PRIVACY POLICY

Café de Paulo – Inverness
At Café de Paulo, we take the protection of your personal data and respect for your privacy very seriously. Through this Privacy Policy, we aim to provide you with clear and transparent information on how we collect, use and protect the personal information you provide when visiting our website. Your personal data is processed in accordance with current UK legislation, in particular the UK General Data Protection Regulation (UK GDPR), the Data Protection Act 2018 and, where applicable, the Privacy and Electronic Communications Regulations (PECR).

Data controller
The data controller responsible for processing your personal data is Café de Paulo, based in Inverness (United Kingdom). If you have any questions regarding data protection, please contact us via the following link.

Personal data we collect
When you use our website, we may collect personal data both directly and automatically. Firstly, we collect the information you voluntarily provide to us when filling in forms or contacting us, such as your name, email address, telephone number and any other information included in your message. On the other hand, we also collect information automatically through the use of cookies and similar technologies. This data may include your IP address, device type, the browser used, as well as information about how you navigate our website.

Purpose of processing
Personal data is used for various purposes, depending on the nature of your relationship with us. In particular, we process your data to respond to enquiries and requests for information, to manage any bookings or services offered via the website, to improve the functioning of the site and the user experience, and to ensure system security. Where you have given your express consent, we may also use your data to send you marketing communications relating to our products or services.

Legal basis for processing
The processing of your personal data is based on various legal grounds. Firstly, on your consent, when you provide your data voluntarily or agree to receive marketing communications. Furthermore, processing may be necessary for the performance of pre-contractual or contractual measures when you request information or services. Furthermore, in certain cases we process data on the basis of our legitimate interest, for example, to improve our services, analyse website usage or prevent fraud, whilst always ensuring that these interests do not override your rights.

Data retention
Your personal data will be retained only for as long as is necessary to fulfil the purpose for which it was collected. Thereafter, it may be kept securely locked away for the periods required by applicable legislation, in order to meet any potential legal liabilities.
In the case of processing based on consent, the data will be retained until the user withdraws that consent.

Marketing communications
Café de Paulo will only send marketing communications where there is a legal basis for doing so, whether this is the user’s prior consent or a pre-existing relationship in accordance with applicable regulations. The user may object to receiving such communications at any time, easily and free of charge.

Data Recipients
Personal data may only be shared with third parties when necessary for the proper operation of our business. Specifically, service providers acting on behalf of Paulo Coffee—such as web hosting providers, technical maintenance services, or email marketing platforms—may have access to this information. These providers operate as data processors and are bound by contractual obligations that guarantee data confidentiality and security. Additionally, data may be disclosed to public authorities whenever required by law.

International transfers
Where any of our suppliers are based outside the UK, we will put in place the necessary safeguards to ensure an adequate level of protection for personal data, such as the use of standard contractual clauses or other legally recognised mechanisms.

User rights
You have the right to access your personal data, request its rectification where it is inaccurate, request its erasure where it is no longer necessary, object to its processing, request the restriction of such processing and, where applicable, request the portability of your data. You may also withdraw your consent at any time, without this affecting the lawfulness of any processing carried out prior to such withdrawal. To exercise these rights, please contact us via the email address provided above.

Complaints to the supervisory authority
If you believe that the processing of your personal data does not comply with the applicable regulations, you have the right to lodge a complaint with the competent data protection authority in the United Kingdom:

Information Commissioner’s Office (ICO)

Data security
Café de Paulo takes the necessary technical and organisational measures to ensure the security of personal data and to prevent its loss, alteration, unauthorised access or misuse.

Use of cookies
Our website uses cookies and similar technologies to ensure the site functions properly, to analyse how users interact with it, and to improve your experience.
You can find more information in our Cookie Policy.

Changes to the policy
Café de Paulo reserves the right to amend this Privacy Policy at any time to bring it into line with regulatory changes or improvements to the website’s functionality. In the event of significant changes, users will be duly notified.

Contact
If you have any questions or queries regarding this Privacy Policy, please contact us via our contact form.