Legal
GDPR & Your Rights
Last updated: 26 August 2026
This page summarises rights under the UK General Data Protection Regulation and the Data Protection Act 2018. The full privacy notice is on our Privacy Policy. This is a plain-English guide for customers of a small café, not legal advice.
1. The law that applies
Oak & Ivy Coffee House is in Draperstown, Northern Ireland. We follow:
- UK GDPR (transparency, lawful bases, data subject rights, security)
- Data Protection Act 2018
- PECR for cookies, similar technologies and electronic marketing
The regulator is the Information Commissioner’s Office (ICO). EU GDPR can also apply if we offer goods or monitor people in the EEA in a targeted way. This brochure website is aimed at local visitors in Northern Ireland.
2. Your rights
Right to be informed
You should be told who we are, what we use your data for, the lawful basis, who we share it with, how long we keep it and how to complain. That information is in the Privacy Policy.
Right of access
You can ask for a copy of the personal data we hold about you and supporting information. This is a subject access request. We will respond within one month in most cases.
Right to rectification
You can ask us to correct inaccurate data or complete data that is incomplete.
Right to erasure
You can ask us to delete data in certain cases — for example if we no longer need it, or if you withdraw consent and we have no other lawful basis. We may refuse where we must keep records for tax or to defend a legal claim.
Right to restrict processing
You can ask us to store data but not use it, for example while accuracy is disputed.
Right to data portability
Where we process data by automated means on the basis of consent or contract, you can ask for a reusable copy. This café website does not currently run customer accounts, so this right will rarely apply.
Right to object
You can object to processing based on legitimate interests. We will stop unless we have compelling grounds or need the data for a legal claim. You can always object to direct marketing. We do not send marketing emails from this website.
Rights around automated decisions
We do not make solely automated decisions that produce legal or similarly significant effects.
Right to withdraw consent
Where we rely on consent (optional fonts and the map), you can withdraw it at any time using Cookie settings. Withdrawal does not affect processing already carried out.
Right to complain
Please contact us first so we can put things right. You can also complain to the ICO at ico.org.uk/make-a-complaint or 0303 123 1113.
3. How to make a request
Write to Oak & Ivy Coffee House, 6a Tobermore Rd, Draperstown, Magherafelt BT45 7AG, visit us Monday–Saturday 9:00–15:30, or message our official Instagram or Facebook page. Please say which right you want to use and enough detail for us to find your information.
We may need to confirm your identity if the request is sensitive or unclear. We will not charge a fee unless a request is manifestly unfounded or excessive.
Usual deadline: one month from receipt. We can extend by two months for complex or numerous requests and will tell you if we need to.
4. What we hold in practice
For most website visitors who reject optional tools, we may only have a short hosting log and the consent record on your own device. If you messaged us, paid in the café, applied for a job or were involved in an incident, we may hold more. We will tell you what we find.
5. ICO registration
Some small organisations are exempt from paying the ICO data protection fee. Others must pay. That is a business registration matter and does not change your rights. Details: ICO data protection fee.