Privacy Policy

1. Who is responsible for your data

The data controller is Rose Street Cafe (sole trader), 192A Rose Street, Edinburgh EH2 4AZ. Questions about privacy: contact@rosestreetcafe.com or +44 131 478 3612.

2. What we collect

• Contact form: your name, email address, phone number (optional), the topic you choose and your message.
• Spam protection: your IP address and email address are held temporarily in server memory for up to two hours to limit how often the contact form can be used. They are not stored permanently.
• Technical data: like any website, our server receives your IP address, browser type and the pages requested. These may be kept briefly in server logs for security and troubleshooting.
• Emails and calls: if you email or phone us directly, we receive the details you choose to share.

We do not use analytics, advertising or tracking cookies, and we do not sell your data.

3. Why we use it and our lawful basis

• To reply to your enquiry, feedback or group request — our legitimate interest in responding to people who contact us, or steps you ask us to take before arranging a visit.
• To keep the website secure and free from spam — our legitimate interest in protecting our systems.
• To show the embedded Google Map — only with your consent (given by clicking “Show map”), which you can withdraw at any time (see Cookies and local storage).
• Where needed to comply with a legal obligation.

4. Who we share it with

We use a small number of trusted service providers who process data on our behalf:

• Resend (email delivery) — sends contact-form messages to our inbox. Resend is based in the United States; transfers are protected by appropriate safeguards such as the UK International Data Transfer Addendum / Standard Contractual Clauses.
• Website hosting — the company whose servers run this website and temporarily hold its technical logs.
• Google — only if you choose to load the embedded Google Map. Our fonts and images are served from our own website, so no data is sent to third parties just by visiting.

We may also disclose information where required by law or to protect our rights. Links to Instagram, Facebook and Google Maps take you to those services, which have their own privacy policies.

5. How long we keep it

Contact-form enquiries and our replies are kept for up to 24 months and then deleted, unless we need them longer to deal with a complaint or legal claim. Rate-limit data is discarded after two hours.

6. Your rights

You have the right to:

• ask for a copy of the personal data we hold about you;
• ask us to correct or delete it;
• object to, or ask us to restrict, how we use it;
• withdraw consent at any time where we rely on consent;
• ask for your data in a portable format where applicable.

To exercise any of these rights, email contact@rosestreetcafe.com. We will reply within one month. If you are unhappy with how we handle your data, you can complain to the Information Commissioner's Office: ico.org.uk or 0303 123 1113 — though we'd appreciate the chance to resolve it first.

7. Security

The site is served over an encrypted (HTTPS) connection, and access to our email inbox and systems is restricted to authorised staff.

8. Cookies and local storage

We don't use analytics, advertising or tracking cookies, so there is no cookie banner. The site only keeps a few small items in your browser that it needs to work:

• rsc-consent (local storage, 12 months) — remembers whether you chose to show the Google Map.
• rsc-contact-next-allowed (local storage, up to 2 hours) — tells you when you can send another contact-form message.
• tsr-scroll-restoration and rsc-season (session storage, until you close the tab) — remember your scroll position and any seasonal preview.

The embedded Google Map on our Visit & Contact page is the only optional item. It stays switched off until you click “Show map”; Google may then set its own cookies (see Google's cookie policy). You can change your choice here at any time, or clear site data in your browser.

9. Children

This website is not aimed at children. Please don't use the contact form if you are under 13 — ask a parent or guardian to contact us instead.

10. Changes

We may update this notice from time to time. The date at the top shows when it was last changed.