Data Policies

Privacy Policy (effective 25/05/2018)

We are committed to protecting and respecting your privacy.

Everyone has rights with regard to the way in which their personal data is handled. During the course of our activities we will collect, store and process personal data about our customers, suppliers and other third parties, and we recognise that the correct and lawful treatment of this data will maintain confidence in the organisation and will provide for successful business operations.

This policy sets out the basis on which any personal data we collect from you, or that you provide to us, will be processed by us. Please read the following carefully to understand our views and practices regarding your personal data and how we will treat it.

For the purpose of UK data protection laws, the data controller is The Depot Cafe (here-in: The Depot Cafe) of Unit 11a, Steventon Storage Depot, Abingdon, OX13 6DJU.

Data protection principles

When processing your information, we must comply with the six enforceable principles of good practice. These provide that your personal data must be:

• processed lawfully, fairly and in a transparent manner,
• processed for specified, explicit and legitimate purposes,
• adequate, relevant and limited to what is necessary,
• accurate and kept up-to-date,
• kept for no longer than is necessary, and
• processed in a manner than ensures appropriate security.

Information you give to us

You may give us information (such as your names, address, email address, phone number and other information, and financial and credit card information) by:

• filling in forms on our website,
• giving a third-party permission to share it with us,
• corresponding with us by phone, email, letters or otherwise.

We may use the information you give to us for a number of different purposes. For each purpose, we are required to confirm the 'legal basis' that allows us to use your information, as follows:

Purposes for which we will use the information you give to us	Legal basis
Provide the services to you under the terms of any contract entered into	It will be necessary for the performance of the contract between you and us.
Managing and performing contracts with third party contractors in order to provide you with the services.	It will be necessary for the performance of the contract between those parties and us.
Marketing and related communications.	It will be necessary for our legitimate business interests, namely to promote and advertise our business.
Pass relevant information to our licensees or other third-parties in order to provide you with additional services and marketing.	We will only do this if you give us your consent by some specific, informed and unambiguous method.

It is also a contractual requirement for you to provide us with certain information as prescribed by law. If you do not provide us with that information, we will not be able to provide you with the services.

All other information you give us is given entirely as your discretion. If you do not provide that information, then we may not be able to provide you with additional offers and services.

Information we collect about you from other sources

When you visit our website, we may collect information about you (such as the Internet protocol (IP) address used to connect your computer to the Internet, your login information, browser type and version, time zone setting, browser plug-in types and versions, Internet Service Provider (ISP) Information, GPS and location information, operating system and platform information, the unique device identifier (for example, your device's IMEI number, the MAC address of the device's wireless network interface, or the mobile phone number used by the device).

We may also collect information about you (and your guarantor's if applicable) by conducting searches of public records (e.g. Companies House, electoral roll), or in the process of confirming your identity via our online ID verification provider.

We may use the information we collect about you for a number of different purposes. For each purpose, we are required to confirm the 'legal basis' that allows us to use your information, as follows:

Purposes for which we will process the information	Legal basis for the processing
To administer our website and for internal operations, including troubleshooting, data analysis, testing, research, statistical and survey purposes, to allow you to participate in interactive features of our service, when you choose to do so, to measure or understand the effectiveness of advertising we serve to you and others, and to deliver relevant advertising to you and to make suggestions and recommendations to you and other users of our site about goods or services that may interest you or them.	It will be necessary for our legitimate business interests to ensure you receive the best experience possible when accessing and using our website.
To administer our portal for internal operations, including troubleshooting, data analysis, testing, research, statistical and survey purposes, to allow you to participate in interactive features of our service, when you choose to do so, to measure or understand the effectiveness of advertising we serve to you and others, and to deliver relevant advertising to you and to make suggestions and recommendations to you and other users of our site about goods or services that may interest you or them.	It will be necessary for our legitimate business interests to ensure you receive the best experience possible when accessing and using our App.
To obtain further information about you, with a view to us entering into a contract with you or the organisation you represent.	It will be necessary for our legitimate business interests to ensure we are fully aware of all issues relating to the matter that is the subject of the services you have requested from us.

You can change the settings on your internet browser to restrict the amount of information that we can collect when you visit our website. If you do not allow us to collect this information, then we may be unable to offer you the best experience possible when accessing and using our website or App. Our cookie policy is available to view here.

Disclosure of your information

You agree that we have the right to share your personal information with:

• our auditors and quality assurance assessors;
• our website hosting provider;
• selected third parties including:
• business partners, customers, suppliers and sub-contractors to the extent we reasonably consider that it is in your best interests for us to do so, or it is necessary for our legitimate business interests;
• analytics and search engine providers that assist us in the improvement and optimisation of our site;

We will disclose your personal information to third parties:

• in the event that we enter into negotiations to sell or buy any business or assets, in which case we will disclose your personal data to the prospective seller or buyer of such business or assets;
• if The Depot Cafe or substantially all of its assets are acquired by a third party, in which case personal data held by it about you will be one of the assets transferred to the third party; or
• if we are under a duty to disclose or share your personal data in order to comply with any legal obligation, or in order to enforce or apply any contract between you or us, or our website terms of use, or to protect the rights, property, or safety of The Depot Cafe, our customers, or others. This includes exchanging information with other companies and organisations for the purposes of fraud protection and credit risk reduction.

Where we store your personal data

All information you provide to us is stored on our secure servers in the United Kingdom.

We will take all steps reasonably necessary to ensure that your data is treated securely, including taking the following safeguards:

• Data centre access limited to data centre technicians
• Biometric scanning for controlled data centre access
• Security camera monitoring at all data centre locations
• 24x7 onsite staff provides additional protection against unauthorised entry
• Unmarked facilities to help maintain low profile
• Physical security audited by an independent firm
• System Security for your business
• System installation using hardened, patched OS
• System patching to provide ongoing protection from exploits
• Dedicated firewall and VPN services to help block unauthorised system access
• Data protection with managed back-up solutions
• Optional, dedicated intrusion detection devices to provide an additional layer of protection against unauthorised system access
• Distributed Denial of Service (DDoS) mitigation services
• Ongoing risk assessment and security consultation
• All employees trained on documented information security and privacy procedures
• Access to confidential information restricted to authorised personnel only, according to documented processes
• Systems access logged and tracked for auditing purposes
• Best practices used in the random generation of initial passwords
• All data encrypted during transmission (128bit SSL) and while in storage

Unfortunately, the transmission of information via the internet is not completely secure. Although we will do our best to protect your personal data, we cannot guarantee the security of your data transmitted to our site; any transmission is at your own risk. Once we have received your information, we will use strict procedures and security features to try to prevent unauthorised access.

How long we will store your personal data

The length of time that we will store your data will depend on the legal basis for why we are using that data, as follows:

Legal basis	Length of time
Where we use/store your data because it is necessary for the performance of the contract between you and us	We will use/store your data for as long as it is necessary for the performance of the contract between you and us
Where we use/store your data because it is necessary for us to comply with a legal obligation to which we are subject	We will use/store your data for as long as it is necessary for us to comply with our legal obligations
Where we use/store your data because it is necessary for our legitimate business interests	We will use/store your data until you ask us to stop. However, if we can demonstrate the reason why we are using/storing your data overrides your interests, rights and freedoms, then we will continue to use and store your data for as long as it is necessary for the performance of the contract between you and us (or, if earlier, we no longer have a legitimate interest in using/storing your data)
Where we use/store your data because you have given us your specific, informed and unambiguous consent	We will use/store your data until you ask us to stop

Your rights

You have various legal rights in relation to the information you give us, or which we collect about you, as follows:

• You have a right to access the information we hold about you free-of-charge, together with various information about why and how we are using your information, to whom we may have disclosed that information, from where we originally obtained the information and for how long we will use your information.
• You have the right to ask us to rectify any information we hold about you that is inaccurate or incomplete.
• You have the right to ask us to erase the information we hold about you (the 'right to be forgotten'). Please note that this right can only be exercised in certain circumstances and, if you ask us to erase your information and we are unable to do so, we will explain why not.
• You have the right to ask us to stop using your information where: (i) the information we hold about you is inaccurate; (ii) we are unlawfully using your information; (iii) we no longer need to use the information; or (iv) we do not have a legitimate reason to use the information. Please note that we may continue to store your information, or use your information for the purpose of legal proceedings or for protecting the rights of any other person.
• You have the right to ask us to transmit the information we hold about you to another person or company in a structured, commonly-used and machine-readable format. Please note that this right can only be exercised in certain circumstances and, if you ask us to transmit your information and we are unable to do so, we will explain why not.
• Where we use/store your information because it is necessary for our legitimate business interests, you have the right to object to us using/storing your information. We will stop using/storing your information unless we can demonstrate why we believe we have a legitimate business interest which overrides your interests, rights and freedoms.
• Where we use/store your data because you have given us your specific, informed and unambiguous consent, you have the right to withdraw your consent at any time.
• You have the right to object to us using/storing your information for direct marketing purposes.

If you wish to exercise any of your legal rights, please contact us by writing to the address at the top of this policy, or by emailing us at eat@thedepot.cafe

You also have the right, at any time, to lodge a complaint with the Information Commissioner's Office if you believe we are not complying with the laws and regulations relating to the use/storage of the information you give us, or that we collect about you.

Automated decision-making

We do not use automated decision-making but will use automated processing.

Changes to our policy

Any changes we make to our policy in the future will be posted on our website. Changes will become effective immediately on posting. Please check our website frequently to see any updates or changes to our policy.

Contact

Questions, comments and requests regarding this policy are welcomed and should be addressed to us by writing to the address at the top of this policy, or by emailing us at eat@thedepot.cafe

Cookie policy (effective 25/05/2018)

Information about our use of cookies

Our website uses cookies to distinguish you from other users of our website. This helps us to provide you with a good experience when you browse our website and also allows us to improve our site. By continuing to browse the site, you are agreeing to our use of cookies.

A cookie is a small file of letters and numbers that we store on your browser or the hard drive of your computer if you agree. Cookies contain information that is transferred to your computer's hard drive.

We use the following cookies:

• Strictly necessary cookies. These are cookies that are required for the operation of our website. They include, for example, cookies that enable you to log into secure areas of our website, use a shopping cart or make use of e-billing services.
• Analytical/performance cookies. They allow us to recognise and count the number of visitors and to see how visitors move around our website when they are using it. This helps us to improve the way our website works, for example, by ensuring that users are finding what they are looking for easily.
• Functionality cookies. These are used to recognise you when you return to our website. This enables us to personalise our content for you, greet you by name and remember your preferences (for example, your choice of language or region).
• Targeting cookies. These cookies record your visit to our website, the pages you have visited and the links you have followed. We will use this information to make our website and the advertising displayed on it more relevant to your interests. We may also share this information with third parties for this purpose.

You can find more information about the individual cookies we use and the purposes for which we use them in the table below:

Cookie	Name	Purpose	More information
__stacxiommap	ShareThis	These cookies are placed on the website by third parties and are used to allow users to login to their social networking sites to share a chosen page. The cookie remains after your browser is closed.	Click here for more information on ShareThis cookies
_gat, _ga, _gid	Google Analytics	Used by Google Analytics to distinguish users and throttle request rates. Expires after 24hours, 2years & 1 minute	More Information
PHPSESSID	thedepot.cafe	The PHPSESSID cookie is native to PHP and enables websites to store serialised state data. On the website it is used to establish a user session and to pass state data via a temporary cookie, which is commonly referred to as a session cookie. As the PHPSESSID cookie has no timed expiry, it disappears when the client is closed.	N/A

Please note that third parties (including, for example, advertising networks and providers of external services like web traffic analysis services) may also use cookies, over which we have no control. These cookies are likely to be analytical/performance cookies or targeting cookies

You block cookies by activating the setting on your browser that allows you to refuse the setting of all or some cookies. However, if you use your browser settings to block all cookies (including essential cookies) you may not be able to access all or parts of our site.

Except for essential cookies, all cookies will expire after 1 Year.