Cafform — Privacy Policy

Version 1.7 — In effect since August 20, 2026

Who is responsible for your data

ELKADRI & CO LTD, trading as Cafform, is responsible for the personal information described in this policy.

ELKADRI & CO LTD is a private limited company registered in England and Wales. Our business and contact details are available on our Contact Information page.

For privacy questions or requests, email support@cafform.com.

What we collect

• Order information — your name, email address, delivery address, billing address, phone number if provided, products purchased, order value, currency and order history.
• Payment information — payment is processed by our payment service providers. We receive information such as payment status, card type and limited payment details. We do not receive or store your full payment card number.
• Account information — if you use a customer account, information associated with that account and your order history.
• Communications — emails, contact-form submissions, return requests, warranty claims and other messages you send us.
• Shipping and fulfilment information — information needed to prepare, deliver, track and, where necessary, return your order.
• Technical and usage information — such as IP address, browser type, device information, cookie identifiers, pages viewed, referring pages, interactions with the store and similar information generated when you use cafform.com.
• Advertising and measurement information — when advertising or measurement services are enabled, this may include advertising click identifiers, campaign information, product views, checkout activity, purchases and other conversion events.

Where the information comes from

Most personal information comes directly from you when you place an order, use an account, request a return, make a warranty claim or contact us.

Technical, usage and advertising information may be collected automatically through Shopify, cookies, pixels, tags and similar technologies when those services are enabled.

We may also receive information from payment providers, shipping carriers, fulfilment providers and advertising or measurement services in connection with transactions and store activity.

Why we use your information

We use personal information where necessary to operate Cafform and provide our services, including:

• taking and processing orders
• processing payments and refunds
• packing, shipping, tracking and delivering orders
• handling returns, cancellations and warranty claims
• providing customer support
• detecting and preventing fraud, abuse and security incidents
• maintaining transaction, tax and accounting records
• operating, securing and improving cafform.com
• measuring the effectiveness of advertising and marketing
• understanding how customers interact with our store
• showing or measuring advertising where permitted
• complying with applicable legal and regulatory obligations

Legal bases where UK data-protection law applies

Where UK data-protection law applies to our processing, we rely on one or more of the following legal bases depending on the activity:

• Contract — where processing is necessary to take steps at your request or perform our contract with you, such as processing, delivering or returning an order.
• Legal obligation — where we must retain or use information to comply with tax, accounting, fraud-prevention or other legal requirements.
• Legitimate interests — where appropriate for purposes such as protecting the store, preventing fraud, providing customer service, understanding store performance and improving our services, provided those interests are not overridden by your rights.
• Consent — where consent is required for non-essential cookies, advertising technologies or another particular use of personal information. Where processing relies on consent, you may withdraw that consent.

Who we share information with

We share personal information only where necessary for the purposes described in this policy.

• Shopify — our ecommerce platform, which hosts and operates significant parts of the store, checkout and customer-account infrastructure.
• Payment service providers — to authorise payments, process transactions and issue refunds.
• Red Stag Fulfillment — our fulfilment partner in Sweetwater, Tennessee, which receives information necessary to pack and ship orders and receive authorised returns.
• Shipping carriers — including carriers such as UPS and FedEx, which receive information necessary to deliver, track and return parcels.
• Google — when Google services are connected or enabled, including Google & YouTube, Google Merchant Center, Google Ads or Google Analytics, information may be shared for product listings, advertising, campaign measurement, analytics, conversion measurement and related services.
• Professional and legal service providers — where reasonably necessary for accounting, legal compliance, dispute resolution, fraud prevention or protection of our rights.
• Government or regulatory authorities — where disclosure is required or permitted by applicable law.

We do not sell personal information for money.

Google advertising and measurement

Cafform may use Google services to advertise products and measure the effectiveness of advertising, including Google Ads and services connected through Shopify's Google & YouTube channel.

When enabled, Google technologies may collect or receive information such as:

• the pages and products you view
• your device and browser information
• IP address and related technical information
• advertising click identifiers
• checkout and purchase events
• order value, currency and product information associated with measured conversions

Google advertising and conversion-measurement technologies may use cookies or similar identifiers to understand whether a visit or purchase resulted from an advertisement.

If we enable enhanced conversion or similar measurement features, certain first-party customer information may be processed in hashed or otherwise protected form before being transmitted to the relevant advertising service, subject to the configuration and consent requirements that apply.

Google's own use of information is governed by its applicable privacy terms and policies.

Shopify and Shopify Network Intelligence

Shopify processes personal information as our ecommerce platform and may process information in accordance with its own privacy terms and the settings enabled for our store.

If Shopify Network Intelligence or related Shopify enhanced services are enabled, Shopify may use information about interactions with our store together with information from its wider network to provide services such as fraud protection, store personalisation, performance insights and advertising-related features.

You can learn more about Shopify's processing and exercise certain choices directly through the Shopify Privacy Portal.

Targeted advertising and data sharing

Depending on the advertising and Shopify features enabled for the store, certain processing may be considered targeted advertising, sharing, or a sale under some privacy laws even where no money is paid for the information.

We do not sell personal information for money.

Where applicable, you may opt out of certain data sharing or targeted advertising through our data sharing opt-out page.

You may also email support@cafform.com with a privacy or opt-out request.

Cookies and similar technologies

cafform.com uses cookies and similar technologies for functions that may include:

• keeping the site and checkout working
• maintaining your cart and session
• security and fraud prevention
• remembering permitted preferences
• understanding store performance
• analytics and measurement
• advertising and conversion measurement when those services are enabled

Some cookies are necessary for the store to function. Other cookies or tracking technologies may be non-essential and may be controlled through our privacy or cookie settings where required.

You can also control or delete cookies through your browser. Blocking necessary cookies may prevent parts of the store or checkout from functioning correctly.

Consent and privacy choices

Where applicable, our cookie or privacy banner allows you to manage consent for non-essential technologies.

When consent is required, advertising or analytics technologies are handled according to the consent choices recorded through our store's privacy settings and integrations.

You may change available privacy preferences through the controls provided on cafform.com or contact us at support@cafform.com.

Global Privacy Control

Where required and supported by our privacy configuration, we recognise applicable browser-based opt-out signals such as Global Privacy Control in connection with data sharing or targeted advertising choices.

How long we keep information

We retain personal information only for as long as reasonably necessary for the purposes for which it was collected, including customer support, warranty administration, fraud prevention and legal, accounting or tax requirements.

Our general retention periods are:

• Order and transaction records — generally retained for up to 7 years where needed for accounting, tax, transaction or legal record-keeping.
• Support communications — generally retained for up to 2 years, unless a longer period is necessary for an active order, dispute, warranty claim, legal obligation or other legitimate reason.
• Customer account information — retained while the account remains active and afterwards where necessary for legal, transaction or security purposes.

Where information is no longer required, we delete, anonymise or otherwise dispose of it as appropriate.

Your privacy rights

Your rights depend on the laws that apply to you and to the particular processing activity.

Depending on your location and applicable law, you may have rights to:

• request access to personal information we hold about you
• receive a copy of certain personal information
• correct inaccurate or incomplete information
• request deletion of information in circumstances where a deletion right applies
• request restriction of certain processing
• receive certain information in a portable format
• object to certain processing
• withdraw consent where processing is based on consent
• opt out of certain targeted advertising, sale or sharing of personal information where applicable
• challenge our compliance or make a complaint to an applicable privacy regulator
• exercise applicable privacy rights without unlawful discrimination or retaliation

How to exercise your rights

Email support@cafform.com and describe the privacy right or request you want to exercise.

We may need to verify your identity before disclosing, correcting or deleting personal information. We request only information reasonably necessary for verification.

You may use an authorised representative where applicable. We may request reasonable evidence that the representative has authority to act for you.

How quickly we respond

We aim to respond to verified privacy requests as quickly as reasonably possible and within the deadline required by applicable law.

For access requests subject to Canadian PIPEDA requirements, the normal response period is 30 days, subject to permitted extensions.

Where UK data-protection law applies, applicable access requests are generally handled within one month, subject to any lawful extension.

Privacy complaints

If you have a concern about how we handle personal information, please contact us first at support@cafform.com so that we can review it.

Depending on the law that applies, you may also have the right to complain to a privacy or data-protection authority, including the UK Information Commissioner's Office, the Office of the Privacy Commissioner of Canada, an applicable Canadian provincial privacy authority, or another competent regulator.

Sensitive information

We do not intentionally request sensitive personal information such as health information, biometric information, racial or ethnic origin, religious beliefs or precise geolocation for ordinary purchases.

Please do not send sensitive personal information unless it is genuinely necessary for a request and we have asked you to provide it.

Children

Cafform sells coffee machines to adults and is not directed to children.

We do not knowingly collect personal information from children for the purpose of selling our products. If you believe a child has provided us with personal information inappropriately, contact support@cafform.com.

International processing and transfers

ELKADRI & CO LTD is established in the United Kingdom, while Cafform serves customers in the United States and Canada and uses service providers that may operate in those and other countries.

As a result, personal information may be accessed, processed or stored in countries other than the country where you live.

Where applicable data-protection law requires safeguards for an international transfer, we use the transfer mechanism or safeguard required for that transfer or rely on another lawful basis permitted by applicable law.

Service providers may also process personal information under their own applicable privacy terms and legal obligations.

Security

We use reasonable administrative, technical and organisational measures to protect personal information appropriate to the nature of the information and the services we operate.

Payment card processing is handled by payment providers and Cafform does not receive or store full card numbers.

No online service can guarantee absolute security.

Data breaches

If a security incident involving personal information occurs, we investigate it and take appropriate steps to contain and address it.

Where applicable law requires notification to affected individuals, privacy regulators or other authorities, we will make the required notifications.

Notice at collection

This policy describes the principal categories of personal information we collect, the purposes for which we use it, the categories of parties with whom it may be shared, applicable privacy choices and how to contact us.

Additional notices or choices may also be displayed at checkout, through a cookie banner, through privacy settings or at another point where information is collected.

Changes to this policy

We may update this Privacy Policy when our services, technology, providers or legal obligations change.

The version number and effective date at the top of this page identify the version currently in effect.

Where appropriate, we may provide additional notice of a material change.

Contact

Privacy questions and requests may be sent to support@cafform.com.

Our full business and contact information is available on our Contact Information page.