Privacy Policy

PRIVACY AND COOKIES POLICY

Coffee-Direct.co.uk and Tea-Direct.co.uk

Operated by Red Spider Direct Limited

1. Who we are and what this policy covers

Red Spider Direct Limited ("Red Spider Direct", "we", "us" or "our") operates Coffee-Direct.co.uk and Tea-Direct.co.uk. Red Spider Direct is the controller of personal data described in this policy.

This policy explains how we collect and use personal data when you visit either website, place an order, create or use an account, contact us, use our sales or customer service channels, respond to a promotion or survey, or otherwise deal with us.

Company number: 06797531 (registered in England and Wales)

VAT number: 944613517

Postal contact: Red Spider Direct Limited, PO Box 433, Lymington, SO41 1EH

Privacy contact: support@coffee-direct.co.uk or support@tea-direct.co.uk

Data Protection Officer

Red Spider Direct Limited, PO Box 433, Lymington, Hampshire, SO41 1EH

Email: support@coffee-direct.co.uk or support@tea-direct.co.uk

Our websites may link to other organisations' websites. Their privacy and cookie policies apply to their services, and we are not responsible for their data practices.

2. Personal data we collect

Depending on how you use our services, we may collect:

  • Identity and contact details, such as your name, title, delivery and billing addresses, email address and telephone number.
  • Account details, such as your username and password. Passwords should be stored securely and are not available to us in readable form.
  • Order and transaction details, including products bought, delivery and return information, payment status and customer service history. Payment card details are handled by our payment provider; we do not intend to store full card security details.
  • Communications with us, including emails, messages, social media communications and information you choose to give us during calls or chats.
  • Audio recordings and written transcripts of conversations with our AI-assisted sales or customer service agent, and related interaction details such as date, time, channel and the enquiry or outcome. See section 4.
  • Website and device information, such as IP address, browser and device details, pages viewed, referral information, cookie identifiers and interactions with our adverts, subject to your cookie choices and applicable law.
  • Marketing preferences, consent records, survey answers, competition entries and feedback.
  • Information from other sources, such as delivery or fulfilment partners, payment and fraud-prevention providers, advertising and analytics platforms, publicly available sources, or retailers and suppliers involved in an order. We use such information where appropriate to fulfil an order, keep our records accurate, prevent fraud or measure marketing.

Please do not provide sensitive personal information in a conversation unless it is necessary for your enquiry. If you do provide it, we will handle it in accordance with data protection law and only for an appropriate purpose.

3. Why we use personal data and our legal grounds

We use personal data for the purposes below. The legal ground depends on the particular activity and circumstances.

  • Orders, accounts, delivery, payment, returns and refunds: to take steps at your request before a contract and to perform our contract with you; and, where required, to meet legal obligations such as accounting and tax rules.
  • Customer enquiries and support: to respond to you, administer your account or order, and provide support under our contract where relevant. We may also rely on our legitimate interests in running our business and resolving customer issues.
  • AI-assisted sales and customer service: to respond to enquiries and provide product assistance; to maintain conversation records; to review service quality; to investigate complaints; and to allow our staff to manually improve the AI agent based on conversations. For staff review and manual improvement, we rely on our legitimate interests in operating and improving the service. We rely on taking steps at your request or performing a contract where relevant to handling your enquiry or order.
  • Website operation, security, fraud prevention and troubleshooting: our legitimate interests in providing a secure, reliable service and protecting our business and customers, and, where applicable, our legal obligations.
  • Product and service development, internal analysis and service quality: our legitimate interests in understanding how our services are used and improving them. We use aggregated or de-identified information where reasonably possible.
  • Marketing by email, text or other electronic message: consent where required by law, or the limited existing-customer "soft opt-in" where its legal conditions are met. We will identify ourselves and provide a simple way to opt out. You can change your marketing preferences at any time. A marketing opt-out does not affect service messages about an order or account.
  • Website analytics and advertising: consent for non-essential cookies and similar technologies where required by law; and the relevant data protection ground for any personal data processed through those technologies. See section 7.
  • Legal claims, regulatory requests and business transfers: our legitimate interests in establishing, exercising or defending legal claims, or complying with a legal obligation. If our business or a part of it is sold or transferred, data may be shared as part of that transaction subject to appropriate safeguards.

Where we rely on consent, you can withdraw it at any time. Withdrawal does not affect processing already carried out lawfully. Where we rely on legitimate interests, you can object as described in section 8.

4. AI-assisted sales and customer service conversations

We use an AI agent to help with sales and customer service through online voice chat. It uses only the information you provide in the chat to answer questions, suggest products, assist with sales and help resolve service enquiries. It does not access your account or order records.

Every online voice chat is recorded and transcribed, and the audio recording and transcript are stored. Recording is required to use the voice chat. If you do not want to use a recorded voice chat, you can contact us by email at support@coffee-direct.co.uk or support@tea-direct.co.uk . These addresses handle all enquiries. We use these records to handle your enquiry, review service quality, investigate complaints or disputes, and protect against misuse. Our staff may review a sample of conversations or review a particular conversation when the case calls for it, and use what they learn to improve the AI agent. This is a staff-led manual review process; the AI does not automatically learn from conversations. Access is restricted to people and providers who need it for these purposes.

The AI agent can make mistakes. This online voice chat does not offer a live human handoff. You can contact our team at support@coffee-direct.co.uk or support@tea-direct.co.uk .

We do not use the AI agent to make decisions solely by automated processing that produce legal or similarly significant effects about you. If this changes, we will update this policy and provide any additional information and safeguards required by law.

The AI agent was built internally by Red Spider Direct Limited. OpenAI processes customer speech, generates transcripts and AI responses, and stores voice recordings.

TypeSafe (Jev) interprets and routes requests using relevant conversation text. Vercel, Neon and Upstash provide hosting and process or store conversation records and temporary session information.

We use Twilio for AI-assisted telephone support and support texts, including photo-upload links; it processes your telephone number, call content and messages. Calls are transcribed and analysed so our team can review enquiries and improve service, and the telephone assistant can use the order number and postcode you provide to look up your order.

When the avatar is used, Anam animates the assistant from its spoken responses. Anam does not receive the customer's microphone audio directly, and recording and transcript storage are disabled in our Anam configuration. However, the assistant's spoken response may repeat information you provided, so that information may be processed by Anam.

Voice recordings stored by OpenAI expire after 30 days. Transcripts in our control panel become inaccessible after 30 days and are automatically deleted by the next daily cleanup. These periods apply to our stated systems; external providers may retain records, logs, backups or subprocessor copies under their own retention rules, so we cannot promise that every copy is deleted within 30 days. We retain particular information longer where needed to deal with an ongoing issue, meet a legal obligation or establish, exercise or defend a legal claim.

5. Who we share personal data with

We share only the information reasonably needed for the relevant purpose, with:

  • Service providers, including website, ecommerce, hosting, AI, voice, customer support, payment and fraud-prevention providers. Our AI and voice providers are described in section 4.
  • Delivery, fulfilment and retail partners where they need details to deliver products or provide a service connected with your order.
  • Analytics, advertising and embedded-media services. Both websites use Google Analytics and Shopify Analytics for website analytics, Meta/Facebook and Microsoft/Bing for advertising and measurement, and YouTube for embedded video. Depending on the feature and your cookie choices, these services may receive device identifiers and information about your activity for analytics, advertising, campaign measurement or embedded video. Meta tracking runs only after you accept advertising cookies through CookieYes.
  • Professional advisers, insurers, auditors, regulators, law enforcement or courts where needed for advice, legal obligations, legal claims or the prevention or detection of crime.
  • A purchaser or successor if we sell or transfer all or part of our business.

Our service providers must protect personal data and may process it only as permitted by our instructions and applicable law, unless they act as a separate controller for a specific service. Some providers may have their own responsibilities under their privacy notices.

6. International transfers

Some of our service providers and their subprocessors may process personal data outside the United Kingdom, including in the United States and other countries where they operate. Where a transfer is restricted under UK data protection law, we rely on UK adequacy regulations or appropriate safeguards, such as the UK International Data Transfer Agreement or the UK Addendum to the EU Standard Contractual Clauses, as applicable. You can ask us for information about the relevant safeguards or a copy using the contact details in section 1.

7. Cookies and similar technologies

Our websites use cookies and similar technologies, including pixels, tags and scripts, to operate the sites, remember preferences, understand site performance and, where enabled, measure or personalise advertising.

Strictly necessary technologies are used to provide a service you request, such as keeping a basket or maintaining site security. We ask for your consent before using non-essential analytics or advertising cookies and similar technologies where required by law. We use CookieYes to manage cookie choices. The Cookie Settings link at the bottom of every page lets you review cookie categories and change or withdraw your choices. You can also manage cookies in your browser, though blocking necessary cookies may affect site functions.

8. Your data protection rights

Depending on the circumstances and the applicable legal conditions, you may have the right to:

  • ask for a copy of your personal data;
  • ask us to correct inaccurate or incomplete data;
  • ask us to erase data;
  • ask us to restrict how we use data;
  • object to processing based on our legitimate interests, including profiling related to those interests;
  • object at any time to the use of your personal data for direct marketing;
  • receive certain data you provided in a portable format, or ask us to transmit it to another organisation where the right applies; and
  • withdraw consent where processing is based on consent.

These rights are subject to legal conditions and exemptions. To exercise a right, contact us using the details in section 1 and tell us what you need. We may ask for information reasonably needed to verify your identity. We normally respond within one month; the law allows an extension in certain complex or multiple-request cases, and we will explain if that applies. We do not normally charge a fee. A reasonable fee or refusal is permitted only in limited cases, such as a manifestly unfounded or excessive request or a request for further copies.

You may complain to the Information Commission (the UK data protection regulator, which continues to use the ICO name and website): Information Commissioner's Office, Wycliffe House, Water Lane, Wilmslow, Cheshire, SK9 5AF; website: ico.org.uk . We would appreciate the opportunity to address your concern first.

9. How long we keep personal data

We keep personal data only for as long as reasonably needed for the purpose for which it was collected, including to provide services, maintain accurate business and tax records, handle complaints, prevent fraud and deal with legal claims. We then securely delete it or anonymise it, unless the law requires or permits longer retention.

Our usual retention periods and criteria are:

  • Order and accounting records: six years from the end of the relevant company financial year, or longer where legally required or needed for a tax enquiry.
  • Customer account profiles: while the account is in use or until you request deletion, subject to legal requirements. We may retain transaction records as needed for accounting, tax or legal purposes.
  • Routine support enquiries: two years after resolution. Records about a complaint, dispute or legal claim are kept while needed to resolve it and, where justified, for the applicable claim period.
  • AI voice recordings stored by OpenAI: 30 days. Transcripts in our control panel become inaccessible after 30 days and are automatically deleted by the next daily cleanup. Provider logs, backups and records may be subject to separate retention rules, as explained in section 4.
  • Marketing preferences: while relevant to your choices. We keep unsubscribe records to ensure you are not added to marketing lists again, unless you request full deletion.
  • Website analytics and advertising data: Google Analytics user-level and event-level data is retained for 14 months. Other analytics and advertising data is retained for the periods set by the relevant provider and, where applicable, the cookie duration shown in Cookie Settings.

10. Security

We use appropriate technical and organisational measures designed to protect personal data, such as access controls and security safeguards for systems and communications. Access is limited to people who need it for their work. No method of transmission or storage is completely secure, but we work to protect the information we hold and respond to suspected personal data breaches as required by law.

11. Children

Our services are intended for adults making purchases. We do not knowingly seek to collect personal data from children for marketing. If you believe a child has provided us with personal data, contact us so we can review and, where appropriate, delete it.

12. Changes to this policy

We may update this policy when our services, technology or legal obligations change. The latest version will be posted on Coffee-Direct.co.uk and Tea-Direct.co.uk with its effective date. If a change materially affects how we use personal data, we will take reasonable steps to bring it to your attention.

Effective date: 29 October 2026