Privacy Policy
Last updated: 23 September 2026
This policy explains what personal data we collect when you visit bobabot.co.uk, order at order.bobabot.co.uk or at our kiosk, join our stamp card or mailing list, and what we do with it. We collect as little as we can: you don't need an account to order.
1. Who we are
BobaBot is run by Roboccino Limited, a company registered in England and Wales (company number 13306950), registered office 13 Eastern Avenue, Pinner, HA5 1NW. We are the "controller" of your personal data.
Questions or requests about your data: hello@bobabot.co.uk.
2. What we collect
| Data | When | Required? |
|---|---|---|
| A short name for your order (a first name or nickname for the screen, like the name on a coffee cup; it doesn't need to be your real or full name) | When you order | Optional |
| Your order: drinks, customisations, price, date and time, order number | When you order | Yes |
| Payment details: card details go directly to Square. We never see or store your full card number. We receive a payment reference, card type and last four digits. | When you pay | Yes |
| Mobile number | If you ask for a text when your drink is ready, or use the stamp card | Optional |
| Email address | If you ask for an email receipt, or join our mailing list | Optional |
| Stamp card details: stamps earned, rewards, number of orders and the dates of your first and last order, linked to your mobile number | When you order with your mobile number | Optional |
| Technical data: when you visit our websites, our hosting and security systems automatically record basic information such as your IP address, browser type and the time of your visit | When you visit | Automatic |
| Website usage data (pages viewed, device and browser type, approximate location from your IP address) via Google Analytics | Only if you choose "Accept all" on our cookie banner | Optional |
Good to know: if you give your mobile number for a "your drink is ready" text, we also use it to add stamps to your stamp card automatically, so you don't miss rewards. If you'd rather we didn't keep a stamp card for you, email us and we'll remove it.
3. How we use it, and why we're allowed to
| Purpose | Legal basis |
|---|---|
| Taking payment, making your drink, showing your name when it's ready, and sending the texts or receipt you asked for | Contract: we need it to fulfil your order |
| Running the stamp card and sending your one-time login codes | Legitimate interests: rewarding repeat customers. You can opt out at any time. |
| Sending news, new drinks and discount codes by email | Consent: only if you sign up. Unsubscribe at any time. |
| Understanding how our website is used (Google Analytics) | Consent: only if you choose "Accept all" |
| Handling problems, refunds and complaints, and preventing fraud and misuse of codes | Legitimate interests |
| Keeping our websites and ordering system secure and working properly | Legitimate interests |
| Keeping sales and tax records | Legal obligation |
We don't sell your data, and we don't use it for automated decisions that have legal or similarly significant effects on you.
4. Who we share it with
We use trusted service providers who process data only on our instructions:
- Square: card payments, email receipts and order records.
- Twilio: text messages (order updates and stamp card codes).
- Mailgun (EU region): transactional emails, such as welcome discount codes.
- MailerLite: our mailing list, if you sign up.
- Amazon Web Services (London region): hosting our ordering system and database.
- Google: Google Analytics (only with your consent), and Google Fonts, which your browser loads from Google.
- Internal team tools we use to handle orders and support (for example, staff alerts that may include your order name).
We may also share data if the law requires it, or to protect our customers, staff or business.
5. International transfers
Some of our providers (for example Twilio, MailerLite and Google) may process data outside the UK, including in the United States. Where they do, we rely on the protections required by UK law, such as the UK International Data Transfer Addendum or the UK–US "data bridge".
6. How long we keep it
- Order and payment records: 6 years, for tax and accounting.
- Mobile number, email address and stamp card details: up to 5 years after your last order, or sooner if you ask us to delete them. (Stamps themselves expire after 12 months without a new stamp.)
- Mailing list: until you unsubscribe or ask us to remove you.
- Google Analytics data: 14 months.
7. Cookies and similar technology
bobabot.co.uk: we store your cookie choice on your device. Google Analytics cookies
(_ga, _ga_*, lasting up to 2 years) are only set if you choose "Accept all".
You can change your mind at any time with Cookie settings.
order.bobabot.co.uk: we use what's needed for the site to work, such as remembering your basket, your preferences and your cookie choice. When you pay, the card form is provided by Square, not by us. To keep payments secure and prevent fraud, Square may save a small amount of technical information in your browser (for example, a device identifier). This is controlled by Square and covered by Square's privacy notice. Google Analytics is only used there if you choose "Accept all".
You can also block or delete cookies in your browser settings, and opt out of Google Analytics on all websites with Google's opt-out tool.
8. Your rights
You have the right to:
- ask for a copy of your data;
- ask us to correct or delete it;
- object to, or ask us to restrict, how we use it;
- ask for your data in a portable format;
- withdraw consent at any time, for example by unsubscribing or changing your cookie settings.
Email hello@bobabot.co.uk, or write to Roboccino Limited, 13 Eastern Avenue, Pinner, HA5 1NW. We'll reply within one month. Please include your mobile number or email address so we can find your data.
If you're unhappy with how we've handled your data, you can complain to the Information Commissioner's Office: ico.org.uk or 0303 123 1113. We'd appreciate the chance to put things right first.
9. Marketing
We only send marketing emails if you sign up. Every email has an unsubscribe link, or you can email us. We don't send marketing texts. Texts are only for your order and your stamp card.
10. Children
Our drinks are for everyone, but our mailing list is for people aged 13 and over. If you're under 13, please ask a parent or guardian before giving us your details.
11. Keeping your data safe
We use secure, encrypted connections. Card payments are handled by Square. Stamp card login codes are stored in a protected (hashed) form and expire after a few minutes. Only authorised staff can see customer details.
12. Changes to this policy
We may change this policy from time to time, for example if we add new services or the law changes. The latest version will always be on this page, with the date at the top. If we make a significant change, we'll make it clear on our website.