Privacy policy

Privacy Policy

Last updated: 30 July 2026

Who we are

G R I B I N O is operated by the Gribino Ministry of Coffee.

For legal and data-protection purposes, the business responsible for this website is Benjamin Gribbin, trading as G R I B I N O.

Our store is hosted by Shopify, which provides the ecommerce platform that allows us to offer our products and services to you.

In this policy, “Gribino”, “we”, “us” and “our” refer to Benjamin Gribbin trading as G R I B I N O.

What this policy covers

This Privacy Policy explains how we collect, use, store and share personal information when you:

  • visit or use our website;

  • make or attempt to make a purchase;

  • create or use a customer account;

  • subscribe to our mailing list;

  • contact us;

  • request a return or refund; or

  • otherwise interact with G R I B I N O.

Personal information means information that identifies you or could reasonably be linked to you. It does not include information that has been anonymised so that you can no longer be identified.

Personal information we collect

The personal information we collect depends on how you use our website and services.

Information you provide to us

We may collect:

  • your name;

  • billing and delivery addresses;

  • email address;

  • telephone number, where you choose to provide one as part of an order;

  • order and transaction details;

  • product preferences and selections;

  • customer-account information;

  • marketing preferences;

  • messages, enquiries and other communications you send to us;

  • returns, refunds and complaint information; and

  • any other information you choose to provide.

Payment information

Payments are processed by Shopify and its payment providers.

Your payment provider may collect information such as your card number, expiry date, security information and billing details. Gribino will generally receive transaction information, payment confirmation and limited payment details rather than your complete card information.

Payment providers process information under their own terms and privacy policies.

Information collected automatically

When you visit our website, Shopify and other authorised service providers may automatically collect information including:

  • your IP address;

  • browser and device type;

  • operating system;

  • approximate location;

  • pages viewed;

  • links and buttons used;

  • referring website;

  • dates and times of visits;

  • shopping-basket activity;

  • checkout activity; and

  • cookie and similar technology identifiers.

Information received from other organisations

We may receive information from:

  • Shopify;

  • payment processors;

  • fraud-prevention and security providers;

  • our coffee roasting and order-fulfilment partner;

  • delivery and courier providers;

  • email and customer-service providers; and

  • other service providers used to operate the store.

How and why we use personal information

We only use personal information where we have a lawful reason to do so.

To perform our contract with you

We use personal information where necessary to:

  • process and fulfil your order;

  • take and confirm payment;

  • arrange delivery;

  • provide order and dispatch updates;

  • manage returns, refunds and replacements;

  • respond to enquiries relating to your order;

  • maintain your customer account; and

  • provide the products and services you have requested.

Without certain information, such as your name, delivery address and payment confirmation, we may be unable to accept or fulfil an order.

To comply with legal obligations

We may use and retain information where necessary to:

  • maintain tax and accounting records;

  • comply with consumer-protection requirements;

  • respond to lawful requests from regulators, courts or public authorities;

  • manage data-protection rights and complaints;

  • prevent or report unlawful activity; and

  • comply with other legal obligations that apply to us.

For our legitimate interests

We may use personal information where necessary for our legitimate business interests, provided those interests are not overridden by your rights and freedoms.

These interests include:

  • operating and improving the website;

  • understanding how customers use the store;

  • providing customer service;

  • protecting our business and customers from fraud;

  • maintaining website and payment security;

  • managing stock, orders and fulfilment;

  • keeping appropriate business records;

  • establishing, exercising or defending legal claims; and

  • improving our products, services and customer experience.

With your consent

Where consent is required, we may use personal information to:

  • send marketing emails;

  • place certain optional cookies or similar technologies;

  • personalise advertising; or

  • carry out another activity that we have clearly explained when asking for your consent.

You can withdraw your consent at any time. Withdrawing consent does not affect processing that took place lawfully before it was withdrawn.

Marketing communications

We may send you news, product updates and promotional emails where you have agreed to receive them or where sending them is otherwise permitted by law.

You can unsubscribe at any time by:

Unsubscribing from marketing does not prevent us from sending non-marketing messages relating to an order, payment, delivery, return, refund, complaint or customer-service enquiry.

We do not sell your personal information to third-party mailing lists.

Cookies and similar technologies

Our website uses cookies and similar technologies.

These may include:

Essential cookies

These are required for the website to function and may be used to:

  • keep products in your basket;

  • operate checkout;

  • process payments;

  • remember privacy choices;

  • maintain website security; and

  • prevent fraud.

Essential cookies cannot normally be disabled through our cookie controls because the store may not work correctly without them.

Analytics and functionality cookies

These help us understand how visitors use the store and may help improve website performance and functionality.

Advertising and personalisation cookies

Where enabled, these may be used to measure advertising, understand customer interests or display more relevant advertising.

Where the law requires consent, optional cookies will not be used until you have made a choice through our cookie banner or privacy controls.

You can review or change your choices through the cookie or privacy controls shown on our website. You can also control cookies through your browser settings, although disabling some cookies may affect how the store functions.

How we share personal information

We may share personal information only where reasonably necessary to operate the store, fulfil orders, comply with the law or protect our legitimate interests.

Recipients may include:

Shopify

Shopify hosts our website, provides our ecommerce platform and processes information required to operate the store, checkout and related services.

For some Shopify services and enhanced features, Shopify may also process information for its own purposes as an independent data controller. Further details are available in Shopify’s Consumer Privacy Policy and Shopify Privacy Portal.

Payment providers

Payment information is shared with Shopify Payments, banks, card networks and other payment providers where necessary to authorise, process, refund or investigate a transaction.

Roasting and fulfilment partners

We may share your name, delivery address, contact information and order details with our coffee roasting, packing and order-fulfilment partner so that your order can be prepared and dispatched.

Our fulfilment partner is permitted to use this information only as necessary to fulfil orders and provide related services.

Delivery providers

We may share delivery details with Royal Mail, couriers or other delivery providers responsible for transporting your order.

Technology and professional service providers

We may share information with trusted providers that help us operate the business, such as:

  • website and hosting providers;

  • email providers;

  • customer-service tools;

  • fraud-prevention providers;

  • analytics providers;

  • accountants;

  • insurers;

  • legal advisers; and

  • IT and security providers.

Legal and regulatory disclosures

We may disclose information where reasonably necessary to:

  • comply with a legal obligation;

  • respond to a valid court order or regulatory request;

  • prevent, detect or investigate fraud or crime;

  • protect the safety, rights or property of Gribino, our customers or others; or

  • establish, exercise or defend legal claims.

Business transfers

If the business is sold, transferred, reorganised or merged, relevant personal information may be disclosed to professional advisers, prospective purchasers or the new business owner, subject to appropriate confidentiality and data-protection safeguards.

Fraud prevention and automated systems

Shopify, payment providers and fraud-prevention providers may use automated systems to identify suspicious transactions, assess risk or prevent fraud.

These providers may decline or refer a transaction for review under their own terms and privacy policies.

Gribino does not itself carry out solely automated decision-making that produces legal or similarly significant effects on customers.

International transfers

Some of our service providers, including Shopify and its subprocessors, may process personal information outside the United Kingdom.

Where personal information is transferred to a country that does not have an applicable UK adequacy decision, appropriate safeguards will be used where required. These may include the UK International Data Transfer Agreement, the UK Addendum to approved standard contractual clauses or another legally recognised transfer mechanism.

How long we keep personal information

We keep personal information only for as long as reasonably necessary for the purposes described in this policy.

In general:

  • core order, transaction, tax and accounting records may be retained for up to six years, or longer where legally required;

  • customer-service and complaint correspondence is retained for as long as reasonably necessary to resolve the matter and protect our legal interests;

  • return and refund information may be retained with the associated transaction record;

  • customer-account information is retained while the account remains active and for a reasonable period afterwards;

  • marketing information is retained until you unsubscribe, withdraw consent or the information is no longer required; and

  • technical and analytics information is retained according to the settings and retention periods of the relevant service provider.

We may retain information for longer where it is needed in connection with a dispute, legal claim, fraud investigation or regulatory requirement.

When information is no longer required, it will be deleted, anonymised or securely disposed of where reasonably practicable.

How we protect personal information

We use reasonable technical and organisational measures designed to protect personal information from accidental loss, misuse, unauthorised access, alteration or disclosure.

These measures may include:

  • secure Shopify hosting;

  • access controls;

  • password protection;

  • multi-factor authentication;

  • secure payment processing;

  • limited access to customer information; and

  • appropriate arrangements with service providers.

No internet transmission or storage system is completely secure. You should not send sensitive payment or confidential information to us through ordinary email.

You are responsible for keeping any customer-account password or login details secure.

Your data-protection rights

Depending on the circumstances, you may have the right to:

  • request confirmation that we process your personal information;

  • request access to your personal information;

  • ask us to correct inaccurate or incomplete information;

  • ask us to delete personal information;

  • ask us to restrict how personal information is used;

  • object to certain uses of personal information;

  • object to direct marketing;

  • request a portable copy of certain information;

  • withdraw consent where processing is based on consent; and

  • complain about how we have handled your information.

These rights are not absolute and may be subject to legal exceptions. For example, we may need to retain transaction information to meet tax, accounting or legal obligations.

To exercise a right, email itsgribino@gmail.com.

Please provide enough information for us to understand your request. We may need to ask for reasonable evidence of identity before disclosing or changing personal information.

We will respond within the period required by applicable data-protection law.

Children’s information

Our store is intended for a general audience and is not designed specifically for children.

We do not knowingly collect personal information directly from children who are too young to provide valid consent under applicable law.

Where a parent or guardian believes that a child has provided personal information to us inappropriately, they can contact itsgribino@gmail.com.

Data-protection complaints

You may make a complaint about how we have collected, used, stored, disclosed or otherwise handled your personal information by emailing:

itsgribino@gmail.com

Please include:

  • your name and contact details;

  • a description of your concern;

  • relevant dates, order numbers or correspondence; and

  • any outcome you would like us to consider.

We will acknowledge a data-protection complaint within 30 days of receiving it.

We will take appropriate steps to investigate the complaint without undue delay, keep you reasonably informed about its progress and explain the outcome when our investigation is complete.

We may ask for additional information or proof of identity where reasonably necessary to investigate the complaint securely.

Complaining to the Information Commissioner

We would appreciate the opportunity to address your concern directly.

You also have the right to complain to the Information Commissioner’s Office, the UK supervisory authority responsible for data protection.

Information about making a complaint is available on the Information Commissioner’s Office website.

Changes to this policy

We may update this Privacy Policy from time to time to reflect changes to:

  • our services;

  • the Shopify platform;

  • our service providers;

  • our use of personal information;

  • applicable law; or

  • other operational or regulatory requirements.

We will publish the updated policy on this website and change the “Last updated” date above.

Where required by law, we will provide additional notice of significant changes.

Contact details

For questions, rights requests or data-protection complaints, contact:

G R I B I N O

Email: itsgribino@gmail.com

Postal address:
Gribino
21 Appleton Court
Durkar
Wakefield
WF2 7AR
United Kingdom