Privacy policy

Privacy Policy

Last updated: 08.06.2026 

This Privacy Policy explains how Bean Theory Limited ("Flavour Theory", "we", "us", "our") collects, uses, shares and protects your personal data when you visit flavourtheory.co.uk (the "Site"), buy from us, design a blend in The Lab, contact us, or otherwise interact with us. It also explains your rights under UK data protection law.

We are committed to protecting your privacy and handling your data in line with the UK General Data Protection Regulation (UK GDPR) and the Data Protection Act 2018.

 

1. Who we are (Data Controller)

The data controller responsible for your personal data is:

  • Legal/trading name: Bean Theory Limited, trading as Flavour Theory
  • Company number (if a limited company): 14684599
  • Registered/business address: Waresley Park Stud, Gamlingay Road, Waresley, Sandy, SG193DD
  • Email: hello@flavourtheory.co.uk

For any privacy questions or to exercise your rights, contact us at hello@flavourtheory.co.uk

2. The personal data we collect

a) Information you give us

  • Identity & contact details: name, email address, phone number, billing and delivery addresses.
  • Order information: the products you buy, custom blend recipes and the names you give your blends, order value and history.
  • Account information: login details and preferences if you create an account.
  • Payment information: card or payment details are collected and processed by our payment providers (see section 5). We do not store full card numbers ourselves.
  • Communications: messages you send us by email, contact form, reviews, surveys or social media, and our replies.
  • Marketing preferences: whether you've opted in to emails or other marketing.

b) Information we collect automatically

  • Device & usage data: IP address, browser type and version, time zone, operating system, the pages you view, referring URLs, and how you interact with the Site.
  • Cookies and similar technologies: see section 6.

c) Information from third parties

  • Our e-commerce platform, payment providers, couriers, marketing and analytics providers, and (if you engage with us there) social media platforms.

We do not knowingly collect "special category" data (e.g. health, ethnicity). Please don't send us such information.

3. How and why we use your data (and our lawful bases)

We only use your personal data where the law allows. The lawful bases we rely on are:

Purpose Lawful basis
Process and deliver your orders, including custom blends; take payment; provide customer service Performance of a contract with you
Create and manage your account Performance of a contract
Send order and service messages (confirmations, dispatch, delays) Performance of a contract / Legitimate interests
Prevent and detect fraud, secure our Site, and keep records Legitimate interests and Legal obligation
Keep accounting, tax and transaction records Legal obligation
Improve our products, Site and service; analytics Legitimate interests (and consent for non-essential cookies)
Send marketing emails about products, offers and new blends Consent, or Legitimate interests for existing customers (soft opt-in) — you can opt out any time
Respond to your enquiries and reviews Legitimate interests
Handle returns, refunds and complaints Performance of a contract / Legal obligation

Where we rely on legitimate interests, we've balanced those interests against your rights. You can object at any time (see section 9).

4. Marketing and your choices

We'll only send you marketing where you've opted in, or where you're an existing customer and we're contacting you about similar products (and you didn't opt out). Every marketing email has an unsubscribe link, and you can opt out any time by clicking it or emailing hello@flavourtheory.co.uk. Opting out of marketing won't stop essential service messages about orders you've placed.

5. Who we share your data with

We never sell your personal data. We share it only with trusted parties who help us run our business, and only as needed:

  • E-commerce platform / hosting: Shopify Inc. (which hosts our Site and processes orders).
  • Payment processing: Shopify Payments / Stripe, PayPal, Shop Pay, Apple Pay / Google Pay — to take payment securely.
  • Delivery & fulfilment: our couriers and fulfilment partners Royal Mail / Evri / DPD / others to deliver your order.
  • Email & marketing: Klaviyo / Mailchimp / Shopify Email to send emails you've agreed to.
  • Analytics & advertising: Google Analytics, Meta/Facebook, TikTok — to understand Site usage and (where you consent) measure advertising.
  • Reviews: Judge.me / Loox / other if we collect product reviews.
  • Other apps/services: list any other Shopify apps you install that process personal data.
  • Professional advisers: accountants, lawyers and insurers where necessary.
  • Authorities: law enforcement, regulators or others where required by law or to protect our rights.
  • Business transfers: if we sell or reorganise the business, your data may be transferred to the new owner under the same protections.

Each of these acts as our processor or as a separate controller and is required to keep your data secure.

6. Cookies and similar technologies

We use cookies and similar technologies to make the Site work, remember your basket and preferences, understand usage, and (with your consent) support marketing. Cookies fall into:

  • Strictly necessary (e.g. checkout, security) — always on.
  • Functional/preferences — remember your choices.
  • Analytics/performance — help us improve.
  • Marketing/advertising — set only with your consent.

You can manage non-essential cookies via our [cookie banner / preferences] and through your browser settings. Blocking some cookies may affect how the Site works. See our [Cookie Policy] for the full list if you publish one separately.

7. International transfers

Some of our providers (e.g. Shopify and certain analytics/marketing tools) may process your data outside the UK or European Economic Area. Where they do, we make sure appropriate safeguards are in place — such as a UK "adequacy" decision, the UK International Data Transfer Agreement (IDTA), or the EU Standard Contractual Clauses with the UK Addendum.

8. How long we keep your data (retention)

We keep your data only as long as necessary:

  • Order and transaction records: [6] years to meet UK tax/accounting requirements.
  • Account data: until you ask us to delete your account, then removed/anonymised (subject to records we must legally keep).
  • Marketing data: until you unsubscribe or ask us to stop, then suppressed so we don't contact you again.
  • Enquiries/correspondence: [up to 2 years] after your query is resolved.

After these periods we securely delete or anonymise your data.

9. Your rights

Under UK data protection law you have the right to:

  • Be informed about how we use your data (this policy).
  • Access a copy of the personal data we hold about you.
  • Rectification of inaccurate or incomplete data.
  • Erasure ("right to be forgotten") in certain circumstances.
  • Restrict processing in certain circumstances.
  • Data portability — receive your data in a portable format.
  • Object to processing based on legitimate interests, and to direct marketing at any time.
  • Withdraw consent at any time where we rely on consent.
  • Rights relating to automated decision-making and profiling (see section 11).

To exercise any of these, email hello@flavourtheory.co.uk. We may need to verify your identity. We'll respond within one month (extendable by two further months for complex requests, and we'll tell you if so). Exercising your rights is free unless your request is manifestly unfounded or excessive.

10. Complaints — the ICO

If you're unhappy with how we've handled your data, please contact us first so we can try to put it right. You also have the right to complain to the UK supervisory authority:

Information Commissioner's Office (ICO) — ico.org.uk · Helpline 0303 123 1113.

11. Automated decision-making and profiling

We do not make decisions that produce legal or similarly significant effects about you based solely on automated processing. We may use basic analytics to group customers and tailor marketing, but you can object to this at any time.

12. Children

Our Site and products are intended for adults. We do not knowingly collect personal data from children under [16]. If you believe a child has provided us data, contact us and we'll delete it.

13. Third-party links

Our Site may link to third-party sites (e.g. social media, payment providers). We're not responsible for their privacy practices — please read their policies.

14. Data security

We use appropriate technical and organisational measures to protect your data, including secure (HTTPS) connections, access controls and reputable providers. No method of transmission over the internet is 100% secure, but we work to protect your data and have procedures to deal with any suspected breach.

15. Changes to this policy

We may update this policy from time to time. The "Last updated" date at the top shows the latest version. Significant changes will be highlighted on the Site or by email where appropriate.

16. Contact us

  • Email: hello@flavourtheory.co.uk
  • Post: Waresley Park Stud, Gamlingay Road, Waresley, Sandy, Beds, SG19 3DD