Privacy Notice

Effective date: 22 July 2026

Privacy at a glance

We use your information to take payment, deliver orders, manage subscriptions, provide customer support and keep products safe.

We share only what is needed with providers such as our ecommerce platform, payment processors, subscription platform, couriers, IT providers and professional advisers.

We use non-essential analytics and advertising technologies only in accordance with your cookie choices.

You can unsubscribe from marketing at any time.

You have rights over your personal information and may complain to the Information Commissioner's Office.

Privacy questions: info@boteane.co.

Full privacy notice

1. Controller and contact details

Boteane LTD, company number 13218679, of 71-75 Shelton Street, Covent Garden, London, United Kingdom, WC2H 9JQ, is the controller of the personal information described in this Notice. Contact: info@boteane.co. Boteane LTD will complete the ICO data-protection fee self-assessment and, if registration is required, will publish its ICO registration number once confirmed.

2. Information we collect

Identity and contact information: name, billing and delivery address, email, telephone number and gift-recipient information.
Order and transaction information: products, prices, discounts, returns, refunds, gift messages, customs details and order history.
Payment information: payment status, method and transaction reference. Complete card information is normally handled by the payment provider rather than Boteane.
Account and subscription information: login details, preferences, renewal dates, skips, pauses, cancellations and account credits.
Customer-service information: messages, complaint details, photographs, call notes and First Match Concierge preferences. Calls are not recorded unless we tell you and have a lawful basis.
Food and product-safety information: batch or lot codes, allergy or incident information voluntarily provided, and recall or investigation records.
Marketing and preference information: subscriptions, opt-outs, campaign interactions and interests.
Technical and usage information: IP address, device, browser, cookie identifiers, pages viewed and security logs, subject to cookie rules where applicable.
Review and user-content information: reviews, ratings, photographs, social handles and moderation records.

3. How we collect information

We collect information directly from you when you browse, order, create an account, subscribe, contact us, join marketing, leave a review or use the concierge service. We also receive information from ecommerce, payment, subscription, fraud-prevention, delivery, analytics, advertising and customer-service providers, and from gift purchasers or recipients where relevant.

4. Purposes and lawful bases

Process orders, payments, delivery, returns and subscriptions: contract; legal obligation where applicable.
Provide accounts, customer support and concierge recommendations: contract; legitimate interests in effective service.
Prevent fraud, secure the website and enforce terms: legitimate interests; legal obligation.
Maintain tax, accounting and transaction records: legal obligation.
Manage food safety, product safety, traceability, complaints and recalls: legal obligation; public interest in safety; legitimate interests.
Send service messages, renewal reminders and safety notices: contract; legal obligation; legitimate interests.
Send marketing about similar Boteane products where the soft opt-in applies: legitimate interests together with the PECR soft opt-in, always with an opt-out.
Send marketing based on consent: consent.
Use non-essential cookies, pixels and similar technologies: consent under PECR and UK data-protection law.
Improve products, website and service using proportionate analysis: legitimate interests; consent where cookie rules require it.
Establish, exercise or defend legal claims: legitimate interests; legal obligation where applicable.

5. Marketing

We send email or electronic marketing to individuals only with consent or where the products-and-services soft opt-in applies. The soft opt-in is used only where we obtained contact details directly during a sale or genuine sales negotiation, market our own similar products, gave a clear opt-out when collecting the details and include a simple opt-out in every message.

You can unsubscribe at any time using the link in a message or by contacting us. We maintain a suppression record so we can respect the request. Service communications, safety notices and subscription reminders are not marketing merely because they use the same contact details.

6. Who we share information with

Ecommerce hosting, checkout and customer-account providers, including our Shopify storefront infrastructure.
Payment processors, banks and fraud-prevention providers.
Subscription-management and account-credit providers.
Couriers, postal operators, fulfilment providers, customs brokers and destination authorities.
Email, customer-support, cloud, security and IT service providers.
Analytics, advertising and social-media providers where your consent or another lawful basis permits.
Tea brands, manufacturers, suppliers, laboratories, insurers or regulators where needed for a product-quality or safety investigation.
Accountants, lawyers, insurers, auditors and other professional advisers.
Police, courts, regulators, tax authorities and public bodies where required or permitted by law.
A purchaser, investor or successor in a genuine business transaction, subject to confidentiality and data-protection safeguards.

7. International transfers

Some providers may process personal information outside the United Kingdom. Where a restricted transfer occurs, we use a lawful transfer mechanism, such as UK adequacy regulations, the UK Extension to the EU-US Data Privacy Framework where applicable, the International Data Transfer Agreement, the UK Addendum to approved contractual clauses, or another permitted safeguard. Contact us for further information about the relevant safeguard.

8. How long we keep information

Order, payment, tax and accounting records: normally 6 years from the end of the relevant financial year, or longer where law, a tax enquiry or legal claim requires.
Active account and subscription records: for the life of the account or subscription, then for a proportionate period needed for support, fraud prevention and legal claims.
Customer-service and flavour-promise claims: normally up to 24 months after closure, unless linked to safety, litigation or a longer legal requirement.
Food and product-safety, incident and recall records: for the period reasonably required for traceability, product life, safety obligations, insurance and legal claims.
Marketing records: until you opt out or consent is withdrawn, with a minimal suppression record retained to respect the choice.
Cookie and analytics data: for the period shown in the live cookie settings and provider configuration.
Security logs: for a proportionate period based on risk, normally no longer than necessary to detect and investigate incidents.

9. Your rights

Depending on the circumstances, you may have rights to be informed, access your information, correct it, erase it, restrict its use, object to processing, receive portable data and withdraw consent. You also have an absolute right to object to direct marketing. Some rights are limited where information must be kept for law, safety, fraud prevention or legal claims.

To exercise a right, contact info@boteane.co. We may ask for proportionate information to verify identity. You may complain to the Information Commissioner's Office at ico.org.uk. We would appreciate the opportunity to address the concern first.

10. Children

The shop is not directed at children and we do not knowingly create customer accounts for children without appropriate adult involvement. An adult should place purchases for a child.

11. Security

We use appropriate technical and organisational measures designed to protect personal information. No internet system is completely secure. Please use a strong, unique password and tell us promptly about suspected account misuse.

12. Changes to this Notice

We may update this Notice. We will publish the revised date and draw attention to material changes where appropriate. We will provide new privacy information before using personal information for a materially new purpose where required.