Who we are
Tea Time Cafe is operated by Tea Time Yorkshire Ltd at 87 Market Place, Thirsk, North Yorkshire YO7 1ET. The data controller is Tea Time Yorkshire Ltd, and Rosa Fothergill is the person to contact about it. You can reach us at rosa@teatimeyorkshire.co.uk or 01845 523869.
What we collect, and why
We only collect what we need to run the cafe and answer the things you ask us. In practice that's:
- Booking forms — name, email, phone number, party size, booking date and time, dietary or special-occasion notes you supply, and for afternoon tea the names of any dishes you picked from our menu. We use this to confirm and run your booking.
- Contact forms — name, email, phone (optional), and the content of your message. We use this to reply. If you tick the box to hear from us, we also keep your name and email on our mailing list.
- Gift vouchers bought online — your name and email, the recipient's name and any gift message you add. We use this to take the payment, email you the voucher and check its code when it is used.
- Workshop places booked online — your name, email, phone number, how many places you book and, if you tell us, whether you have done the craft before. We use this to take the payment, confirm your place and reach you if the workshop changes.
- Analytics — if you accept analytics cookies, we use two tools: Google Analytics 4 to count page views, and PostHog, hosted in the EU, to see which links get clicked and where our booking form trips people up. They use browser identifiers, cookies and local storage, which can be personal data even without a name. PostHog records clicks and page paths with element text and attributes masked; session recording is turned off. Neither runs at all until you accept.
Lawful basis
- Contract for arranging and running your booking.
- Contract for booking and running a workshop place you buy online, and legal obligation for keeping the record of the sale for our accounts.
- Contract for selling and delivering a gift voucher you buy online.
- Legal obligation for keeping the record of each voucher sale for our accounts.
- Legitimate interests for replying to enquiries, basic site administration, essential security logs and protecting against spam.
- Consent for non-essential cookies and the associated analytics processing. Withdraw it any time with the “Change cookie choices” link at the bottom of any page, which puts the choice back in front of you.
- Consent for our occasional emails about what is on, given by ticking the box on the contact form. Every email has an unsubscribe link, and you can also email rosa@teatimeyorkshire.co.uk to come off the list.
How long we keep it
- Booking, reservation and enquiry data: up to 24 months from creation. Dietary and reservation notes are stripped seven days after the visit.
- Gift vouchers bought online: your name and email, the recipient's name and any gift message are removed 24 months after the voucher's expiry date, whether it was used, unused or refunded. A record of the sale itself (the amount, the voucher code and the dates, with no names) is kept for 6 years for our accounts. An unfinished checkout is deleted after 30 days.
- Workshop places booked online: your name, email and phone number are removed 6 months after you book. A record of the sale (places, amount and dates, with no names) is kept for 6 years for our accounts. An unfinished checkout is deleted after 30 days.
- Google Analytics user and event data follow the property retention setting, up to 14 months in a standard GA4 property. Aggregated reports can last longer. PostHog follows its project setting; ask Rosa for the current settings.
Who we share it with
The site is hosted on Vercel. Bookings, reservations and enquiries are stored in a Neon Postgres database. Email is sent through Resend. Analytics, if you opt in, runs through Google and PostHog (PostHog on its EU infrastructure). Gift vouchers and workshop places bought online are paid through Stripe: you type your card details on Stripe's own page, so they never reach us. Stripe receives your name, email and the payment, and handles them under its own privacy policy as well as for us. We don't sell your data, ever.
When you send a booking request, a table request, an enquiry or a message, a short note goes to a staff channel in Slack, passed on by n8n, an automation service, so whoever is on shift knows it has come in. Every note gives the kind of request and a reference number. A note about a booking, a table request or an enquiry also gives a link to our own admin page, and can give the day and time, how many are coming and, for the event space, the catering you picked from our list. A note about a message gives the topic you chose. Your name, contact details, dietary needs, the occasion and anything you wrote yourself stay in Rosa's email and our booking records. When you send an afternoon tea request, any dishes you picked from the menu go with it into Rosa's email only.
Some of these providers process data outside the UK. Where they do, the transfer relies on the UK's approved safeguards. If you want the current list of who holds what, ask us and we will tell you plainly.
Your rights
You can ask to see what we hold about you, correct it, delete it (where lawful), or ask us to stop processing it. Email rosa@teatimeyorkshire.co.uk and we normally respond within one calendar month. We will explain any lawful extension within that month. Rights include access, correction, erasure, restriction, objection, and portability where applicable. Consent can be withdrawn without affecting earlier lawful processing. If you're unhappy with our response, you can complain to the Information Commissioner's Office at ico.org.uk.
Cookies
We set the cookies needed to keep the site working (no consent needed). Anything optional — analytics, in particular — you opt into via the cookie banner. Google Analytics uses _ga and _ga_* cookies (normally up to two years). PostHog uses ph_* identifiers and local storage. Our teatime-consent local storage records your choice and teatime-attribution records a consenting visitor's referral source. Your choice is stored on your own device, not in a cookie, so clearing cookies does not reset it. Use the “Change cookie choices” link at the bottom of any page instead, which clears the choice and asks again.
Withdrawing consent stops our loaded analytics clients immediately and removes their browser cookies. It does not automatically delete events already received by a provider; contact Rosa to request deletion where we can identify the record.
Children and family bookings
The cafe welcomes families. Online bookings, enquiries and mailing-list subscriptions should be made by an adult, using the adult's contact details. We do not offer child accounts or ask for children's dates of birth. Please give party numbers instead of children's names, and avoid putting children's personal information in free-text messages. If a child has submitted information, a parent can contact Rosa to request review and deletion. We do not use children's data for targeted advertising.
Dietary information
Allergies and some dietary requests can reveal health or religious information. We ask for explicit consent before saving online dietary choices, and record the time and notice version with the booking. Give only what the kitchen needs, without naming another guest. Discuss serious allergies directly with Rosa. You can withdraw dietary consent by contacting her; this may affect what the kitchen can safely provide. This information is used to handle the request, not for marketing. Consent evidence remains with the booking for its retention period; the dietary choices are removed earlier.
Privacy signals and policy changes
We do not sell personal information or use it for cross-context behavioural advertising. Optional analytics requires your choice regardless of where you visit from. Essential hosting and requested booking processing still take place. We do not treat continued browsing or a revised notice as consent to a new use of your information.