Ulúa Coffee is committed to protecting and respecting your privacy. This privacy policy explains how we collect, use, and safeguard your personal information when you visit our website (ulua.coffee) or communicate with us.
Ulúa Coffee is a trading name of Catra Selection Limited ("we", "us", or "our"), the data controller responsible for your personal data under the UK General Data Protection Regulation (UK GDPR) and the Data Protection Act 2018.
1. Information we collect
We collect information you provide to us:
- Mailing list subscriptions: when you sign up on our Shop or Contact page to receive news about our releases and harvests, we collect your email address.
- Contact and wholesale enquiries: when you reach out via our contact form, we collect your contact name, business name, email address, and any details you share in your message.
- Direct correspondence: if you email us at hello@ulua.coffee, we retain your email address and message history to respond to your enquiry.
- Customer and transaction records: if you buy from us, we keep the business contact, order, contract and invoice details needed to supply you and meet our accounting obligations.
We also collect limited technical data automatically. Our hosting and security systems log information such as your IP address, browser type, and the date and time of your visit, to keep the website secure and running reliably.
We do not collect payment card information through the website, nor do we collect sensitive personal data.
2. How we use your information and legal basis
- Sending updates, release announcements and harvest news (email address) — Consent: you opted in by submitting your email. You can withdraw consent at any time.
- Responding to sample requests, lot enquiries and business questions (name, business name, email, message) — Legitimate interests: responding to prospective buyers who contacted us, and taking steps at your request before entering into a contract.
- Replying to emails sent directly to hello@ulua.coffee (email address, message content) — Legitimate interests: answering the people who contact us and running our business.
- Keeping customer, contract and invoice records (business contact and transaction details) — Legal obligation: UK tax and accounting law requires us to keep these records.
- Keeping the website secure and working (technical data such as IP address) — Legitimate interests: protecting our website and visitors from misuse.
3. How we store and protect your data
Your information is stored in secure, access-controlled databases hosted within secure cloud environments. Access is restricted to authorised personnel who need it to answer enquiries or manage communications.
We do not sell, rent, or trade your personal information to third parties.
We only share data with trusted technical service providers who help us operate our website and communicate, including website hosting, database hosting, email delivery and web font delivery, under agreements that require them to protect your data.
4. International transfers
Some of our technical service providers store or process data outside the UK, including in the European Economic Area and the United States. Where this happens, we rely on appropriate safeguards: UK adequacy regulations (for example for the EEA, and for US organisations certified under the UK Extension to the EU-US Data Privacy Framework), or the UK International Data Transfer Addendum to the European Commission's Standard Contractual Clauses included in our providers' data processing terms.
5. Data retention
- Mailing list subscribers: we retain your email until you unsubscribe or ask to be removed.
- Contact, wholesale enquiries and direct emails: we retain these for as long as needed to manage our commercial relationship, typically up to 2 years after last contact if no trading relationship develops.
- Customer and transaction records: we keep invoices, contracts and accounting records for 6 years from the end of the financial year they relate to.
- Technical logs: kept for a short period by our hosting and security providers, then deleted automatically.
6. Cookies and third-party services
Our website does not use analytics, advertising cookies, marketing pixels, or tracking tools. We only use strictly necessary technical storage required for the basic operation and security of the site.
To display our typefaces, the website loads fonts from a third-party web font delivery provider. When a page loads, your browser connects to that provider's servers, which receive your IP address. The provider does not set cookies through this service.
7. Your rights
Under UK GDPR, you have the right to:
- Access: request a copy of the personal data we hold about you and information about how we use it.
- Rectification: ask us to correct inaccurate or incomplete personal data.
- Erasure: ask us to delete your personal data where there is no good reason for us to keep processing it.
- Restriction: ask us to suspend the processing of your personal data in certain circumstances, for example while we verify its accuracy.
- Objection: object to our processing of your personal data where we rely on our legitimate interests, and object at any time to the processing of your personal data for direct marketing purposes, in which case we will stop.
- Data portability: where we process your personal data based on your consent or a contract with you and by automated means, receive it in a structured, commonly used and machine-readable format, and ask us to transfer it to another organisation.
- Withdraw consent: withdraw your consent at any time where we rely on it, including by unsubscribing from our mailing list, without affecting the lawfulness of processing carried out before your withdrawal.
To exercise any of these rights, email us at hello@ulua.coffee.
We will respond to your request within one month of receiving it. We may extend this period by up to two further months where the request is complex or we receive a large number of requests, and we will tell you if we do.
If you have a concern about how we handle your personal data, please contact us first so that we can try to resolve it. You also have the right to lodge a complaint with the Information Commissioner's Office (ICO): ico.org.uk · Helpline 0303 123 1113.
8. Contact us
Catra Selection Limited (t/a Ulúa Coffee)
Company number: 17306232
Registered office: Crown House, 27 Old Gloucester Street, London, WC1N 3AX
Email: hello@ulua.coffee