1. Welcome to H’ARTISAN’s Privacy Policy

H’ARTISAN Wargrave Limited is the operator of the website https://www.hartisanfriends.co.uk

We take your privacy very seriously. Please read this privacy policy carefully as it contains important information on who we are and how and why we collect, store, use and share your personal data. It also explains your rights in relation to your personal data and how to contact us or supervisory authorities in the event you have a complaint.

We collect, use and are responsible for certain personal data about you. When we do so we are subject to the UK General Data Protection Regulation (UK GDPR).

2. Key terms

It would be helpful to start by explaining some key terms used in this policy:

We, us, our	H’ARTISAN Wargrave Limited
Personal data	Any information relating to an identified or identifiable individual
Special category personal data	Personal data revealing racial or ethnic origin, political opinions, religious beliefs, philosophical beliefs or trade union membership Genetic data Biometric data (where used for identification purposes) Data concerning health, sex life or sexual orientation
Data subject	The individual who the personal data relates to

3. Personal data we collect about you

When you visit our website or use our services (i.e connect to our Customer Relationship Management Platform (CRM), in our cafe), we will collect certain personal data about you which may include your name and contact information.

4. Information we collect about you via technology

To make our website more useful to you, our servers (which are hosted by a third party service provider) collect information from you, including your browser type, operating system, Internet Protocol (“IP”) address (a number that is automatically assigned to your computer when you use the Internet, which may vary from session to session), domain name, and/or a date/time stamp for your visit.

We also collect information via cookies. Please see the ‘cookies’ paragraph below for more information.

5. How your personal data is collected

We may collect personal data directly from you in our café, or by telephone, text or email and/or via our website. However, we may also collect information:

from cookies on our website—for more information on our use of cookies, please see more information about cookies below.

6. How and why we use your personal data

Under data protection law, we can only use your personal data if we have a proper reason, eg:

where you have given consent;
to comply with our legal and regulatory obligations;
for the performance of a contract with you or to take steps at your request before entering into a contract; or
for our legitimate interests or those of a third party.

A legitimate interest is when we have a business or commercial reason to use your personal data, so long as this is not overridden by your own rights and interests. We will carry out an assessment when relying on legitimate interests, to balance our interests against your own.

The table below explains what we use your personal data for and why.

What we use your personal data for	Our reasons
Making our website available to you	To enable you to contact us via the website and deal with your query and respond to you.
Preventing and detecting fraud against you or us	For our legitimate interest, ie to minimise fraud that could be damaging for you and/or us
To enforce legal rights or defend or undertake legal proceedings	Depending on the circumstances: —to comply with our legal and regulatory obligations; —in other cases, for our legitimate interests, ie to protect our business, interests and rights
Ensuring business policies are adhered to, eg policies covering security and internet use	For our legitimate interests, ie to make sure we are following our own internal procedures so we can deliver the best service to you
Statistical analysis to help us manage our business, eg in relation to our customer base	For our legitimate interests, ie to be as efficient as we can so we can deliver the best service to you at the best price
Preventing unauthorised access and modifications to systems	Depending on the circumstances: —for our legitimate interests, ie to prevent and detect criminal activity that could be damaging for you and/or us; —to comply with our legal and regulatory obligations
Protecting the security of systems and data used to provide the services	To comply with our legal and regulatory obligations We may also use your personal data to ensure the security of systems and data to a standard that goes beyond our legal obligations, and in those cases our reasons are for our legitimate interests, ie to protect systems and data and to prevent and detect criminal activity that could be damaging for you and/or us
Updating customer records	Depending on the circumstances: —to perform our contract with you or to take steps at your request before entering into a contract; —to comply with our legal and regulatory obligations; —for our legitimate interests, eg making sure that we can keep in touch with our customers about our services
Marketing our services to: —existing and former customers; —third parties who have previously expressed an interest in our services; —third parties with whom we have had no previous dealings.	For our legitimate interests, ie to promote our business to existing and former customers

How and why we use your personal data—in more detail

More details about how we use your personal data and why are set out in the table below.

Purpose	Processing operation	Lawful basis relied on under the UK GDPR	Relevant categories of personal data
Communications with you not related to marketing, including about changes to our terms or policies or changes to the products or other important notices (other than those addressed above)	Addressing and sending communications to you about changes to our terms or policies or changes to the services or other important notices	Processing is necessary for compliance with a legal obligation to which we are subject (Article 6(1)(b)) Our legitimate interests (Article 6(1)(f)), which is to be as efficient as we can so we can deliver the best service to you	—your name, address and contact information, including email address and telephone number and company details if —your account details (use—your name, address and contact information.
Enable you to access wifi and our Customer Relationship Management Platform (CRM) provided by Airship	Providing you with free access to wifi in our café and our CRM.	Our legitimate interests (Article 6(1)(f)), which is to be as efficient as we can so we can deliver the best service to you in our café.	You will be asked to input at a minimum your name, email address and certain other personal data, e.g DOB
To update you with news and information about our business.	Send you newsletters	We will only do this with your consent.	Names, email addresses.

8. Marketing

We will use your personal data to send you updates (by email, text message, telephone or post) about our services, including exclusive offers and promotions.

We have a legitimate interest in using your personal data for marketing purposes (see above ‘How and why we use your personal data’). This means we do not usually need your consent to send you marketing information except in the case of our newsletter. If you choose to subscribe for our newsletter, we rely on your consent as the basis for sending you these.

You have the right to opt out of receiving marketing communications at any time by:

contacting us at info@hartisanfriends.co.uk or
using the ‘unsubscribe’ link in emails or ‘STOP’ number in texts (if we send you text messages).

We may ask you to confirm or update your marketing preferences if you ask us to provide further services in the future, or if there are changes in the law, regulation, or the structure of our business.

We will always treat your personal data with the utmost respect and never share it with other organisations for marketing purposes.

9. Who we share your personal data with

We routinely share personal data with:

other third parties we use to help us run our business and help to deliver our services to you, eg payment providers, marketing agencies, website hosts, wifi providers and our CRM and email marketing provider;

We or the third parties mentioned above occasionally also share personal data with:

our and their external auditors, eg in relation to the audit of our or their accounts, in which case the recipient of the information will be bound by confidentiality obligations;
our and their professional advisors (such as lawyers and other advisors), in which case the recipient of the information will be bound by confidentiality obligations;
law enforcement agencies, courts, tribunals and regulatory bodies to comply with our legal obligations

10. How long your personal data will be kept

We will only keep your personal data for as long as we need it.

When we decide how long we need to keep your personal data for, we take into account the amount, nature, and sensitivity of the personal data, the potential risk of harm from unauthorised use or disclosure of your personal data, the purposes we use your personal data for and whether we can achieve those purposes another way, and applicable legal requirements.

We may also keep your personal data for legal or technical reasons and also fraud prevention.

11. Transferring your personal data out of the UK

Your personal data may be transferred to a country outside of the UK if we use third party payment providers for example who are located outside of the UK. If we do transfer personal data outside of the UK, we will only transfer it to countries that are subject to an adequacy decision issued by the European Commission, or where the entity is bound by an appropriate personal information transfer agreement as deemed adequate by the European Commission, known as the Standard Contractual Clauses.

12. Your rights

You have the following rights, which you can exercise free of charge:

Access	The right to be provided with a copy of your personal data
Rectification	The right to require us to correct any mistakes in your personal data
Erasure (also known as the right to be forgotten)	The right to require us to delete your personal data—in certain situations
Restriction of processing	The right to require us to restrict processing of your personal data in certain circumstances, eg if you contest the accuracy of the data
Data portability	The right to receive the personal data you provided to us, in a structured, commonly used and machine-readable format and/or transmit that data to a third party—in certain situations
To object	The right to object: —at any time to your personal data being processed for direct marketing (including profiling); —in certain other situations to our continued processing of your personal data, eg processing carried out for the purpose of our legitimate interests unless there are compelling legitimate grounds for the processing to continue or the processing is required for the establishment, exercise or defence of legal claims
Not to be subject to automated individual decision making	The right not to be subject to a decision based solely on automated processing (including profiling) that produces legal effects concerning you or similarly significantly affects you
The right to withdraw consents	If you have provided us with a consent to use your personal data you have a right to withdraw that consent easily at any time Withdrawing a consent will not affect the lawfulness of our use of your personal data in reliance on that consent before it was withdrawn

For more information on each of those rights, including the circumstances in which they apply, please contact us (see ‘How to contact us’ below) or see the Guidance from the UK Information Commissioner’s Office (ICO) on individuals’ rights.

If you would like to exercise any of those rights, please email, call or write to us—see below: ‘How to contact us’ and provide enough information to identify yourself (eg your full name and address) and also please let us know what right you want to exercise and the information to which your request relates.

13. Keeping your personal data secure

We have appropriate security measures to prevent personal data from being accidentally lost, or used or accessed unlawfully. We limit access to your personal data to those who have a genuine business need to access it. Those processing your personal data will do so only in an authorised manner and are subject to a duty of confidentiality.

We also have procedures to deal with any suspected data security breach. We will notify you and any applicable regulator of a suspected data security breach where we are legally required to do so.

14. How to complain

Please contact us if you have any queries or concerns about our use of your personal data (see below ‘How to contact us’). We hope we will be able to resolve any issues you may have.

You also have the right to lodge a complaint with the Information Commissioner. The Information Commissioner may be contacted using the details at https://ico.org.uk/make-a-complaint or by telephone: 0303 123 1113.

15. Changes to this privacy policy

This privacy policy was published on 25^th July 2023 and last updated on 21^st July 2023.

We may change this privacy policy from time to time—when we do we will inform you via our website or e-mail depending on the nature of the change.

16. How to contact us

You can contact us by email at info@hartisanfriends.co.uk if you have any questions about this privacy policy or the information we hold about you, to exercise a right under data protection law or to make a complaint.

Cookies

Our website uses cookies to distinguish you from other users of our website. This helps us to provide you with a good experience when you browse our website and also allows us to improve our site.

What is a cookie?

A cookie is a small file of letters and numbers that we store on your browser or the hard drive of your computer if you agree. Cookies contain information that is transferred to your computer’s hard drive.

The information contained in the cookies serves session control, in particular improving navigation and enabling a high degree of user-friendliness of a website. The cookies we use do not store personal information. Most web browsers automatically accept cookies. You can avoid this by changing the settings of your browser. You can remove cookies stored on your computer at any time by deleting temporary Internet files (browser bar “Tools-Internet Options”).

Deactivating cookies may result in you not being able to use all the features of our portal.

Here is also the guide for deleting cookies for Internet Explorer https://support.microsoft.com and Mozilla https://support.mozilla.org

We use the following cookies:

Strictly necessary cookies. These are cookies that are required for the operation of our website. They include, for example, cookies that enable you to log into secure areas of our website, use a shopping cart or make use of e-billing services.
Analytical or performance cookies. These allow us to recognise and count the number of visitors and to see how visitors move around our website when they are using it. This helps us to improve the way our website works, for example, by ensuring that users are finding what they are looking for easily.
Functionality cookies. These are used to recognise you when you return to our website. This enables us to personalise our content for you, greet you by name and remember your preferences (for example, your choice of language or region).
Targeting cookies. These cookies record your visit to our website, the pages you have visited and the links you have followed. We will use this information to make our website and the advertising displayed on it more relevant to your interests. We may also share this information with third parties for this purpose.

You can find more information about the individual cookies we use and the purposes for which we use them below:

Google advertising cookies: our website uses Google advertising cookie to enable Google partners to serve ads to you based on your visit to certain sites on the internet. You may opt out at any time by visiting https://myadcenter.google.com/personalizationoff?sasb=true&ref=ad-settings
Facebook Plug-Ins. Our websites include plugins from the social network Facebook, 1601 South California Avenue, Palo Alto, CA 94304, USA. The Facebook plug-ins can be identified by the Facebook logo or the Like button or Share button on our website. An overview of Facebook plug-ins can be found here: http://developers.facebook.com/docs/plugins/. When you visit our website, the plug-in establishes a direct connection between your browser and the Facebook server. The content of the plug-in is transmitted directly from Facebook to your browser and integrated into the website. Facebook thereby receives the information that you have visited our site with your IP address, even if you do not have a Facebook account or are not currently logged in to Facebook. This information (including your IP address) is transmitted from your browser directly to a Facebook server in the USA and stored there. If you click the Facebook “Like” button while you are logged into your Facebook account, you can link the contents of our website to your Facebook profile. This allows Facebook to associate the visit to our website with your user account. The information about your interaction is also transmitted directly to a Facebook server and stored there. The information is also published on Facebook and displayed to your Facebook friends. We would like to point out that as the provider of the website, we have no knowledge of the content of the transmitted data or its use by Facebook. Facebook can use this information for the purposes of advertising, market research, and the customised design of Facebook pages. For this purpose, usage, interests and relationship profiles are created by Facebook, e.g. to evaluate your use of our website with regard to the ads displayed to you on Facebook, to inform other Facebook users about your activities on our website, and to provide other services associated with the use of Facebook. For more information, please see Facebook’s privacy policy at https://www.facebook.com/about/privacy/. If you do not want Facebook to associate the visit to our website with your Facebook user account, please log out of your Facebook user account before using our website.
Our websites include plug-ins from the social network LinkedIn, provided by LinkedIn Corporation, 2029 Stierlin Court, Mountain View, CA 94043, USA (“LinkedIn”). You can recognise LinkedIn plug-ins by the LinkedIn logo or the “Recommend” button on our website. When you visit our websites, the plug-in establishes a direct connection between your browser and the LinkedIn server. LinkedIn then receives information that you have visited our site with your IP address. If you click on the LinkedIn “Recommend” button while logged into your LinkedIn account, you can link the content of our pages to your LinkedIn profile. This allows LinkedIn to associate the visit to our website with your user account. Please note that we as the provider of the pages have no knowledge of the content of the transmitted data or its use by LinkedIn. You can find details on data collection (purpose, scope, further processing, use), as well as your rights and setting options in the LinkedIn privacy policy. You can find this information at: http://www.linkedin.com/legal/privacy-policy.
Our website includes at least one plug-in from YouTube, which is owned by Google Inc., located at LLC 901 Cherry Ave, San Bruno, CA 94066, USA. When you visit a page on our website that contains a YouTube plug-in, a connection is established with the servers of YouTube. This informs the YouTube server that our website has been visited by you. If you are also logged into your YouTube account, you would allow YouTube to directly associate your surfing behaviour with your personal profile. You can prevent this association by logging out of your account before visiting our website. For further information on the collection and use of your data by YouTube, please refer to the privacy policy available at http://www.youtube.com/t/privacy.
Google Adsense. These websites may use Google AdSense, a service for embedding advertising from Google Inc. (“Google”). Google AdSense uses so-called “cookies”. Google AdSense also uses so-called web beacons (invisible graphics). Through these web beacons, information such as visitor traffic on the pages of this offer can be evaluated. The information generated by cookies and web beacons about the use of this website (including the IP address of the users) and the delivery of advertising formats is transmitted to a Google server in the USA and stored there. This information may be passed on by Google to contractual partners of Google. However, Google will not merge your IP address with other data stored by you.Users can prevent the installation of cookies by adjusting their browser software accordingly. However, the provider points out to users that in this case they may not be able to use all functions of this offer to their full extent. By using this website, users agree to the processing of the data collected about them by Google in the manner and for the purpose described above.
On our websites, we use social plugins from the social network Pinterest, which is operated by Pinterest Inc., 635 High Street, Palo Alto, CA, 94301, USA (“Pinterest”). The plugins can be recognised by the “Pin it” button on our site. If you access a page on our website that contains such a plugin, your browser will establish a direct connection to Pinterest’s servers. The plugin content is transmitted directly from Pinterest to your browser and integrated into the page. This integration informs Pinterest that your browser has accessed the relevant page of our website, even if you do not have a Pinterest profile or are currently not logged in to Pinterest. This information (including your IP address) is transmitted from your browser directly to a Pinterest server in the USA and stored there. If you are logged in to Pinterest, Pinterest can directly associate your visit to our website with your Pinterest account. When you interact with the plugins, such as clicking the “Pin it” button, this information is also transmitted directly to a Pinterest server and stored there. The information is also published on your Pinterest account and displayed to your contacts. For the purpose and scope of data collection and the further processing and use of the data by Pinterest, as well as your rights in this regard and settings options for protecting your privacy, please refer to Pinterest’s privacy policy: https://policy.pinterest.com/de/privacy-policy
Google+. Our websites use social plugins (“plugins”) from the social network Google+, which is operated by Google Inc., 1600 Amphitheatre Parkway, Mountain View, CA 94043, USA (“Google”). The plugins can be recognised by buttons with the sign “+1” on a white or coloured background. An overview of the Google plugins and their appearance can be found here: https://developers.google.com/+/plugins. When you access a page of our website that contains such a plugin, your browser establishes a direct connection to Google’s servers. The content of the plugin is transmitted by Google directly to your browser and integrated into the page. By integrating it, Google receives information that your browser has accessed the corresponding page of our website, even if you do not have a Google+ profile or are currently not logged in to Google+. This information (including your IP address) is transmitted directly from your browser to a Google server in the USA and stored there. If you are logged in to Google+, Google can directly associate your visit to our website with your Google+ profile. If you interact with the plugins, for example by clicking the “+1” button, the corresponding information is also transmitted directly to a Google server and stored there. The information is also published on Google+ and displayed to your contacts there. For the purpose and scope of data collection and the further processing and use of data by Google, as well as your related rights and privacy protection settings, please refer to Google’s privacy policy: http://www.google.com/intl/de/+/policy/+1button.html. If you do not want Google to directly associate the data collected through our website with your Google+ profile, you must log out of Google+ before visiting our website. You can also completely prevent the loading of Google plugins with add-ons for your browser, such as the script blocker “NoScript” (http://noscript.net/).
Our websites use social plugins from Instagram, which is operated by Instagram LLC, 1601 Willow Road, Menlo Park, CA 94025, USA (“Instagram”). The plugins are marked with an Instagram logo, such as an “Instagram camera.” An overview of the Instagram plugins and their appearance can be found here: http://blog.instagram.com/post/36222022872/introducing-instagram-badges. When you access a page of our website that contains such a plugin, your browser establishes a direct connection to Instagram’s servers. The content of the plugin is transmitted by Instagram directly to your browser and integrated into the page. By integrating it, Instagram receives the information that your browser has accessed the corresponding page of our website, even if you do not have an Instagram profile or are not currently logged into Instagram. This information (including your IP address) is transmitted by your browser directly to an Instagram server in the USA and stored there. If you are logged into Instagram, Instagram can immediately associate your visit to our website with your Instagram account. If you interact with the plugins, for example by clicking the “Instagram” button, this information is also transmitted directly to an Instagram server and stored there. The information is also published on your Instagram account and displayed to your contacts. For the purpose and scope of data collection, as well as the further processing and use of data by Instagram, and your related rights and privacy settings, please refer to Instagram’s privacy policy: https://help.instagram.com/155833707900388/. If you do not want Instagram to directly associate the data collected from our website with your Instagram account, you must log out of Instagram before visiting our website. You can also completely prevent the loading of Instagram plugins with add-ons for your browser, such as the script blocker “NoScript” (http://noscript.net/).
Google Analytics. This website uses Google Analytics, a web analysis service provided by Google Inc. (“Google”). Google Analytics uses so-called “cookies”. The information generated by the cookie about your use of this website (including your IP address, browser type/version, operating system, referrer URL of the previously visited website, and time of the server request) is usually transferred to a Google server in the USA and stored there. If IP anonymization is activated on our website, your IP address will be truncated by Google within member states of the European Union or in other states party to the Agreement on the European Economic Area before being transmitted. In exceptional cases, the full IP address may be transferred to a Google server in the USA and truncated there. Google will use this information to evaluate your use of the website, to compile reports on website activity for website operators, and to provide other services related to website activity and internet usage. Google may also transfer this information to third parties if required by law or if third parties process this data on behalf of Google. The IP address transmitted by your browser as part of Google Analytics is not merged with other data from Google. You can prevent the installation of cookies by adjusting the settings of your browser software accordingly. However, please note that in this case, you may not be able to use all functions of this website to their full extent. By using this website, you consent to the processing of data about you by Google in the manner and for the purposes set out above. Further information on the web analysis service used can be found on the website of Google Analytics. Instructions on how to prevent the processing of your data by the web analysis service can be found at http://tools.google.com
These websites use so-called social plugins from TikTok, which is operated by TikTok Technology Limited, 10 Earlsfort Terrace, Dublin, D02 T380, Ireland. The plugins are marked with a TikTok logo. When you access a page on our website that contains such a plugin, your browser establishes a direct connection to TikTok’s servers. The content of the plugin is transmitted directly from TikTok to your browser and integrated into the page. Through this integration, TikTok receives information that your browser has accessed the corresponding page of our website, even if you do not have a TikTok profile or are not currently logged in to TikTok. This information (including your IP address) is transmitted from your browser directly to a TikTok server and stored there. If you are logged in to TikTok, TikTok can directly associate your visit to our website with your TikTok account. If you interact with the plugins, this information is also transmitted directly to a TikTok server and stored there. The information is also published on your TikTok account and displayed to your contacts. For the purpose and scope of data collection and further processing and use of data by TikTok, as well as your rights and privacy settings, please refer to TikTok’s privacy policy (https://www.tiktok.com/legal/privacy-policy If you do not want TikTok to directly associate the data collected about our website with your TikTok account, you must log out of TikTok before visiting our website. You can also completely prevent the loading of TikTok plugins with add-ons for your browser, such as the script blocker “NoScript” (http://noscript.net/).
Facebook Remarketing. Remarketing tags of the social network Facebook, 1601 South California Avenue, Palo Alto, CA 94304, USA are integrated on our pages. When you visit our pages, a direct connection is established between your browser and the Facebook server via the remarketing tags. Facebook thereby receives the information that you have visited our site with your IP address. This enables Facebook to assign the visit to our pages to your user account. We would like to point out that we, as the provider of the pages, have no knowledge of the content of the transmitted data or its use by Facebook. For more information, please see Facebook’s privacy policy at https://www.facebook.com/about/privacy/.
If you use the comment function on our website, the time of creation, your chosen pseudonym, and temporarily your IP address will be stored alongside your comments. This is done so that we can protect our rights in case of illegal content.