Privacy Policy.

Who is responsible for your information

The Coffee Club Sutton LTD is responsible for the customer information described here. Questions about privacy or requests about your information can be sent to support@tccsutton.co.uk.

Information we collect

Depending on how you use the website or native apps, we collect or create:

• your first name, surname where applicable, email address and mobile number;
• an optional birthday day and month for birthday rewards. We do not ask for or store your birth year;
• your separate choice about whether to receive marketing;
• account and authentication information, including securely hashed password credentials, session information and security controls;
• basket contents, products and customisations, prices, collection choice, order notes, order status and order history;
• loyalty stamps and ledger entries, rewards, birthday reward activity, NFC collection activity and Admin corrections;
• payment status, payment-provider references, refunds and transactional receipt status; and
• your notification choices, browser push subscription where used, iPhone APNs and Live Activity push tokens, and Android Firebase Cloud Messaging tokens and installation identifiers needed for account-linked updates, together with device registration and delivery activity;
• audit, security, error and operational records, which may include technical request information such as an IP address, browser or device information and timestamps.

The website supports account creation and management; ordering and checkout take place in authorised native apps. You do not need to give us a home delivery address because orders are collection only.

How we use the information

We use this information to provide and manage collection orders, confirm payment status, show orders to authorised staff, provide optional order-status notifications and Live Activities, verify account email addresses and send order receipts when transactional email is enabled, maintain customer accounts and loyalty, answer support requests, review refunds, keep security and audit records, prevent misuse and operate and diagnose the website and native apps.

Sign-in and account history

TCC v1 offers email and password sign-in. If you previously used Apple or Google, we retain the existing provider account identifier and verified email address associated with your TCC account, including an Apple private-relay address where supplied. Password recovery uses the email stored on that same account. We do not retain provider access tokens, refresh tokens or authorization codes. Linking to an existing account requires confirmation of its password. We record how an account was created so genuine pre-launch accounts are preserved when historical test data is reviewed. New email/password signup uses a six-digit verification code valid for 10 minutes. Until verification, we hold an expiring pending registration with hashed password and code, rather than an active customer account. Existing provider-created accounts retain their customer details and linked identity records. After new account setup completes, we send a transactional Welcome email independently of optional marketing consent. Password recovery uses a short-lived, single-use email link.

Accounts, loyalty and NFC

Website accounts use the same identity as the iPhone and Android apps. Browser and PWA ordering are unavailable. An account is required to earn or redeem loyalty. Signed-in orders are linked to the account. We record loyalty earning and redemption, rewards and their expiry, refunds where applied, NFC collections and authorised corrections. NFC Collect Stamp also records the authorised collection session and the card used so duplicate, replay or abusive use can be checked.

Marketing and birthday information

Marketing consent is optional, starts unchecked and is separate from account creation, ordering, loyalty and birthday details. The application does not currently send marketing campaigns. Transactional order and receipt messages are not marketing. Birthday day and month are used only for the configured birthday reward and can be omitted.

Our reasons for using personal information

Depending on the activity, we use personal information where it is necessary to perform or take steps connected with your order or account relationship, to comply with legal obligations, or for legitimate interests such as operating, securing, preventing misuse of and improving the service where those interests are not overridden by your rights. We rely on consent where consent is specifically requested, such as for optional marketing.

Service providers

Cloudflare provides hosting, storage, security and diagnostic services for the website and app services and may process the information needed to provide those services.

If you enable browser order notifications, your browser’s push service receives the technical subscription and request needed to deliver an alert. In the iPhone app, Apple’s Push Notification service receives the device or Live Activity token and notification needed for the order or train updates you enable. The app associates its device token with your account while signed in. Order alerts and Live Activities show an order number, status and collection timing where relevant, not your name or order contents.

In the Android app, Google Firebase Cloud Messaging uses an installation identifier and device token to deliver account-linked notification wakeups. TCC associates the registration with the signed-in account and resolves private notification details through the authenticated app. Notification delivery remains subject to your preferences and device permissions. Google also processes technical information needed to operate these SDK services.

SumUp provides the payment checkout. Card and supported wallet details entered into SumUp checkout are handled by SumUp and are not sent to or stored by The Coffee Club application servers. We retain the payment reference, status and related order or refund records.

Resend provides transactional account-verification and receipt delivery where these services are enabled. It receives the recipient email address and the name and account-verification or order information needed to send the relevant message. The automated sender is noreply@tccsutton.co.uk; support enquiries should be sent to support@tccsutton.co.uk.

Camera and optional coffee reminders

The native apps process counter QR camera frames on the device. Camera access is used only when you choose to scan. TCC does not upload or retain those images. A valid decoded TCC collection link is sent to the TCC service when you use it. Android uses Google's ML Kit barcode scanner, which also collects technical device and application information and per-installation identifiers for diagnostics and usage analytics.

Optional coffee reminders use device location services to detect entry near the shop, including while the app is closed, subject to your operating-system permissions. The apps use a fixed shop location and do not send your location samples to TCC's servers. Android uses Google Play services for this device location feature. You can turn reminders off in the app and change location and notification permissions in device settings.

Cookies and device storage

Necessary cookies keep customer, staff and short-lived NFC collection sessions working. Browser storage may retain receipts and notification preferences from earlier website use. New basket and checkout activity is available only in the native apps. The iPhone app stores the account session, an account preview, pending payment and receipt recovery details, and some claim links in the device Keychain. It keeps basket choices and limited public display data in app storage. Local sign-out removes the account session and preview immediately; a pending logout record can remain securely in Keychain until the server can revoke the offline session or that session expires. A payment attempt that may still complete can remain securely stored until its status is resolved, and guest receipts are kept separately. Android stores its account session and limited account preview in encrypted device storage, protected by the Android Keystore, and keeps basket and public display data locally. The PWA stores an installation preference and caches allowlisted public static files, not account, payment or staff responses. The application does not set analytics or advertising cookies. Full details are in Cookies & Browser Storage.

Who can see the information

Authorised staff can see the order information needed to prepare and manage collections. Authorised administrators can also access customer profiles, order history, loyalty balances, rewards and the audit information needed to investigate an issue or make a recorded correction. Customer data is not made public.

Retention and account deletion

We keep information only for as long as reasonably necessary for the purpose for which it is used and where required for legal, tax or accounting obligations, fraud or security handling, or disputes.

When the deletion service is available, you can request account deletion from Account → Security & data → Delete account in the apps, or Delete Account & Data on the website. The screen checks availability before accepting a request. If the service is unavailable, it explains this and does not claim that a request has been submitted or that your account has been deleted. You can still exercise your data-protection rights by contacting the support address in this policy. For an accepted in-app or website request, you do not need to phone or email us. Deletion is permanent. If there is outstanding value, a payment or an order, the request can remain pending while it is resolved. TCC reviews delayed requests within 2 working days and emails an update if an outstanding issue prevents completion. You can view its status in the same screen and withdraw a pending request to keep your account and use your balance first. Remaining TCC Balance is only forfeited if you separately confirm the displayed amount; deletion never silently discards it. We use transactional email to confirm receipt and completion. On completion, the active account, sessions, loyalty records, rewards and NFC collection sessions are removed. Retained orders and resolved payment drafts have customer identity replaced with Deleted User; customer email, mobile, account links and free-text preparation notes are removed. Minimum payment evidence remains for reconciliation without restoring deleted identity. Account-linked browser continuity and native app sessions are revoked; account-linked push registrations are removed. The apps clear their account session and preview when they receive authoritative deletion or session-expiry confirmation; unresolved payment recovery information is retained only while needed to determine whether a payment completed. Related financial, receipt, operational, security and audit records may remain where required. Deleting an account does not automatically delete information independently held by payment, email or infrastructure providers, or unrelated guest receipts saved in a browser or the app.

Your UK data-protection rights

Subject to applicable UK data-protection law and any relevant limitations, you may have rights to access your personal information, correct inaccurate information, request deletion or restriction in appropriate circumstances, object to certain processing, receive portable data where applicable, and withdraw consent where processing relies on consent.

To exercise a right or raise a privacy concern, email support@tccsutton.co.uk. We may need to verify your identity before fulfilling a request.

You also have the right to complain to the UK Information Commissioner’s Office. Information about making a complaint is available from the ICO website.