Privacy Policy
Laynes Coffee and Bakery ltd
Last updated: 6/11/26
1. Who we are
Laynes Coffee and Bakery ltd ("we", "us", "our") is the controller of the personal data described in this policy. This means we decide how and why your data is used.
Business name: Laynes Coffee and Bakery ltd
Company number: 15140083
Address: 12-16 New Station Street, Leeds, LS1 5DL
Email: hello@laynescafe.co.uk
Phone: 07828823189
ICO registration number: ZC257484
We have not appointed a Data Protection Officer because we are not required to. Questions about your data can be sent to the email address above.
2. What this policy covers
This policy explains how we collect and use personal data when you visit our cafe, use our website, contact us, book a table, order from us, join our mailing list or loyalty scheme, or use our Wi-Fi.
3. The personal data we collect and why
Enquiries: name, email, phone number, and your message, when you contact us by email, phone, social media or our website form
Why we use it: To reply to you and handle your request
Our lawful basis: Legitimate interests (running our business and answering questions)
Table bookings: name, phone, email, party size, date and time, and any dietary or accessibility needs you tell us about
Why we use it: To manage your booking and meet your needs
Our lawful basis: Contract (taking steps to provide your booking)
Orders (in-cafe, online or by phone): name, contact details, order details, collection or delivery address
Why we use it: To prepare and deliver your order
Our lawful basis: Contract
Payments: transaction details such as the amount and date. Card payments are handled by our payment provider, and we do not store your full card number
Why we use it: To take payment, keep accounts and prevent fraud
Our lawful basis: Contract and legal obligation (accounting and tax records)
Allergy and dietary information you give us (this may reveal health information)
Why we use it: To serve you safely
Our lawful basis: Your explicit consent, or where you volunteer it to us in order to receive safe food, the legitimate interests of keeping you safe. We use it only for that order.
Mailing list: name and email address
Why we use it: To send news, offers and events
Our lawful basis: Consent, which you can withdraw at any time
Loyalty scheme: name, contact details, purchase history
Why we use it: To run the scheme and give you rewards
Our lawful basis: Contract, and consent for any marketing
Vouchers and gift cards: purchaser and recipient details
Why we use it: To issue and redeem them
Our lawful basis: Contract
CCTV: images of customers and staff in and around the cafe
Why we use it: Crime prevention, safety of customers and staff, and protecting our property
Our lawful basis: Legitimate interests. Licensing requirement
Website use: IP address, device and browser information, pages visited, via cookies and similar technologies (see section 6)
Why we use it: To make the website work, understand how it is used and, where you agree, for marketing
Our lawful basis: Consent, except for strictly necessary or otherwise exempt technologies
Feedback and reviews: what you tell us and any public reviews you post
Why we use it: To improve our service
Our lawful basis: Legitimate interests
Photos and videos: if we photograph or film at events or within the shop itself
Why we use it: Promotion on our website and social media
Our lawful basis: Consent, or legitimate interests where people are not identifiable. We will tell you if we are filming
We usually collect this data directly from you. Occasionally we receive it from third parties such as booking or delivery platforms you use to order from us, and we treat it under this policy.
4. Marketing
We only send marketing emails or texts to people who have signed up or are existing customers who have not opted out. Every message includes a simple way to unsubscribe. You can also opt out at any time by emailing [privacy email address]. We never sell our mailing list.
5. Who we share your data with
We only share personal data where necessary, with:
Service providers (processors) who act on our instructions, such as our website host, booking system, email marketing provider, payment processor, EPOS (till) provider, accountants and IT support: Providers include but not limited to Squarespace, Mailchimp, SquareUp and Resdiary
Authorities such as the police, HMRC or local authority where the law requires or allows it
Anyone you ask us to share with, or in a business sale or restructure, with the new owner, who must respect your data
We do not sell your personal data.
6. Cookies and similar technologies
Our website uses cookies and similar technologies, which are small files or scripts stored on your device.
Strictly necessary: needed for the site to work, for example to remember items in your basket or keep the site secure. These don't need your consent.
Analytics: help us understand how people use the site.
Marketing: used for advertising or social media tracking. We only set these if you agree.
When you first visit, you'll see a banner letting you accept or reject non-essential cookies. You can change your choice at any time using the "Cookie settings" link in the website footer. You can also block cookies in your browser settings, though some parts of the site may not work properly.
8. How long we keep your data
We keep personal data only as long as we need it. This amount of time can vary on factors such as whether we need the information to maintain an account of gift card, to comply with legal obligations, resolve disputes or support other contracts and policies.
9. Keeping your data safe
We use sensible technical and organisational measures to protect personal data, including password protection, restricted access, secure payment providers and staff training. No system is completely secure, and if there is a breach that is likely to put your rights at risk we will notify you and the ICO where the law requires it.
10. Your rights
Under UK data protection law you have the right to:
Be informed about how we use your data (this policy)
Access a copy of the personal data we hold about you
Rectification: have inaccurate data corrected
Erasure: ask us to delete your data in certain circumstances
Restrict our use of your data in certain circumstances
Data portability: receive some data in a portable format
Object to processing based on legitimate interests, and to direct marketing at any time
Withdraw consent at any time, where we rely on consent. This won't affect processing done before you withdrew
Not be subject to solely automated decisions with significant effects. We don't make any such decisions
To use any of these rights, contact us at [privacy email address]. We may need to check your identity, and we will normally respond within one month. There is usually no charge.
11. Children
Our website and mailing list are not aimed at children, and we don't knowingly collect marketing data from anyone under 13. If you think a child has given us personal data, please contact us and we will delete it. CCTV may capture children visiting the cafe with their families.
12. Complaints
If you're unhappy with how we've handled your data, please contact us first at hello@laynescafe.co.uk or 07828823189, and we will aim to acknowledge your complaint within 30 working days and respond without undue delay.
You also have the right to complain to the Information Commissioner's Office (ICO):
Website: ico.org.uk
Telephone: 0303 123 1113
Address: Information Commissioner's Office, Wycliffe House, Water Lane, Wilmslow, Cheshire SK9 5AF
13. Links to other sites
Our website may link to other sites, such as social media, delivery platforms or maps. We aren't responsible for their privacy practices, so please read their policies.
14. Changes to this policy
We may update this policy from time to time. The latest version will always be on our website with the "last updated" date at the top. For significant changes we will let you know where appropriate, for example by email to our mailing list.
15. Contact us
Laynes Coffee and Bakery ltd, 12-16 New Station Street - hello@laynescafe.co.uk - 07828823189