privacy notice
Who we are
Northern Coffee School is a trading name of Heart and Graft Coffee Limited, a company registered in England and Wales, company number 09519472, whose registered office is at 21 North Street, Manchester, M8 8RE.
We are the data controller for the personal information described in this notice. That means we are responsible for deciding how it is used and for keeping it safe.
If you have any question about your information, or you want to exercise any of the rights set out below, email [email protected].
What we collect, and why
When you enquire through our website
Our contact form asks for your name, email address and your message. We use it to reply to you, and to keep a record of the conversation if it leads to a booking. Our lawful basis is our legitimate interests - you have asked us a question and we need your details to answer it.
When you book a course
Bookings are taken through Bookwhen, our booking provider. Depending on the course, they collect your name, email address, phone number and payment details, along with the course and date you have chosen.
We use this to take your booking, prepare for your course, contact you if anything changes, and issue receipts. Our lawful basis is performance of a contract with you.
Payment card details are handled by Bookwhen and their payment provider. We do not see or store your card number.
Health, allergy and access information
When you book, we ask about allergies, medical conditions, pregnancy and any access requirements. We ask because our courses run inside a working roastery around hot equipment, and because nuts and other allergens may feature in sensory tastings.
Information about your health is special category data and gets extra protection in law. We only use it to keep you safe on the day and to tell you honestly whether we can accommodate you on a particular course. We rely on your explicit consent, which you give by telling us. You do not have to tell us anything, and you can withdraw your consent at any time - though we may then be unable to run a course safely for you, in which case we would refund you.
We share it only with the trainer running your course. We do not use it for anything else.
When you gain a certification
Where your course leads to an SCA certification, we pass your name, email address and assessment result to the Specialty Coffee Association, who issue the credential. We cannot certify you without doing this. Our lawful basis is performance of our contract with you.
The SCA is a separate data controller for what it does with your information, and its own privacy notice covers that.
When you visit our website
If you accept cookies, we use Google Analytics to understand how people use the site - pages visited, roughly how long for, and general location at city level. This is measured in aggregate and we do not use it to identify you.
Analytics only runs if you click “Accept” on our cookie banner. If you decline, or ignore the banner, no analytics cookies are set and nothing is sent to Google. You can change your mind by clearing your browser storage for this site. Our lawful basis is your consent.
Our records
We keep booking and payment records because we have to, for tax and accounting. Our lawful basis is compliance with a legal obligation.
Who else sees your information
We use a small number of providers who process information on our behalf:
| Provider | What for |
|---|---|
| Bookwhen | Course bookings and payments |
| FormSubmit | Delivering our website contact form to our inbox |
| Google Workspace | Our email |
| Google Analytics | Website analytics, only with your consent |
| Cloudflare | Serving and protecting our website |
| Our accountant | Bookkeeping and tax |
We also pass certification details to the Specialty Coffee Association, as described above.
We do not sell your information, and we do not share it for anyone else’s marketing.
Some of these providers process information outside the UK, including in the United States. Where that happens, it is covered by the safeguards UK data protection law requires, such as the UK’s international data transfer agreement or an adequacy decision.
How long we keep it
| What | How long |
|---|---|
| Enquiries that do not lead to a booking | 12 months |
| Booking and payment records | 6 years after the end of the tax year, as tax law requires |
| Health, allergy and access information | Deleted within 3 months of your course |
| Certification records | As long as the SCA requires us to keep them |
| Website analytics | 14 months |
Your rights
You have the right to:
- Ask for a copy of the information we hold about you
- Have it corrected if it is wrong
- Have it deleted, where we do not have a reason to keep it
- Ask us to restrict how we use it
- Object to us using it, where we rely on legitimate interests
- Ask us to transfer it to you or another provider in a portable format
- Withdraw your consent at any time, where we rely on consent
Email [email protected] and we will respond within one month. There is no charge.
If you are unhappy with how we have handled your information, please tell us first so we can put it right. You also have the right to complain to the Information Commissioner’s Office, the UK’s data protection regulator, at ico.org.uk or on 0303 123 1113.
Cookies
We use as few as possible.
- Remembering your cookie choice. When you accept or decline, we store that choice in your browser so we do not ask again. Nothing is sent to us.
- Google Analytics. Only set if you accept. See above.
- Booking pages. Where a Bookwhen booking panel appears on our site, Bookwhen may set its own cookies. Their privacy notice covers those.
Automated decisions
We do not make any decisions about you by automated means, and we do not profile you.
Changes to this notice
If we change how we use your information we will update this page.
This version is dated 31 July 2026.