Privacy Policy

This policy explains how The Heavy Tree Cafe & Bar ("we", "us") uses your personal data when you use this website and order from us. The data controller is The Heavy Tree, 77 Fore Street, Heavitree, Exeter EX1 2RN. Contact: admin@heavytree.co.uk or 01392 660857.

What we collect

• Account details: name, email address, mobile number and password (stored only as a secure one-way hash).
• Delivery details: the addresses you deliver to, and delivery instructions. We convert postcodes and addresses to map locations to check we deliver to you.
• Orders: what you ordered, prices, order status and history.
• Payments: handled by Stripe. We receive confirmation of payment and refunds, but never your full card number.
• Technical data: your IP address and basic request information, used to keep the site secure (for example to block repeated failed logins).

Why we use it (lawful basis)

Purpose	Lawful basis
Creating your account, taking and delivering orders, contacting you about an order	Contract
Payments, refunds and fraud prevention	Contract and legitimate interests
Keeping the website secure	Legitimate interests
Keeping financial records (e.g. for HMRC)	Legal obligation
Offers and news by email — only if you opt in	Consent (withdraw any time)

Who we share it with

Only what's needed, with: Stripe (payments), our hosting provider (servers and databases), our email provider (order emails), address lookup services (postcodes.io and/or Google Maps, to find delivery locations), and our delivery staff (your name, phone number, address and instructions for your order). We don't sell your data.

Some providers may process data outside the UK; where they do, they use legal safeguards such as UK-approved contract clauses.

How long we keep it

• Order and payment records: 6 years, to meet tax and accounting rules.
• Your account and saved addresses: until you ask us to delete your account.
• In-app notifications: 90 days. Login sessions: up to 30 days ("Remember me") or 12 hours.

Cookies

We only use essential cookies: one to keep you signed in (and a separate one for staff on our admin site). Your basket is stored in your own browser. We don't use advertising or analytics cookies, so we don't ask for cookie consent.

Your rights

You can ask to access, correct or delete your data, restrict or object to how we use it, or receive it in a portable format. Email admin@heavytree.co.uk — we'll respond within one month. If you're unhappy with how we handle your data you can complain to the Information Commissioner's Office (ico.org.uk, 0303 123 1113).

Changes

We'll update this page if how we use your data changes. The date at the top shows when it was last updated.