Privacy notice

Cafe Jade · guest WiFi · last updated 11 August 2026

This notice explains what the Cafe Jade guest WiFi collects about you, why, where it is kept, and what you can do about it. The short version: an email address, the minimum of technical data needed to run the network, nothing sold, nothing tracked across the web, and everything kept in the United Kingdom.

What we collect, and why

Data	Why	Lawful basis	Kept for
Email address	To identify your session and deal with misuse of the network	Our legitimate interests in running the service you asked for	While you keep using us; reviewed after 24 months without a visit
Email address, for marketing	To send you the venue's newsletter	Your consent, given by ticking the optional box (as required by the Privacy and Electronic Communications Regulations)	Until you unsubscribe
Device address (MAC), IP address, browser type, connection times	To run the network, apply time limits, and investigate misuse	Our legitimate interests	12 months
Access codes you redeem	To apply the daily limit fairly	Our legitimate interests	12 months
Aggregated usage statistics (e.g. sign-ins per day)	To understand how busy the WiFi is and improve it	Our legitimate interests	Indefinitely — they are anonymised and contain nothing about you

What we deliberately do not do

No advertising trackers, no cross-site tracking, no fingerprinting, no Google or Meta analytics, pixels or tag managers — on principle. Any statistics we keep are aggregated and anonymised before they are stored, so they cannot be traced back to you. We never sell your details, and we do not share them for anyone else's marketing.

Who is responsible, and who sees it

The service is run day to day by the venue and its technology supplier. For the purposes of UK data protection law, Cafe Jade LTD (the operator of Cafe Jade) is the data controller, and Kazap Technologies Limited, which builds and operates the WiFi service on the venue's behalf, is the data processor acting only on the controller's instructions. Nobody else has access to your personal data. Staff see nothing beyond what they need to help you get online.

Where your data lives

All personal data is stored on servers located in the United Kingdom (hosted with DigitalOcean in London) and is not transferred outside the UK. Two service providers are involved in running the network itself: DigitalOcean provides the hosting, and Cloudflare provides domain name services, including the family-safe DNS resolver this network uses for content filtering. Cloudflare processes DNS lookups as network traffic and may produce aggregated, anonymised statistics from them; those lookups are not stored against you and do not identify you to us or to Cloudflare.

Content filtering

This network filters domain lookups to block malware and adult content, using a third-party filtering service. That means some websites will not load. Filtering is applied to the network as a whole and is not recorded against you personally.

Your rights

Under the UK GDPR and the Privacy and Electronic Communications Regulations you may ask us to:

give you a copy of the personal data we hold about you
correct it if it is wrong
delete it
restrict or object to how we use it
provide it in a portable format
stop sending you marketing — you can withdraw consent at any time, and withdrawing it does not affect your WiFi access

To do any of these, unsubscribe from any newsletter or speak to any member of staff. If you are not happy with how we have handled it, you can complain to the Information Commissioner's Office (ICO).

Automated decisions

We do not make automated decisions about you that produce legal effects. Time limits are applied uniformly to every guest.

Changes

If this notice changes, the updated version appears here.