Privacy Policy

1. What this notice covers

This Privacy Policy explains how may handle personal information in connection with this public-facing, informational café website. We aim to be transparent about the limited functions actually present: visitors can read our café story, view menus and photographs, explore the gallery, and find our contact details. The published website has no visitor accounts, payment checkout, booking engine, enquiry submission form, advertising tags or third-party analytics scripts.

This notice addresses the UK General Data Protection Regulation (UK GDPR), the Data Protection Act 2018 and, where applicable, rules governing electronic communications. Depending on circumstances, visitors from the European Economic Area may also have rights under the EU GDPR.

2. Data controller and how to reach us

The website operator and point of contact for privacy enquiries is . Business correspondence address: . Email: info@purethaliqorena.com. We have not published a separate data protection officer because this website does not indicate that one is legally required.

Please identify the nature of your enquiry, but do not include unnecessary sensitive details in an initial message. We may ask you to provide reasonable evidence of identity before sharing personal information in response to a rights request.

3. Information that may be processed

Merely viewing these static pages does not ask you to provide a name, email address, telephone number, password, payment card or other account details. Like most hosted websites, however, the web server or hosting company may technically receive a browser request containing an IP address, date and time, the requested file, a user-agent string and basic connection or error information. Whether and for how long such logs are retained depends on the actual hosting configuration.

If you choose to contact us outside this website by sending an email or telephoning the business, we may receive your name, contact details, the contents of your message and anything you voluntarily provide. The site itself does not automatically submit such a message.

4. Why information is used and lawful bases

Where technical request records are needed to make the website available, detect abuse, maintain security or investigate faults, the lawful basis is generally our legitimate interests under Article 6(1)(f) UK GDPR in providing a secure, reliable service, balanced against your rights. Hosting that is strictly necessary to deliver a page may also be part of steps requested by the visitor.

Where you independently send us a direct enquiry, we process its contents to reply and, where applicable, to take steps requested before a possible service arrangement under Article 6(1)(b), or on our legitimate interests under Article 6(1)(f). When law requires retention or disclosure, Article 6(1)(c) may apply. We do not rely on implied consent for optional analytics or advertising, because such features are not present.

5. Site functionality and browser-side processing

The site's fonts, stylesheets, JavaScript, photos and icons are served from the same website rather than external content-delivery networks. Its small local script controls the mobile navigation, makes an existing photo strip easier to scroll, and loads publicly displayed company details from a local project resource. These functions do not create user accounts or send visitor information to an external analytics service.

The mobile navigation state lasts only while the page is open; the script does not need to retain it between visits. The site's current frontend does not write visitor identifiers to cookies, local storage or session storage.

6. Cookies, tracking and consent

The static frontend supplied with this website does not set analytics, marketing, personalisation or social-media cookies, and it does not deploy tracking pixels. Consequently, no optional tracking is activated and an opt-in banner is not required for these absent features. Standard browser and hosting behaviour may differ if the site is later deployed behind a platform that adds functionality.

See our Cookie Policy for details, including how to review the cookies visible in your browser. If we introduce non-essential technology, we will first provide the appropriate notice and a genuine choice where required by UK PECR and relevant law.

7. Hosting and service providers

The current site is packaged as static files and can be served from a local or conventional web server. No particular external hosting provider, payment processor, analytics provider, CRM or AI service is configured in the delivered frontend. On publication, the chosen hosting provider may handle requests and infrastructure logs on the operator's behalf under its actual terms and security arrangements.

We only ask service providers to access information where reasonably necessary and, where required, use an appropriate data processing agreement. Details of any host-specific processing should be updated when the production hosting environment is confirmed.

8. Sharing and disclosures

We do not use this website to sell personal information or exchange visitor profiles with advertising networks. Information received through direct correspondence may be accessed by authorised staff who need it to respond. It may be shared with relevant advisers or authorities where legally required, or with a technical supplier assisting with website security under suitable safeguards.

We do not publish email enquiries or make contact details available publicly merely because someone writes to us. We will assess requests for disclosure against applicable law.

9. International data transfers

The static frontend does not deliberately send visitor data to a third-party API located abroad. Nevertheless, the geographic processing location of infrastructure logs and independent email services depends on the hosting and communication services used after deployment. If personal data is transferred outside the UK in circumstances requiring safeguards, we will use an applicable adequacy regulation, the UK International Data Transfer Agreement, the UK Addendum to EU Standard Contractual Clauses or another lawful mechanism.

Any EU GDPR transfer obligations will also be assessed where relevant. The presence of an international visitor does not, by itself, mean the website uses international analytics services.

10. Retention and deletion

We aim to retain personal information only as long as it is necessary for the stated purpose, for security, to respond to correspondence or to meet legal obligations. Direct enquiries normally remain until resolved and are then reviewed for deletion or justified retention. Material needed for a legal claim or a legitimate accounting obligation may be held for the applicable statutory period.

Server log retention is determined by the actual hosting configuration and should be documented when the site is deployed. We do not claim a universal fixed retention period when no host-specific evidence is available. If you would like to know how a particular enquiry is held, contact us.

11. Security measures

We seek to apply reasonable organisational and technical safeguards, including limiting administrative access, using maintained software and deploying HTTPS when the live site is hosted. No internet transmission or electronic storage system is entirely risk free, so we cannot promise absolute protection. Please avoid including unnecessary sensitive or financial information in an ordinary email.

12. Your information rights

Depending on the circumstances, data protection law may give you rights to access personal information, request correction, request erasure, restrict processing, object to processing based on legitimate interests, receive portable information where the statutory conditions apply, and withdraw consent where we actually rely on it. You may also have rights relating to automated decision-making, although the current website does not implement solely automated decisions producing legal or similarly significant effects.

To exercise a right, email info@purethaliqorena.com with sufficient detail to identify the information concerned. We will respond within the applicable legal time limits, normally one month under UK GDPR unless an extension is legally permitted. We may need to verify your identity, and exemptions can apply in certain cases.

13. Complaints and regulators

If you are dissatisfied with how a request is handled, please contact us first so we can investigate. You also have the right to complain to the UK Information Commissioner's Office (ICO). Details about making a complaint are available on the official ICO website. EEA residents may additionally be able to approach their competent supervisory authority where EU GDPR applies.

14. Children and special-category information

Our pages describe a general-audience café and are not designed to collect information from children. We do not provide registration accounts or any feature intended to gather children's profiles. Please do not send health details, identity documents or other sensitive information unless it is genuinely necessary for a specific request and an appropriate secure communication method has been arranged.

15. External links and updates

The delivered site does not embed external social widgets. If you follow a later-added link away from the website, the destination's privacy practices will apply. We may update this notice when the site's real functionality, hosting, legal requirements or processing activities change; the last-updated date reflects the current text. Substantive new processing will require a revised explanation and any legally necessary consent controls before activation.