GDPR & Your Data Rights

• Access — a copy of the personal data we hold about you.
• Rectification — correction of inaccurate or incomplete details.
• Erasure — deletion, where we don't need to keep records by law.
• Restriction — pause processing while a query is resolved.
• Portability — your data in a common machine-readable format.
• Objection — object to processing based on legitimate interests.
• Withdraw consent — for marketing and non-essential cookies, at any time.

Email info@cafe1luton.co.uk with the subject "Data request", telling us which right you want to use and the name, phone number or email you used when ordering. We may ask for proof of identity to protect your data.

We respond within one calendar month. If a request is complex we may extend this by up to two further months and will explain why. Requests are free unless clearly unfounded or excessive.

Financial and order records are retained for six years to meet HMRC requirements, even after an account is deleted. Remaining personal details are removed or anonymised.

Access to order and customer data is restricted to café staff accounts with role-based permissions. Card details are handled entirely by our secure payment provider and never stored by Café 1.

If you're unhappy with how we've handled your data you can complain to the Information Commissioner's Office at ico.org.uk or on 0303 123 1113.