Privacy Policy

Woodies Coffee Shop

Last updated: 15/12/25

At Woodies (“we,” “us,” or “our”), we are committed to protecting your personal data and complying with the Data Protection (Bailiwick of Guernsey) Law, 2017 (“the Law”). This Privacy Policy explains the types of personal data we collect, how we use and store it, the legal bases for processing, and your rights under Guernsey’s data protection regulations.

If you have questions, contact our Data Protection Officer (“DPO”):
Email: gracie@woodiescoffeeshop.com
Address: 27 The Pollet, Guernsey GY1 1WQ

1. Personal Data We Collect

1.1 Data You Provide

When you sign up for our digital loyalty card, we may collect:

• Name
• Email address
• Phone number
• Communication preferences
• Payment information (processed securely by third-party providers)

1.2 Data Collected Automatically

When you use our loyalty app, we collect:

• Purchase history (items purchased, store visited, date/time)
• Loyalty points balance and activity
• Device information (IP address, browser type, device ID)
• App usage metrics
• Location data (only if you enable GPS services)

1.3 Data from Third Parties

We may receive data from:

• Payment processors
• Marketing or analytics partners
• Social media platforms you choose to link with our Services

2. How and Why We Use Your Personal Data

Under Guernsey’s data protection law, we must identify a lawful basis for each processing activity. We use your personal data for the following purposes:

2.1 To Provide and Manage Your Account — Legal basis: Contract

• Creating and maintaining your loyalty card account
• Processing purchases and rewards
• Authenticating your identity

2.2 To Improve and Customise Services — Legal basis: Legitimate Interests

• Analysing purchase behaviour for service improvements
• Personalising offers and recommendations
• Conducting internal analytics and reporting

We ensure these interests do not override your rights or freedoms.

2.3 Marketing Communications — Legal basis: Consent

• Sending personalised promotions
• Notifying you of events or new products

You may withdraw consent at any time through your account settings or by contacting us.

2.4 Compliance and Legal Obligations — Legal basis: Legal Requirement

• Responding to law enforcement or regulatory authorities
• Record-keeping obligations

3. Sharing Your Personal Data

We do not sell your personal data. We may share it only when necessary:

3.1 Service Providers (Processors)

We work with carefully selected third parties who provide:

• Website and app hosting
• Payment processing
• Marketing or analytics services
• IT maintenance and security

These providers must comply with the Law and process your data only on our instructions.

3.2 Legal Requests

We may share data where required to:

• Comply with court orders
• Respond to lawful government demands

3.3 Business Transactions

If we merge or are acquired, personal data may transfer to the new entity, subject to continuous protection.

4. International Data Transfers

If we transfer your personal data outside the Bailiwick of Guernsey, we ensure appropriate safeguards are in place, including:

• Adequacy decisions issued for the destination country
• Contractual Clauses approved under Guernsey law
• Other legally recognised protective measures

These measures ensure your data remains protected to Guernsey standards.

5. Data Security

We use technical and organisational security measures to safeguard your personal data, including:

• Encryption of data at rest and in transit
• Secure servers and firewalls
• Access controls and authentication procedures
• Regular risk assessments and system monitoring

We retain your data only as long as necessary for the purposes outlined or as required by law.

6. Your Rights Under Guernsey Law

Under the Data Protection (Bailiwick of Guernsey) Law, 2017, you have the right to:

• Access your personal data
• Rectify inaccurate or incomplete information
• Erase your data (“right to be forgotten”)
• Restrict processing in certain circumstances
• Object to processing based on legitimate interests or direct marketing
• Data portability — receive your data in a usable format
• Withdraw consent at any time (for marketing or optional features)
• Lodge a complaint with the Office of the Data Protection Authority (ODPA):
  https://odpa.gg

To exercise any of these rights, contact us at gracie@woodiescoffeeshop.com.

7. Cookies and Tracking Technologies

We use cookies and similar technologies to:

• Facilitate website functionality
• Analyse traffic and usage patterns
• Personalize offers and content

Where legally required, we will request your consent before using non-essential cookies.

8. Children’s Privacy

Our Services are not intended for children under 13, and we do not knowingly collect children’s data. If such data is discovered, we will promptly delete it.

9. Updates to This Policy

We may revise this Privacy Policy to reflect changes in:

• The Law
• Our data practices
• New features or services

We will post updates on this page and revise the “Last updated” date.

10. Contact Us

If you have questions or concerns about this Privacy Policy or how we process your personal data, contact our DPO:

Woodies Coffee Shop
Email: gracie@woodiescoffeeshop.com
Address: 27 The Pollet, Guernsey GY1 1WQ

Contacting the ODPA

If you have any concerns or complaints about how your data has been handled, or feel that we are not handling your queries correctly, you have the right to contact the Office of the Data Protection Authority (ODPA):

Office of the Data Protection Authority
Block A, Lefebvre Court, Lefebvre Street, St Peter Port GY1 2JP, Guernsey

Phone: +44 (0)1481 742074
Email: info@odpa.gg
Website: https://www.odpa.gg