Privacy Policy

Café 1 Luton, operating at Luton Crown Court, LU1 2AA and Futures House, Marsh Farm, LU3 3QB, is the data controller for personal data collected through this site. Contact us at info@cafe1luton.co.uk.

• Order details: items, modifiers, notes, order type and time slot.
• Contact details: name, phone number, email address.
• Visit details: your chosen branch, order type, table number and order notes.
• Account details if you register: name, email, loyalty points, order history.
• House account details where your employer holds a tab with us.
• Technical data: device and browser information, and cookies as described in our Cookie Policy.

Card payments are processed by our secure payment provider. Café 1 never sees or stores your full card number, expiry date or security code — we only receive a payment reference and whether the payment succeeded.

To take and prepare your order, to arrange dine-in or takeaway, to handle refunds and complaints, to operate house accounts and loyalty, to keep records required by law, and — only with your permission — to send marketing.

Performance of a contract (fulfilling your order), legitimate interests (running and securing the café and our site), legal obligation (tax and accounting records) and consent (marketing and non-essential cookies).

Our payment provider, website security and edge provider (Cloudflare), hosting and database provider (Supabase/Lovable), and Google Maps services used to show our café locations. If you allow analytics, Google Analytics receives the normal browser and page-use data with advertising features disabled. If you allow marketing cookies and play an embedded social video, its source platform receives the normal browser request. We do not sell your data.

Order and transaction records are kept for six years for tax purposes. Account data is kept until you ask us to delete it. Marketing consent records are kept until you withdraw consent.

We use access controls, encrypted HTTPS connections, audit records and role-based database rules to protect data. Some technology providers may process data outside the UK; where that happens, we rely on the provider's applicable contractual and legal transfer safeguards. No internet service can guarantee absolute security.

You can request access, correction, deletion, restriction or a copy of your data, and object to processing. See our GDPR page for how to make a request, or contact info@cafe1luton.co.uk. You can also complain to the Information Commissioner's Office (ico.org.uk).

Last updated: 9 August 2026.