Version 1.0, effective [to confirm: launch date]
This notice explains how Coffee Cyber collects and uses personal data when you use our website, sign up and use our control panel. It is written for the people at our business customers who deal with us, such as account owners, administrators and billing contacts.
1. Who we are
Coffee Cyber is a trading name of Coffee Cup Solutions Ltd, a company registered in England and Wales with company number 08905462. Our registered and trading address is Unit 3, Millars Brook, Wokingham, Berkshire, RG41 2AD.
For the personal data described in this notice, Coffee Cup Solutions Ltd is the controller. That means we decide how and why it is used. [to confirm: ICO registration number]
2. When this notice applies, and when it does not
We play two different roles with personal data:
- As controller: for the data we use to run your account, the control panel, billing, support and our website. This notice covers that data.
- As processor: for device and telemetry data from the CrowdStrike Falcon platform that we handle on our customer's behalf. Our customer is the controller of that data, and our Data Processing Agreement governs how we handle it. If you are an employee of one of our customers and want to know how your device data is used, please ask your employer first.
CrowdStrike processes endpoint telemetry as part of the Falcon platform under its own terms and data protection terms.
3. The personal data we collect
We collect the following personal data:
- Account contacts: names and work email addresses of the people who use or are named on the account, and their role.
- Billing details: billing contact details. Card and bank details are entered on Stripe's pages and held by Stripe. We keep only the last four digits and the type of card or account.
- Company details: information about your business from Companies House, which can include the names of directors and officers.
- Support tickets: the contents of support requests and any attachments you send us, which may include screenshots, logs and other information you choose to share.
- Audit and security logs: records of sign-ins, actions in the control panel and acceptance of our terms and agreements, including dates, times and IP addresses.
- Device information: information from the Falcon platform about your devices, such as hostnames, operating system, last seen time, sensor version and detections. Detections can include usernames and file paths. We handle this as a processor (see section 2), but it also appears in our records where we need it for billing and support.
- Website data: basic technical information needed to deliver our website securely, such as IP address and browser type in server logs.
We do not ask for special category data (such as health information) and ask you not to include it in support tickets.
4. Where the data comes from
- From you, when you sign up, fill in forms, manage your account or raise a support ticket.
- From your colleagues, when they invite you to the control panel or name you as a contact.
- From Companies House, a public source we query to check and fill in company details.
- From Microsoft, if you choose to sign in with your Microsoft work account (we receive your name and work email address).
- From Stripe, which confirms your payment method and the payments made.
- From the Falcon platform, which reports device information for your account.
5. How sign-in works
Our control panel does not use passwords. You sign in with a one-time link sent to your work email, with your Microsoft work account, or with a passkey. We do not see or store your Microsoft password. If you use a passkey, the private key stays on your device and we store only the public key needed to check it.
6. How we use your data and our lawful bases
| What we use it for | Data used | Lawful basis |
|---|---|---|
| Setting up and running your account, and providing the service | Account contacts, company details, device information | Performance of our contract with your business, and our legitimate interests in running our business |
| Ordering licences and provisioning your Falcon console | Company name, admin contact name and work email | Legitimate interests in providing the service your business has ordered |
| Billing and collecting payment | Billing details, device counts, company details | Performance of our contract, and legitimate interests |
| Providing support | Account contacts, support tickets, device information | Performance of our contract, and legitimate interests |
| Keeping the control panel secure, preventing fraud and investigating misuse | Audit and security logs, IP addresses | Legitimate interests in keeping our platform and customers safe |
| Keeping a record of who accepted our terms and when | Audit logs, IP addresses | Legitimate interests in being able to show what was agreed |
| Sending service messages, such as invoices, notices of price changes and security notices | Account contacts | Performance of our contract, and legitimate interests |
| Keeping accounting and tax records | Billing details, company details | Legal obligation |
| Dealing with legal claims | Any relevant data | Legitimate interests in establishing, exercising or defending legal claims |
Where we rely on legitimate interests, we have considered your rights and believe our use is reasonable and expected for a business service. We do not send marketing emails without the right permission, and you can opt out of any marketing at any time. [to confirm: whether any marketing emails will be sent]
We do not use your personal data for automated decision-making that has legal or similarly significant effects on you.
7. Who we share data with
We share personal data only with the following organisations, and only as needed:
- CrowdStrike: provides the Falcon endpoint protection platform.
- Pax8: our distributor. We share your company name and the name and work email of your admin contact for ordering and provisioning.
- Stripe: our payment processor, which collects payments by Direct Debit and card.
- Microsoft: provides sign-in with Microsoft, and our own email and productivity tools.
- [to confirm: email delivery provider]: sends sign-in links and service emails.
- [to confirm: hosting provider and region]: hosts our control panel and website.
We may also share data with our professional advisers, with the police, regulators or courts where the law requires it, or with a buyer if we sell all or part of our business. We do not sell personal data.
8. Transfers outside the UK
Some of our suppliers, such as CrowdStrike, Pax8, Stripe and Microsoft, may process data outside the UK, including in the United States. Where this happens, we make sure the transfer is protected, for example because the country has UK adequacy regulations (including the UK Extension to the EU-US Data Privacy Framework), or by using the UK International Data Transfer Agreement or the UK Addendum to the EU Standard Contractual Clauses. You can ask us for more details through the support section of your control panel.
9. How long we keep data
| Data | How long we keep it |
|---|---|
| Account and billing records | 6 years after the end of the financial year they relate to, to meet UK tax rules |
| Support tickets and attachments | For the life of the account plus 2 years [to confirm] |
| Audit and security logs | 12 months [to confirm] |
| Records of acceptance of terms and agreements | For the life of the account plus 6 years [to confirm] |
| Device information held in our systems | For the life of the account, then deleted in line with our Data Processing Agreement, except where needed to support billing records |
When we no longer need data, we delete it or make it anonymous.
10. How we keep data secure
We use appropriate technical and organisational measures to protect personal data. These include encryption in transit, passwordless sign-in, access controls so staff see only what they need, and audit logging. If we become aware of a personal data breach that affects you, we will act on it promptly and tell you and the Information Commissioner's Office where the law requires us to.
11. Your rights
Under UK data protection law, you have the right to:
- ask for a copy of your personal data;
- ask us to correct data that is wrong or incomplete;
- ask us to delete your data;
- ask us to restrict how we use your data;
- object to our use of your data where we rely on legitimate interests;
- ask us to transfer data you gave us to another organisation, where this applies; and
- withdraw consent, where we rely on consent.
Some of these rights have limits. For example, we may need to keep billing records for tax purposes. We will respond within one month, and tell you if we need longer.
To use any of these rights, contact us through the support section of your control panel. If you do not have access to the control panel, write to us at Coffee Cup Solutions Ltd, Unit 3, Millars Brook, Wokingham, Berkshire, RG41 2AD.
12. Complaints
If you are unhappy with how we have used your data, please tell us first so we can try to put it right. You also have the right to complain to the Information Commissioner's Office (ICO), the UK data protection regulator, at ico.org.uk.
13. Cookies
We use only strictly necessary cookies. Our Cookie Policy explains which ones and why.
14. Changes to this notice
We may update this notice from time to time. The version number and effective date at the top of this page show when it last changed. If we make a significant change, we will tell account contacts through the control panel or by email.