Privacy Policy

Gravel & Grind is a mobile speciality coffee van and wellbeing hub operating across East Yorkshire and beyond. References to "we", "us", or "our" in this policy refer to Gravel & Grind. Our website is located at gravelandgrind.co.uk.

If you have any questions about how we handle your data, please contact us via our contact page.

We may collect the following personal data when you use our website or contact us:

• Contact information — your name, email address, and any message content you submit via our contact or events enquiry forms.
• Location suggestions — if you use the "Suggest a Location" form on the Find the Café page, we collect the location name and any notes you provide.
• Usage data — standard server logs may record your IP address, browser type, pages visited, and time of visit. This data is used solely for security and performance monitoring.

We do not collect payment card details. We do not run advertising trackers or sell your data to third parties.

We use the data we collect to:

• Respond to your enquiries and event hire requests.
• Consider location suggestions for future van stops.
• Maintain the security and performance of our website.
• Comply with any legal obligations.

We will not use your data for automated decision-making or profiling.

Under UK GDPR, we process your personal data on the following legal bases:

• Legitimate interests — responding to enquiries you initiate and keeping our website secure.
• Consent — where you have explicitly provided information for a specific purpose (such as a location suggestion).
• Legal obligation — where we are required to retain or share data by law.

Our website uses a cookie consent banner. We only set non-essential cookies (such as analytics cookies) after you have given your consent. Essential cookies required for the site to function are set automatically.

You can withdraw your consent at any time by clearing your browser cookies or adjusting your browser settings.

We retain contact form submissions and enquiry data for up to 24 months, after which it is securely deleted. Server log data is retained for no longer than 90 days.

We do not sell, rent, or trade your personal data. We may share data with trusted third-party service providers who assist us in operating our website (such as hosting and email delivery providers), under strict data processing agreements. These providers are not permitted to use your data for their own purposes.

We may disclose data if required to do so by law or in response to a valid legal request.

Under UK GDPR you have the right to:

• Access the personal data we hold about you.
• Rectify inaccurate or incomplete data.
• Erase your data ("right to be forgotten") where there is no overriding legal basis for retention.
• Restrict processing in certain circumstances.
• Object to processing based on legitimate interests.
• Data portability — receive your data in a structured, machine-readable format.

To exercise any of these rights, please contact us via our contact page. We will respond within 30 days. You also have the right to lodge a complaint with the Information Commissioner's Office (ICO).

Our website may contain links to third-party websites (such as Strava, Instagram, or Facebook). We are not responsible for the privacy practices of those sites and encourage you to read their own privacy policies.

We may update this Privacy Policy from time to time. The "Last updated" date at the top of this page will reflect any changes. Continued use of the website after an update constitutes acceptance of the revised policy.