Privacy Policy

Café 1, St Albans Crown Court, AL1 3JU is the data controller for personal data collected through this site. Contact us at info@cafe1stalbans.co.uk.

• Order details: items, modifiers, notes, order type and time slot.
• Contact details: name, phone number, email address.
• Delivery details: address, postcode, company or office name, delivery notes.
• Account details if you register: name, email, loyalty points, order history.
• House account details where your employer holds a tab with us.
• Technical data: device and browser information, and cookies as described in our Cookie Policy.

Card payments are processed by SumUp. Café 1 never sees or stores your full card number, expiry date or security code — we only receive a payment reference and whether the payment succeeded.

To take and prepare your order, to deliver it, to handle refunds and complaints, to operate house accounts and loyalty, to keep records required by law, and — only with your permission — to send marketing.

Performance of a contract (fulfilling your order), legitimate interests (running and securing the café and our site), legal obligation (tax and accounting records) and consent (marketing and non-essential cookies).

Our payment provider (SumUp), website security and edge provider (Cloudflare), hosting and database provider (Supabase/Lovable), our delivery drivers for delivery orders, and Google Maps services used to check our delivery radius. If you allow analytics, Google Analytics receives the normal browser and page-use data with advertising features disabled. If you allow marketing cookies and play an embedded social video, its source platform receives the normal browser request. We do not sell your data.

Order and transaction records are kept for six years for tax purposes. Account data is kept until you ask us to delete it. Marketing consent records are kept until you withdraw consent.

We use access controls, encrypted HTTPS connections, audit records and role-based database rules to protect data. Some technology providers may process data outside the UK; where that happens, we rely on the provider's applicable contractual and legal transfer safeguards. No internet service can guarantee absolute security.

You can request access, correction, deletion, restriction or a copy of your data, and object to processing. See our GDPR page for how to make a request, or contact info@cafe1stalbans.co.uk. You can also complain to the Information Commissioner's Office (ico.org.uk).

Last updated: 9 August 2026.