Data and GDPR

01Our roles

Roastnet Ltd is the controller for personal data about its own customers, market members and website visitors, including market orders, sample requests and deliveries it arranges.

Roastnet is a processor for personal data that roasteries store in their workspaces, such as their contacts, wholesale customers and storefront buyers. The roastery is the controller of that data and decides how it is used.

Where an importer receives a buyer's details to confirm and invoice an order, the importer is an independent controller of those details.

02Data processing agreement

When we act as your processor, our data processing agreement forms part of the Terms of Service and meets the requirements of Article 28 UK GDPR and EU GDPR. It covers processing only on your instructions, confidentiality, security measures, use of sub-processors, assistance with data subject requests and breaches, deletion or return at the end of the service, and audits. A signed copy is available on request from [email protected].

03Sub-processors

We use sub-processors in these categories: cloud hosting and storage, content delivery and security, payment processing, email and messaging delivery, logistics, and AI service providers for workspaces that enable AI features. The current list is available on request from [email protected]. We give notice of new sub-processors and you may object on reasonable grounds.

04Where data is held and transfers

Production data is hosted in data centres in the United Kingdom. Transfers outside the UK or EEA are made under adequacy regulations, or under standard contractual clauses with the UK international data transfer addendum, with supplementary measures where needed. Market trades with importers and origin sellers abroad may require sharing order and delivery details with them in their country.

05Security

Each workspace has its own isolated database, data is encrypted in transit and at rest, and access is role-based. See the Security page for detail. We notify affected customers without undue delay after becoming aware of a personal data breach affecting their data.

06Your rights

Individuals have the right to access, correct, erase, restrict and port their personal data, to object to processing and to withdraw consent. Email [email protected]. Where we are processor, we pass requests to the controlling roastery and help it to respond.

You can complain to the Information Commissioner's Office (ico.org.uk) or your local supervisory authority.

07Representatives and contact

The controller is Roastnet Ltd, a company registered in England and Wales with company number [PLACEHOLDER: company number], registered office [PLACEHOLDER: registered office address]. EU representative: [PLACEHOLDER: EU representative under Article 27, if required]. Contact [email protected].