Who we are
SURFIN CAFE LIMITED, trading as Surfin Café (“we”, “us”, “our”), operates the website surfincafe.co.uk. We are the data controller for the personal information described here.
- Registered company name: SURFIN CAFE LIMITED
- Company number: 08515162
- Registered address: 3–4 Market House, Market Square, Biggleswade, Bedfordshire, SG18 8AQ
- Contact for privacy matters: [email protected]
- ICO registration number: ZC102545
What we collect and why
Contact form
When you send us a message through our contact form, we collect the name, email address and message you provide. That is all — we do not collect anything else about you when you use it. The message is delivered to our inbox by Web3Forms; it does not pass through this website’s server.
- Purpose: to read and reply to your enquiry.
- Lawful basis: legitimate interests — responding to people who contact us about our business.
- Retention: we keep enquiry correspondence for 12 months, then delete it. Web3Forms, who deliver the message to us, keep their own copy for up to three years from the date you sent it, after which they delete it automatically.
What we do not do
We do not use website analytics of any kind — we do not measure or record your visit at all. We do not run a mailing list. We do not use advertising or tracking cookies. We do not sell your information, and we do not share it for advertising. We do not ask for any information you have not chosen to send us.
Who we share information with
We use the following service providers, who process data on our behalf:
| Provider | What they do | Where data is processed |
|---|---|---|
| Render | Hosts our website | United States |
| Web3Forms (Web3Creative) | Delivers contact form messages to our inbox | India, using Amazon Web Services infrastructure across multiple regions |
We may also disclose information where the law requires us to.
International transfers
Our website is hosted by Render, which is based in the United States. Where personal data is transferred outside the UK, that transfer is protected by the UK International Data Transfer Addendum to the EU Standard Contractual Clauses, or by an adequacy decision made by the UK government.
Contact form messages are delivered by Web3Forms, a service operated by Web3Creative from India, using Amazon Web Services infrastructure that may process data in more than one region. Web3Creative acts as our data processor under a written data processing agreement, and transfers of personal data from the UK are made under the Standard Contractual Clauses set out in that agreement.
How we keep your information secure
Our website is served over an encrypted HTTPS connection. We limit access to personal information to the people who need it to run the café and answer enquiries. Our service providers are required to keep the data they handle for us secure.
Your rights
Under UK data protection law you have the right to:
- access the personal information we hold about you
- rectification — ask us to correct anything inaccurate or incomplete
- erasure — ask us to delete your personal information in certain circumstances
- restrict processing in certain circumstances
- object to processing carried out on the basis of our legitimate interests
- data portability — receive your data in a portable format in certain circumstances
To exercise any of these, email [email protected]. We will respond within one month.
Complaints
If you are unhappy with how we have handled your information, please contact us first at [email protected] so we can try to put it right.
You also have the right to complain to the Information Commissioner’s Office, the UK’s data protection regulator, at ico.org.uk or on 0303 123 1113.
Children
Our website is not directed at children, and we do not knowingly collect personal information from children under 13.
Changes to this policy
We may update this policy from time to time. The date at the top shows when it was last revised. Where changes are significant we will make that clear on our website.