PRIVACY POLICY

Terra&Bean ("we", "us", "our") is committed to protecting your personal data. This privacy policy explains how we collect, use, and protect your information in full compliance with the UK GDPR and EU GDPR.

​

We believe transparency is the foundation of trust. This document outlines exactly what we do with your information no hidden practices, no surprises.

We collect only what's necessary to serve you well:​

​

• Name and email address when you contact us or place an order

• Shipping and billing addresses for order fulfilment

• Payment information (processed securely via our PCI-compliant payment provider — we never store card details)

• Browsing behaviour via cookies (only with your explicit consent)

• Communication preferences for marketing (opt-in only)

We collect only what's necessary to serve you well:​

​

• Name and email address when you contact us or place an order

• Shipping and billing addresses for order fulfilment

• Payment information (processed securely via our PCI-compliant payment provider — we never store card details)

• Browsing behaviour via cookies (only with your explicit consent)

• Communication preferences for marketing (opt-in only)

 Your data helps us deliver a better coffee experience:

​

• Processing and fulfilling your orders accurately

• Communicating order updates and delivery notifications

• Improving our products and website experience

• Sending curated recommendations (only if you've opted in)

• Complying with legal and regulatory obligations

We never sell, rent, or trade your personal data to third parties. Ever. 

We implement industry-standard security measures to protect your data:

​

• SSL/TLS encryption on all data transmissions

• PCI DSS-compliant payment processing

• Regular security audits and vulnerability assessments

• Restricted access controls for employee data handling

As a UK or EU resident, you have the right to:

​

• Access — Request a copy of all personal data we hold about you

• Rectification — Correct any inaccurate or incomplete data

• Erasure — Request deletion of your data ("right to be forgotten")

• Restrict Processing — Limit how we use your data

• Data Portability — Receive your data in a machine-readable format

• Object — Opt out of marketing or profiling at any time

We retain your data only as long as necessary:

​

• Order data: 6 years (UK tax and accounting requirements)

• Marketing preferences: until you unsubscribe

• Cookie data: as specified in our Cookie Policy

• Account data: until you request deletion

We retain your data only as long as necessary:

​

• Order data: 6 years (UK tax and accounting requirements)

• Marketing preferences: until you unsubscribe

• Cookie data: as specified in our Cookie Policy

• Account data: until you request deletion

For any privacy-related questions, requests, or concerns: