Privacy & cookies policy

Last updated: 23 September 2026

This policy explains how Rebel Barista collects, uses and protects your personal information when you visit our website, purchase products or contact us.

Who we are

Rebel Barista is a trading name of REBSTA GROUP LTD, registered in England and Wales under company number 16986720.REBSTA GROUP LTD is the controller responsible for the personal information described in this policy.

Website: rebelbarista.store
Email: customersupport@rebelbarista.co.uk
Registered office and correspondence address:
REBSTA GROUP LTD
71-75 Shelton Street
Covent Garden
London
WC2H 9JQ
United Kingdom

The information we collect

Depending on how you interact with us, we collect: Your name, email address and telephone number. Billing and delivery addresses. Details of your orders, purchases, deliveries, payments, returns and refunds. Your account details and preferences, if you create an account. Messages, enquiries, reviews and other information you send us. Your marketing preferences and records of consent. Technical information such as your IP address, browser, device information and security logs generated when you use our website. We collect information directly from you, through the operation of our website, and from payment and delivery providers handling your transactions. If someone orders a delivery for you, we receive the contact and delivery information they supply.

How and why we use your information

We use personal information for the following purposes:

Processing orders and providing customer service

We use your information to accept and fulfil orders, arrange delivery, send order updates, manage customer accounts and handle cancellations, returns and refunds. Our lawful basis is that this processing is necessary to perform our contract with you or take steps you request before entering into a contract. If you do not provide information needed to process payment or deliver an order, we may be unable to complete your purchase.

Meeting legal obligations

We keep appropriate transaction records and use information where necessary to meet accounting, tax, consumer protection and other legal requirements. Our lawful basis is compliance with a legal obligation.

Running and protecting our business

We use relevant information to answer general enquiries, investigate complaints, maintain website security, prevent fraud and misuse, and establish or defend legal claims. Our lawful basis is our legitimate interests in operating a reliable business, protecting customers and safeguarding our services. We consider the impact on your rights when relying on these interests.

Marketing

If you subscribe to promotional emails, we use your contact details to send the updates and offers you requested. Our lawful basis is your consent. You can unsubscribe at any time using the link in a promotional email or by contacting customersupport@rebelbarista.co.uk.Unsubscribing does not stop essential messages about your orders or account. Withdrawing consent does not affect processing that was lawful before you withdrew it.

Payments and SumUp

The payment methods available for your purchase are shown at checkout. Where you pay through SumUp, SumUp processes the information needed to complete your payment, carry out security and fraud checks, and meet its legal obligations. This may include payment details, contact information, transaction information and device information. We receive the transaction information needed to confirm payment, manage your order, reconcile our records and process refunds. SumUp also acts as an independent controller for its own payment services and regulatory responsibilities. Details of its processing, international transfers and your rights are available in SumUp’s privacy policy. Please do not send card numbers or card security codes to us by email. 

Who receives your information

We share relevant personal information where necessary with: Payment providers processing transactions. Suppliers, roasteries and fulfilment partners preparing or dispatching orders. Couriers and delivery services. Website hosting, IT, security and email service providers. Email marketing providers when handling subscriptions and promotional messages. Accountants, legal advisers and other professional advisers. Authorities or regulators where disclosure is required by law. For example, a roastery dispatching your coffee needs your order details and delivery information. A courier may need your telephone number or email address to provide delivery updates. We limit the information shared to what is needed for the relevant purpose. Service providers acting on our behalf must handle it under appropriate data protection arrangements.

Website hosting and international processing

Our website uses WordPress and WooCommerce and is hosted through Namecheap’s EasyWP service. Hosting and payment services can involve processing outside the United Kingdom, including in the European Economic Area and the United States. Namecheap’s EasyWP terms provide for international processing under its Data Processing Addendum, which sets out contractual protections for customer data. SumUp explains its international processing arrangements in its privacy policy linked above. Where we arrange a transfer of personal information that requires additional protection under UK law, we use an applicable UK adequacy arrangement or appropriate contractual safeguards. You can contact us for further information about international transfers and copies of relevant safeguards, subject to necessary redactions.

Cookies and similar technologies

Cookies are small files stored on your device. Our website uses cookies and similar technologies to support functions such as remembering your basket, maintaining your shopping session, allowing account access and supporting security. WooCommerce’s standard basket cookies include: woocommerce_cart_hash and woocommerce_items_in_cart, which help the shop recognise changes to your basket and normally last for your browsing session. wp_woocommerce_session_, which links your browser to your basket information and normally lasts for two days. Cookies needed to provide a service you request, such as maintaining your basket or completing checkout, do not require cookie consent. You can delete or block cookies through your browser settings. Blocking essential cookies may prevent the basket, checkout or account functions from working correctly.

Google Analytics and optional tracking

Google Analytics is not currently enabled on this website. If we introduce Google Analytics or other optional tracking, we will update this policy to explain what information is collected, why it is used, who receives it and the choices available to you. Where consent is required, the relevant tracking will only operate after you have given consent, and you will be able to withdraw it. Browsing our website does not, by itself, constitute consent to optional tracking.

Customer reviews

If you submit a review for publication, its contents and the public name associated with it may appear on our website. Please avoid including private contact details or other information you do not want published. We use our legitimate interests in providing useful product feedback and managing the integrity of reviews to handle submitted reviews.

How long we keep information

We keep personal information for as long as it is needed for the purpose for which it was collected, taking account of legal obligations and any ongoing complaints or disputes. Accounting records are normally retained for six years from the end of the company financial year they relate to. Some records may need to be kept longer where the law requires it. Account information is retained while needed to provide your account and related services. Closing an account does not necessarily require us to delete transaction records we must retain by law. Enquiries, complaints and security records are retained according to the time needed to resolve the issue, protect our services and deal with any resulting legal claims. If you unsubscribe from marketing, we may keep a minimal record of your preference so we do not contact you again by mistake. When information is no longer needed, we delete it or anonymise it. 

Protecting your information

We use appropriate technical and organisational measures to protect personal information against unauthorised access, loss, alteration or disclosure. Access is limited to people and service providers who need the information for their work. No internet transmission or storage system can be guaranteed completely secure.

Your data protection rights

Depending on the circumstances, you have the right to: Access your personal information. Have inaccurate or incomplete information corrected. Request deletion of your information. Request restrictions on how your information is used. Receive certain information in a portable format. Object to processing based on legitimate interests. Withdraw consent where processing relies on your consent.

You can object to the use of your personal information for direct marketing at any time.

These rights are subject to applicable legal conditions. For example, we may need to retain certain transaction records even after receiving a deletion request. To exercise your rights, contact customersupport@rebelbarista.co.uk. We may request information reasonably needed to verify your identity. We normally respond within 48hrs, at busy times this may be extended. If an extension or clarification is permitted by law and needed to deal with your request, we will explain this to you.

Questions and complaints

Please contact us if you have questions or concerns about how we handle personal information. We will investigate and respond. You also have the right to complain to the Information Commissioner’s Office, the UK data protection regulator. Website: ico.org.uk/make-a-complaint
Telephone: 0303 123 1113

Changes to this policy

We will update this policy when our services, data practices or legal requirements change. The latest version will appear on this page with an updated date. We will provide additional notice of significant changes where required.