meta in this way, they act as independent or joint controllers and also process the data under their own terms. We rely on your consent for this advertising-related sharing, and you can withdraw it at any time through our cookie settings. For more information on how these platforms use data, please see Google’s and Meta’s own privacy notices.

Storing and transferring your information

Some of the service providers we use are based outside the United Kingdom, including in the United States. Where your personal information is transferred outside the UK, we make sure it is protected by appropriate safeguards, such as the UK Extension to the EU–US Data Privacy Framework (the “UK–US Data Bridge”), the UK’s International Data Transfer Agreement, or standard contractual clauses.

All information you provide to us is stored on our secure servers. Any payment transactions will be encrypted using SSL technology. Where we have given you (or where you have chosen) a password which enables you to access certain parts of our site, you are responsible for keeping this password confidential. We ask you not to share a password with anyone.

Unfortunately, the transmission of information via the internet is not completely secure. Although we will do our best to protect your personal information, we cannot guarantee the security of your information transmitted to our site; any transmission is at your own risk. Once we have received your information, we will use strict procedures and security features to try to prevent unauthorised access.

How long we keep your information

We keep your personal information only for as long as we need it for the purposes set out in this policy, including to meet any legal, accounting or reporting requirements. The table below sets out our retention periods. Where a period is still being confirmed, it is marked “to be confirmed”.

Type of personal information	How long we keep it
Order, transaction and payment records	6 years after the transaction, to meet tax and accounting requirements.
Customer account information	Kept for 6 years after your last order, in line with the transaction records above, then deleted or anonymised.
Subscription records	For the duration of your subscription. After cancellation, the associated transaction records are kept for 6 years (as above), then deleted or anonymised.
Email and SMS marketing data and consent records	For as long as you are subscribed. We suppress contacts from active marketing after around 24 months of no engagement (to be confirmed).
Customer service correspondence	For as long as we need it to handle your query and any related follow-up.
Website analytics data	14 months.
Advertising audience data	As set by the platform — up to 180 days, or up to around 2 years for purchase-based audiences.
Cookies	As set out in our cookie declaration.

When we no longer need your personal information, we securely delete or anonymise it.

Uses made of the information

We use information held about you in the following ways:

To ensure that content from our site is presented in the most effective manner for you and for your computer.
To provide you with information, products or services that you request from us or which we feel may interest you, where you have consented to be contacted for such purposes.
To carry out our obligations arising from any contracts entered into between you and us.
To allow you to participate in interactive features of our service, when you choose to do so.
To notify you about changes to our service.
To help maintain the quality of our goods and services we may also use your information to contact you to request feedback on the products you have ordered and the service you have received.

If you are an existing customer, we will only contact you by electronic means (e-mail or SMS) with information about goods and services similar to those which were the subject of a previous sale to you.

If you are a new customer, we will contact you by electronic means only if you have consented to this.

Disclosure of your information

We share your personal information with trusted service providers who process it on our behalf, and with other third parties where necessary. Our main service providers are:

Shopify — our e-commerce platform, and Shopify Payments, which processes payments;
Recharge — subscription management;
Klaviyo — email and SMS marketing;
Littledata — website analytics and server-side tracking;
Google and Meta — analytics and advertising;
Judge.me — product reviews;
Cookiebot — cookie consent management;
Royal Mail — order fulfilment and delivery;
our paid media agency, which manages our advertising campaigns on our behalf.

We may also disclose your personal information in the following circumstances:

We may disclose your personal information to any member of our group, which means our subsidiaries, our ultimate holding company and its subsidiaries, as defined in the UK Companies Act 2006.

We may disclose your personal information to third parties:

In the unlikely event that we sell or buy any business or assets, in which case we may disclose your personal information to the prospective seller or buyer of such business or assets.
In the unlikely event that Cafedirect Plc or substantially all of its assets are acquired by a third party, in which case personal information held by it about its customers will be one of the transferred assets.
If we are under a duty to disclose or share your personal information in order to comply with any legal obligation, or in order to enforce or apply our terms of website use or terms and conditions of supply and other agreements; or to protect the rights, property, or safety of Cafedirect Plc, our customers, or others. This includes exchanging information with other companies and organisations for the purposes of fraud protection and credit risk reduction.

Your rights

Under UK data protection law you have the following rights in relation to your personal information:

the right to be informed about how we use your information;
the right to access the personal information we hold about you;
the right to have inaccurate information corrected;
the right to have your information erased in certain circumstances;
the right to restrict or object to our processing in certain circumstances, including objecting to direct marketing at any time;
the right to data portability;
the right to withdraw your consent at any time where we rely on consent;
the right not to be subject to a decision based solely on automated processing where it produces legal or similarly significant effects; and
the right to complain to us and to the Information Commissioner’s Office (see below).

To exercise any of these rights, please contact us at privacy@cafedirect.co.uk. We will respond within one month. There is normally no charge, although we may charge a reasonable fee or refuse to act on a request that is manifestly unfounded or excessive. We may need to verify your identity before we act.

Our site may, from time to time, contain links to and from the websites of our partner networks, advertisers and affiliates. If you follow a link to any of these websites, please note that these websites have their own privacy policies and that we do not accept any responsibility or liability for these policies. Please check these policies before you submit any personal information to these websites.

Data protection complaints

If you have a complaint about how we handle your personal information, please contact us at privacy@cafedirect.co.uk. We will acknowledge your complaint promptly, investigate it, and keep you informed of the outcome. If you are not satisfied with our response, you have the right to complain to the Information Commissioner’s Office (ICO), the UK supervisory authority for data protection, at ico.org.uk. We would, however, appreciate the chance to address your concerns first.

Changes to our privacy policy

Any changes we may make to our privacy policy in the future will be posted on these pages. You are expected to check these pages from time to time to take notice of any changes we made, as they are binding on you. Some of the provisions contained in our privacy policy may also be superseded by provisions or notices published elsewhere on our site.

Law and jurisdiction

This agreement and any dispute arising out of it will be governed by English Law. Any dispute or claim arising out of or in connection with this agreement or its formation (including non-contractual disputes or claims) shall be subject to the exclusive jurisdiction of the courts of England and Wales.

Contact

Questions, comments and requests regarding this privacy policy are welcomed and should be addressed to Cafédirect Roastery Limited, The Roastery, Bent Ley Industrial Estate, Bent Ley Road, Meltham, Huddersfield, HD9 4EP or privacy@cafedirect.co.uk.