Privacy Policy

1. Who we are

ADD Coffee, Automotive & Agriculture Ltd (“ADD Coffee”, “we”, “us”) is an Ethiopian coffee, honey, avocado and sesame exporter and the operator of the ADD Coffee business-to-business marketplace at addcoffee.co.uk.

For the purposes of the UK General Data Protection Regulation and the Data Protection Act 2018, we are the data controller for the personal information described in this policy. Our registered address is 20 Elf Row, London, England, E1W 3EH.

If you sell on our marketplace, note that you are a controller in your own right for the information you receive about your own buyers, and you are responsible for handling it lawfully.

2. What this policy covers

This policy applies to:

• the ADD Coffee website and public catalogue;
• the marketplace — buyer accounts, seller storefronts, orders, quotes, sample requests, escrow, wallets, claims and reviews;
• the ADD Coffee mobile app distributed through Google Play;
• emails, quotes and enquiries you send us, and the notifications we send you.

The mobile app is a wrapper around this same website and account system. It shows you the same pages and stores the same data — it does not collect your location, contacts, calendar, call logs or messages, and it does not read files on your device except the ones you deliberately choose to upload, such as a product photo or a payment receipt.

Our site links to third-party sites and to sellers’ own websites. We are not responsible for their privacy practices; read their policies before giving them information.

3. What we collect

Most of this comes directly from you. Some — usage and device information — is collected automatically, and payment confirmations come back to us from our payment providers.

Account

Your name, email address, password (stored only as a one-way hash — we cannot read it), phone number, role (buyer or seller), and the date you last signed in.

Business profile

Company name, business type, country, city, VAT or registration number, website, preferred incoterms, logo and profile description.

Seller verification

Trade licence, export permit and any other documents you upload so we can verify that you are a genuine exporter. These are held on private storage, are never published, and are only ever seen by our verification team.

Orders

What you ordered, quantities, prices, billing and delivery addresses, delivery contact details, tracking references, delivery confirmations, escrow choices, claims and their outcomes.

Payments

The amount, currency, method, provider reference and status. We do not receive or store your full card number. Card details are entered directly into our payment provider’s hosted fields and never reach our servers. If you pay by bank transfer, we hold the receipt you upload until the transfer is matched.

Wallet and payouts

For sellers, the ledger of what you have earned, the commission deducted, and the payout details you give us so we can pay you.

Content you publish

Product listings, images, bundles, storefront text, and reviews. This is public by design — treat it as visible to anyone.

Messages and enquiries

Quote requests, sample requests, contact-form messages and support correspondence, including anything you choose to put in them.

Technical and usage

IP address, browser and device type, pages viewed, referring page, and the time of each visit. Saved products and basket contents are kept in your own browser until you sign in or check out.

You can browse, search, order, track a delivery and confirm receipt as a guest, without creating an account. We ask for an account only where one is genuinely needed — to sell, to keep a wallet, or to see your own history across visits.

4. Why we use it, and our lawful basis

We use personal information only for the purposes below. Each has a lawful basis under the UK GDPR.

Running your order

Taking payment, telling the seller to dispatch, arranging delivery, holding and releasing escrow, handling claims and refunds. Basis: performance of a contract.

Managing your account

Signing you in, verifying your email, resetting your password, and applying your notification preferences. Basis: performance of a contract.

Verifying sellers

Checking trade licences and export permits so buyers are dealing with real exporters. Basis: legitimate interests — preventing fraud and keeping the marketplace trustworthy.

Service notifications

Order confirmations, dispatch and delivery notices, claim decisions, document decisions, payout and plan notices. These are part of the service and cannot be switched off while you hold an account. Basis: performance of a contract.

Marketing

Occasional emails about products, offers and marketplace features. You can turn these off at any time in your notification preferences or from the unsubscribe link in any such email. Basis: consent, or legitimate interests for existing business customers.

Improving the site

Understanding which pages and products are used, and diagnosing faults. Basis: legitimate interests, and consent where cookies require it.

Fraud, safety and moderation

Detecting fraudulent orders and payments, moderating listings and reviews, and enforcing our terms. Basis: legitimate interests, and legal obligation.

Accounting and tax

Keeping invoices, commission records and transaction ledgers. Basis: legal obligation.

We do not make decisions about you by automated means alone that produce legal or similarly significant effects. Seller approvals, claim outcomes and moderation decisions are made by a person.

5. Who we share it with

We share it only where it is needed to complete something you have asked for:

• The other side of your own transaction. When you place an order, the seller receives your name, delivery address, delivery phone number and what you ordered — they cannot ship without it. Sellers do not see your payment details. When you sell, the buyer sees your company name, storefront and the contact details you have published.
• Payment providers. Stripe (including Google Pay, which is settled through our Stripe account) and PayPal, to take and verify payment and to process refunds.
• Delivery and freight partners, to carry your goods and give you tracking.
• Our email provider, to deliver order confirmations and notifications.
• Analytics providers. Google Tag Manager and Google Analytics, to understand how the site is used.
• Hosting and infrastructure providers, who store the data on our behalf under contract.
• Professional advisers — accountants, auditors and lawyers — where they need it to advise us.
• Authorities, where we are legally required to disclose it, or to establish, exercise or defend legal claims.

If our business is sold or reorganised, information may transfer to the buyer; it would remain subject to a policy no less protective than this one.

6. Sending data outside the UK

We are an Ethiopian exporter with a UK company. Running the marketplace therefore involves transferring information between the United Kingdom, Ethiopia and, in the case of some of our providers, the European Economic Area and the United States.

Where we transfer personal information to a country without a UK adequacy decision, we rely on the UK International Data Transfer Agreement or the UK Addendum to the EU Standard Contractual Clauses, together with additional safeguards where they are needed. You can ask us for details of the safeguards used for any particular transfer.

7. How long we keep it

We keep personal information only as long as we need it for the purpose we collected it, or as long as the law requires.

Account records

While your account is open. When you close it, your access ends immediately and your public presence is removed; the underlying record is retained for the periods below and then deleted.

Orders, invoices and ledgers

Seven years after the end of the relevant accounting period. UK tax law requires it, and the other party to the transaction is entitled to their own records.

Seller verification documents

While you sell with us, and for up to two years afterwards, so we can show why an approval was granted.

Claims and their decisions

Six years from the decision, matching the limitation period for contract claims.

Support and enquiry emails

Two years from the last message in the thread.

Reviews

Kept and shown against the product. On closure they are detached from your name and shown anonymously, so that other buyers keep the benefit of them.

Analytics and logs

Up to 26 months, then deleted or aggregated so it no longer identifies anyone.

8. Your rights

Under UK data protection law you have the right to:

• Be told what we hold about you and why — this policy, and a fuller answer on request.
• Access a copy of your personal information.
• Correct anything inaccurate. Most of it you can fix yourself from your profile.
• Erase your information, where we have no overriding legal reason to keep it.
• Restrict or object to our processing, including any processing based on legitimate interests.
• Port your data — receive it in a structured, machine-readable format, or have it sent to another provider.
• Withdraw consent at any time, where we relied on consent. This does not affect anything done beforehand.
• Opt out of marketing at any time.

Write to addcoffeeglobal@gmail.com and we will respond within one month. There is no charge unless a request is manifestly unfounded or excessive. We may need to verify your identity first, so that we do not hand your data to somebody else.

If you are unhappy with our response you can complain to the Information Commissioner’s Office at ico.org.uk/make-a-complaint, or by calling 0303 123 1113. We would rather you came to us first so we can put it right.

9. Closing your account

You can close your ADD Coffee account yourself, at any time, from addcoffee.co.uk/delete-profile. You do not need the app installed and you do not need to contact us. You will be asked to sign in, then to confirm.

When you close your account:

• you can no longer sign in, and your password stops working;
• your seller storefront and all of your listings and bundles are taken down;
• saved products and unsent baskets are deleted;
• any subscription plan or paid promotion is cancelled so nothing renews;
• your email address is released, so you can register again later if you want to.

We keep the underlying order, invoice, commission and ledger records for the retention periods in section 7, because tax law requires it and because the other party to each transaction is entitled to their copy. We do not use them for anything else, and they are deleted when those periods expire.

We ask you to settle anything still in flight first — an order that has not been delivered, an open claim, or money sitting in your wallet — because we cannot pay a balance to a closed account or send a claim decision to someone we can no longer reach. The closure page tells you exactly what is outstanding and links you straight to it.

Closed by mistake? Email addcoffeeglobal@gmail.com within 30 days and we can restore the account.

10. Cookies and analytics

We use a small number of cookies and similar technologies:

• Strictly necessary — a session cookie that keeps you signed in, and a CSRF token that stops other sites submitting forms as you. The site cannot work without these.
• Functional — your basket and saved products, which we keep in your own browser’s local storage rather than on our servers until you check out.
• Analytics — Google Tag Manager and Google Analytics, which tell us which pages and products are used and where people give up.

You can block or delete cookies in your browser settings. Blocking the strictly necessary ones will stop you signing in or checking out. You can also opt out of Google Analytics using Google’s browser add-on.

11. How we protect it

• All traffic to and from the site is encrypted in transit with HTTPS.
• Passwords are stored as one-way hashes. Nobody at ADD Coffee can read yours, which is why a reset link is the only way to recover an account.
• Card details are entered directly into our payment provider’s hosted fields and never reach our servers.
• Verification documents are held on private storage, outside the public web root, and are served only to authenticated staff.
• Access to production data is limited to the people who need it to do their job.

No system is perfectly secure. If we ever suffer a breach that is likely to result in a risk to your rights and freedoms, we will notify the Information Commissioner’s Office within 72 hours and tell you directly where the law requires it.

12. Children

ADD Coffee is a business-to-business marketplace for wholesale and export trade. It is not intended for anyone under 18, and we do not knowingly collect information from children. If you believe a child has given us personal information, contact us and we will delete it.

13. Changes to this policy

We update this policy when what we do with data changes. The date at the top of the page always shows the current version. If a change materially affects your rights we will tell you by email or by a notice on the site before it takes effect.

14. Contact us

For anything in this policy, including a request to exercise your rights, contact our data protection contact:

• Email: addcoffeeglobal@gmail.com
• Phone: +44 7859 154032
• Post: ADD Coffee, Automotive & Agriculture Ltd, 20 Elf Row, London, England, E1W 3EH

You are also welcome to use our contact form — mark your message “Privacy” so it reaches the right person.