Your privacy.

1. Who we are

Krem Delights Ltd, trading as Krem Gelateria & Café

Bridge Street, Westport, Co. Mayo, Ireland

privacy@krem.ie · www.krem.ie

For the purposes of the GDPR, Krem Delights Ltd is the Data Controller.

2. How we collect personal data

We collect personal data when you:

• Visit our café (including payments, loyalty sign-ups, and CCTV recording)
• Place an order through our website or online shop
• Join or use our loyalty programme
• Purchase or redeem gift cards or vouchers
• Contact us via email, social media, or website forms
• Apply for a job via our website or in person

3. What personal data we collect

Customers (in-store and online):

• Name
• Email address
• Mobile phone number (where provided, including for participation in the Square Loyalty programme)
• Order and purchase history
• Loyalty programme data (points, rewards, redemptions)
• Payment information (processed securely by Square; we do not store card details)
• Technical data such as IP address, browser type, device type, and website usage (via cookies)

Job applicants: name and contact details; CV / employment history; references and qualifications; any additional information you choose to provide.

4. How we use your data

We use personal data to:

• Process and fulfil orders (in-store and online)
• Manage payments, refunds, and transactions
• Operate our Square Loyalty programme, including identifying loyalty members, tracking rewards, and communicating reward status by email or SMS
• Communicate with you regarding orders, services, or enquiries
• Send marketing communications where you have given consent
• Improve our services and customer experience
• Manage recruitment and job applications
• Comply with legal, tax, and regulatory obligations

5. Legal basis for processing

We process personal data under one or more of the following legal bases:

• Contractual necessity – to fulfil orders, payments, loyalty benefits, and services
• Consent – for marketing communications by email or SMS
• Legal obligation – accounting, tax, and regulatory compliance
• Legitimate interests – operating our business, ensuring security, preventing fraud, and managing recruitment

6. How we store and protect your data

We implement appropriate technical and organisational measures to protect personal data, including:

• Secure and encrypted systems provided by Square and other GDPR-compliant service providers
• Restricted access to personal data
• Password-protected systems and secure storage
• Regular review of data protection practices

In the event of a personal data breach, we will notify affected individuals and the relevant supervisory authority where legally required.

7. Sharing your data

We may share personal data with trusted third parties where necessary, including:

• Square (POS, payments, online ordering, and loyalty services)
• Email service providers (order confirmations and communications)
• Delivery or courier partners (if applicable)
• Recruitment or HR service providers (if used)
• Legal, regulatory, or law enforcement authorities where required by law

We do not sell or rent personal data to third parties.

8. Data retention

We retain personal data only for as long as necessary:

• Order and transaction records: up to 6 years
• Loyalty programme data: until inactive for 24 months
• Job applications: up to 12 months after recruitment completion, unless consent is given to retain longer
• Marketing data: until consent is withdrawn

Personal data is securely deleted or anonymised after these periods.

9. CCTV policy

Krem Gelateria & Café operates Closed Circuit Television (CCTV) systems at our premises for the following purposes:

• Protecting the safety and security of customers, staff, and visitors
• Preventing and detecting crime, theft, or anti-social behaviour
• Investigating incidents and supporting insurance or legal claims

Cameras are positioned to minimise intrusion and are not used for staff performance monitoring.

Legal basis: the legal basis for processing CCTV footage is Article 6(1)(f) GDPR — legitimate interests in ensuring safety and protecting people and property.

Access to CCTV footage is strictly limited to authorised personnel. Footage may be disclosed to An Garda Síochána or other authorities where required by law; to insurers or legal advisers following an incident; and to individuals making a valid data subject access request.

Retention: CCTV footage is retained for a maximum of 30 days, unless required for an investigation, legal claim, or insurance matter, in which case it may be retained until the matter is resolved.

Your rights: you may request access to CCTV footage in which you appear by contacting privacy@krem.ie, providing the date and approximate time, the location within the premises, and proof of identity.

10. Cookies and website analytics

Our website uses cookies to:

• Enable essential website functionality
• Improve website performance and user experience
• Collect anonymised analytics data

You can control cookies through your browser settings.

11. Marketing communications

Where you have provided consent, we may contact you by email or SMS regarding:

• Loyalty rewards and account activity
• Promotions, offers, or events

Mobile phone numbers collected for the Square Loyalty programme may be used for transactional or reward-related messages.

You can withdraw consent or opt out at any time by using the unsubscribe link in emails, following opt-out instructions in SMS messages, or contacting us at privacy@krem.ie.

12. International data transfers

Some service providers (including Square) may process personal data outside the European Economic Area (EEA). Such transfers are safeguarded using Standard Contractual Clauses or other GDPR-approved mechanisms.

13. Job applications

Personal data submitted as part of a job application is used solely for recruitment purposes and is not used for marketing. Data is retained only for the period outlined in this policy.

14. Your data protection rights

You have the right to:

• Access your personal data
• Rectify inaccurate or incomplete data
• Request erasure where applicable
• Restrict or object to processing
• Data portability
• Withdraw consent at any time

Requests may be submitted to privacy@krem.ie.

You also have the right to lodge a complaint with the Data Protection Commission (Ireland) at www.dataprotection.ie.

15. Changes to this policy

We may update this Privacy Policy from time to time. The most current version will always be available on our website.

16. Contact us

Krem Delights Ltd t/a Krem Gelateria & Café

Bridge Street, Westport, Co. Mayo, Ireland

privacy@krem.ie · www.krem.ie