Privacy Policy

Last updated: 25 September 2026

1. Who we are

Welcome to the Indie Coffee London directory website (published at indiecoffee.london). We are dedicated to promoting and highlighting independent coffee shops and cafes across London.

2. What data we collect

We may collect and process the following data about you:

  • Account information: Your email address, display name, and (if using email sign-up) a securely hashed password. If signing in with Google, we receive your name, email, and profile picture from Google.
  • Favourites and preferences: Cafes you favourite, boroughs you follow, postcode (if provided), and newsletter subscription preferences.
  • Contact form submissions: Your name (if provided), email address, message, and any café associated with your enquiry. For café-specific visitor enquiries we also record whether you opted in to sharing; if an administrator forwards one, we record when forwarding was attempted and completed, the recipient address, and the email message ID.
  • Newsletter data: Your email address and a record of newsletters sent to you.
  • Session data: A secure session token stored in a cookie to keep you logged in.
  • Location data: Only collected when you explicitly permit your browser to share your location for the "nearby cafe" features. This data is processed locally and not stored on our servers.

3. How we use your data

Your data is used solely for the following purposes:

  • To provide and personalise the directory (e.g., favourites, followed boroughs, nearby cafes).
  • To authenticate you and maintain your session.
  • To send newsletters (only if you opt in).
  • To review and, where possible, respond to your contact enquiries or feedback. A café-specific visitor enquiry is addressed to Indie Coffee London, not directly to the café. We do not guarantee a response or forwarding.
  • If you explicitly tick the optional, initially unchecked sharing box on a café enquiry, an administrator may, after review, share your message, name if provided, and email solely with that café if it is then a participating premium café. Without that opt-in, we do not share your enquiry with the café. We do not forward enquiries automatically.
  • To maintain the security and administration of the directory.

4. Lawful basis for processing

We process your personal data under the following lawful bases:

  • Consent: For account creation and newsletter subscription.
  • Legitimate interests: For operating and improving the directory service.

We do not sell or share your personal data with third parties for marketing purposes.

5. Cookies

We believe in your privacy. We use a single essential session cookie to keep you logged in. It is a secure, HTTP-only cookie that expires after 30 days.

We do not use tracking cookies, analytics cookies, or advertising cookies. No cookie consent banner is required as our cookies are strictly necessary for the functioning of the service.

6. Third-party services

To provide the best possible experience, we utilize the following third-party services:

  • Google Sign-In (OAuth 2.0): If you choose to sign in with Google, we receive your basic profile information (name, email, profile picture) from Google. Google's privacy policy applies to their processing of your data.
  • Google Places API & OpenStreetMap (Leaflet): For mapping, cafe information, and cafe images.
  • Floot: Our secure hosting and platform provider.

7. Data retention

We do not hold your data for longer than necessary:

  • Account data: Retained for as long as your account is active. You can delete your account at any time from your account settings page, which permanently removes all your data.
  • Session data: Sessions expire after 30 days of inactivity.
  • Contact form data: Retained while needed to handle enquiries, maintain forwarding and moderation records, and meet applicable legal or operational obligations. Marking an enquiry resolved does not automatically delete it. Contact us if you want to request deletion.
  • Newsletter data: Retained until you unsubscribe or delete your account.

8. Your rights under UK GDPR

Under the UK General Data Protection Regulation (UK GDPR), you have several rights regarding your personal data, including:

  • The right to access your personal data.
  • The right to rectification of inaccurate data.
  • The right to erasure ("right to be forgotten"). Note that you can exercise your right to erasure by deleting your account from the account settings page.
  • The right to restrict processing.
  • The right to data portability.
  • The right to object to processing.

9. Data security

We take the security of your data seriously:

  • Passwords are securely hashed using industry-standard algorithms (bcrypt) — we never store passwords in plain text.
  • Sessions use cryptographically random tokens.
  • All data is transmitted securely over HTTPS.

10. Changes to this policy

We may update this policy from time to time. The "Last updated" date at the top of this page will be changed accordingly.

11. Contact us

If you have any questions about this Privacy Policy or wish to exercise any of your rights, please get in touch with us via our Contact page.