Here is a comprehensive, plain-English Privacy Policy tailored specifically for The Carb Club website (www.thecarbclub.co.uk).

It is designed to comply with UK GDPR and the Data Protection Act 2018, keeping your customers' data safe while maintaining the clear, honest, and unpretentious tone of your brand.

PRIVACY POLICY

Last Updated: 14 October 2026

Welcome to The Carb Club (www.thecarbclub.co.uk). We take our food seriously, and we take your privacy just as seriously. This Privacy Policy explains how we collect, use, store, and protect your personal data when you visit our website, order merchandise, sign up for event updates, or interact with us online.

When we say "we," "us," or "our," we are referring to The Carb Club.

1. Important Information & Who We Are

The Carb Club is the data controller responsible for your personal data collected through this website.

If you have any questions about this Privacy Policy or how we handle your personal information, please get in touch with us:

2. The Data We Collect About You

We may collect, use, store, and transfer different kinds of personal data about you, which we have grouped together as follows:

  • Identity Data: Includes your name, username, title, or similar identifier.

  • Contact Data: Includes your billing address, delivery address, email address, and telephone number.

  • Financial & Transaction Data: Includes payment card details (processed securely via third-party payment gateways; we do not store full credit card numbers on our servers) and details about products, food orders, or merchandise you have purchased from us.

  • Technical Data: Includes your internet protocol (IP) address, browser type and version, time zone setting, browser plug-in types, operating system, and platform.

  • Usage Data: Information about how you use our website, products, and services.

  • Marketing & Communications Data: Your preferences in receiving marketing/newsletter updates from us and your communication preferences.

3. How We Collect Your Personal Data

We collect data from and about you through:

  • Direct Interactions: You give us your Identity, Contact, and Financial Data when you:

    • Purchase merchandise or book tickets for event pop-ups on our site.

    • Subscribe to our mailing list or newsletter.

    • Contact us via web form, email, or social media.

    • Enter a competition, promotion, or survey.

  • Automated Technologies: As you interact with our website, we may automatically collect Technical Data about your equipment, browsing actions, and patterns via cookies and similar technologies (see Section 8).

4. How We Use Your Personal Data

We will only use your personal data when the law allows us to. Most commonly, we use your personal data in the following circumstances:

  1. To Fulfill Orders: To process and deliver merchandise, event tickets, or pop-up pre-orders you place on www.thecarbclub.co.uk.

  2. To Communicate With You: To send order confirmations, shipping updates, or respond to customer service inquiries.

  3. Marketing: With your explicit consent, to send you news about upcoming pop-ups, guest slots, menu launches, and merch drops. You can unsubscribe at any time using the link at the bottom of any email.

  4. Legitimate Interests: To improve our website, products, and services, and to prevent fraud.

  5. Legal Obligations: Where we need to comply with a legal or regulatory requirement.

5. Sharing Your Personal Data

We never sell your personal data to third parties.

However, we may share your data with trusted service providers who help us run our business and serve you, including:

  • E-commerce & Web Platforms: (e.g., Shopify, Squarespace, or WooCommerce).

  • Payment Processors: Secure gateways such as Stripe, PayPal, or Apple Pay.

  • Fulfillment & Delivery Partners: Royal Mail or courier services to deliver merch to your door.

  • Marketing Platforms: Email distribution platforms (e.g., Mailchimp or Klaviyo) to send newsletter updates you opted into.

  • Professional Advisers & Legal Bodies: Auditors, accountants, regulators, or legal authorities if required by law.

All third-party service providers are required to respect the security of your personal data and treat it in accordance with UK law.

6. Data Security

We have put in place appropriate security measures to prevent your personal data from being accidentally lost, used, accessed in an unauthorized way, altered, or disclosed. Access to your personal data is limited strictly to staff and partners who need to know it to run our operations.

7. Data Retention

We will only retain your personal data for as long as necessary to fulfill the purposes we collected it for, including satisfying any legal, accounting, or reporting requirements (such as holding tax records for sales).

8. Cookies

Our website uses cookies and similar tracking technologies to distinguish you from other users, personalize your browsing experience, and analyze site traffic.

You can set your browser to refuse all or some browser cookies, or to alert you when websites set or access cookies. Note that if you disable or refuse cookies, some parts of this website may become inaccessible or not function properly.

9. Your Legal Rights (UK GDPR)

Under UK data protection laws, you have rights regarding your personal information, including the right to:

  • Access: Request a copy of the personal data we hold about you.

  • Correction: Request correction of any incomplete or inaccurate data.

  • Erasure ("Right to be Forgotten"): Request that we delete or remove personal data where there is no good reason for us continuing to process it.

  • Object / Restrict: Object to or request restriction of our processing of your personal data.

  • Withdraw Consent: Withdraw your consent at any time where we rely on consent to process your personal data (e.g., unsubscribing from marketing emails).

To exercise any of these rights, please email us at mark@threechordscoaching.com If you are not satisfied with how we handle your data, you have the right to lodge a complaint with the UK Information Commissioner’s Office (ICO) at www.ico.org.uk. (We’d appreciate the chance to deal with your concerns first, so please contact us directly!).

10. Changes to This Privacy Policy

We keep our Privacy Policy under regular review. Any updates will be posted directly on this page with an updated "Last Updated" date.

Privacy policy