Buy coffee

Privacy

Privacy notice

Last updated: 8 October 2026

This notice explains what personal information Highs & Lows Coffee collects, why, who we share it with and your rights. We collect only what we need to send you coffee, and we never sell your information.

1. Who we are

Rokad Enterprise Ltd (trading as Highs & Lows Coffee), company number 17483893, 12 The Hayfield, Blackburn, BB2 7BP, is responsible for your personal information (the "data controller"). For any privacy question or request, email hello@rokadenterprise.ltd.

2. What we collect

  • When you order: your name, email address, phone number (if you give it), delivery address, what you ordered, your grind and roast choices, and payment status. For gifts, we also collect the recipient's name and address, and your gift message.
  • Card details: these are collected by Stripe, our payment provider. We never see or store your card number.
  • When you email us: your email address and whatever you include in your message.
  • Pay it forward: if you buy coffee for someone else, any note or name you add for the card.
  • Ventures: if you register your interest, the details you choose to send us (such as your name, age, town and business idea).

3. Requests for a pay-it-forward bag

If you ask us for a bag, your request tells us that you live with bipolar disorder. That's health information, which the law treats as especially sensitive, so we take extra care with it:

  • We use it only to post your coffee, and only with your explicit consent, which you give by sending us the request. You can withdraw your consent at any time by emailing us, and we'll delete your request.
  • We keep these requests in our email account only. We don't add any health information to our order systems, and the parcel and its card make no mention of bipolar disorder.
  • We never tell the person who paid it forward who received the coffee.
  • We delete your request and address within 3 months of posting your bag, unless you ask us to keep you on the list for future bags.
  • The same care applies to anything you tell us about your health when registering your interest in Ventures.

4. Why we use your information

  • To take and deliver your order, including subscriptions and renewals, gift deliveries and customer service. Our legal basis is that we need it to carry out our contract with you.
  • To deliver a gift to its recipient. Our legal basis is our legitimate interest in fulfilling the order the buyer has placed.
  • To keep business and tax records. Our legal basis is our legal obligation to keep accounts.
  • To prevent fraud (carried out mainly by Stripe). Our legal basis is our legitimate interest in protecting our business and customers.
  • We don't send marketing emails. If we ever start, we'll only email you if you've opted in, and every email will have an unsubscribe link.

5. Who we share it with

We share your information only with the companies that help us run the shop, and only what each needs:

  • Stripe: processes payments and subscriptions, and sends your receipts.
  • Royal Mail: your name and address appear on your parcel.
  • Cloudflare: hosts our website and checkout.
  • Supabase: stores our order records, on servers in London.
  • Notion: our order board, which we use to track what needs packing and posting.
  • Our email provider: for messages you send us.

We don't share your information with Skylark, our roaster, and we never sell it. We may share it if the law requires it.

6. Information stored outside the UK

Some of the companies above (such as Stripe, Cloudflare and Notion) may process information in the United States or elsewhere. When that happens, the transfer is protected by safeguards approved under UK law, such as the UK–US data bridge or standard contractual clauses.

7. How long we keep it

  • Order and payment records: 6 years after the end of the financial year they relate to, as required for tax purposes.
  • Gift recipients' details: deleted after the gift's final delivery, except where they form part of the order record above.
  • Pay-it-forward requests: see section 3.
  • Emails: deleted once they're no longer needed, normally within 2 years.

8. Cookies

Our website doesn't use advertising or tracking cookies. To show our fonts, your browser loads them from Google Fonts, which can see your IP address. When you pay, Stripe's checkout page uses cookies to keep your payment secure and prevent fraud. You can read Stripe's privacy policy for details.

9. Your rights

You have the right to:

  • ask for a copy of the information we hold about you;
  • ask us to correct anything that's wrong;
  • ask us to delete your information (we may need to keep order records for tax purposes);
  • ask us to stop or limit using your information, or object to how we use it;
  • ask for your information in a format you can take elsewhere;
  • withdraw your consent at any time, where we rely on it.

To make a request, email hello@rokadenterprise.ltd. We'll reply within one month. It's free.

If you're unhappy with how we've handled your information, please tell us first. You can also complain to the Information Commissioner's Office (ICO) at ico.org.uk or on 0303 123 1113.

Buy coffee