Privacy policy
Privacy Policy
Last updated: 22 May 2026
This Privacy Policy explains how DREAM BREW LIMITED (trading as DreamBrew) handles personal information when you visit dreambrew.com, place an order, sign up to our waitlist, or interact with us. It's written to comply with the UK GDPR, the Data Protection Act 2018, and the Data (Use and Access) Act 2025.
1. Who is the controller of your data
DREAM BREW LIMITED (registered in England and Wales, trading as DreamBrew).
- Registered company name: DREAM BREW LIMITED
- Company number: 15982899 (incorporated 27 September 2024)
- Trading name: DreamBrew
- Registered address: Seven Grange Lane, Pitsford, Northampton, NN6 9AP, United Kingdom
- Privacy contact: hello@dreambrew.com
DREAM BREW LIMITED is the data controller for the personal information described in this Policy.
2. What personal information we collect
We collect different categories depending on how you interact with us.
When you visit the website
- Cookies and similar identifiers (see our Cookie Policy below).
- IP address, browser type, device type, pages viewed, time spent.
- Referrer URL (which site you came from).
When you join our waitlist or newsletter
- Email address.
- Marketing preferences (opted in / opted out).
When you place an order
- Name, billing address, delivery address, email, phone.
- Order details and history.
- Payment confirmation reference (we don't store full card numbers — that's handled by Shopify Payments and your bank).
- Communications with our customer support.
When you create an account
- All of the above, plus the password hash (never the password itself).
When you contact us
- Whatever you share in your message (email, chat, social).
We don't intentionally collect special-category data (health, religion, ethnicity, etc.). Please don't share special-category data with us unless absolutely necessary.
3. Why we process your data, and our lawful basis
We rely on the following lawful bases under UK GDPR Article 6:
| Purpose | Lawful basis |
|---|---|
| Processing your order, taking payment, dispatching, dealing with returns | Contract (Article 6(1)(b)) |
| Sending order confirmations, dispatch notices, delivery updates | Contract |
| Account management and customer support | Contract |
| Email marketing to existing customers about similar products | Soft opt-in under PECR + Legitimate Interest |
| Email marketing to waitlist signups | Consent (Article 6(1)(a)) |
| SMS marketing | Consent |
| Cookies and tracking beyond strictly necessary | Consent (PECR) |
| Fraud prevention and security | Legitimate Interest |
| Complying with tax, accounting and consumer-law obligations | Legal obligation (Article 6(1)(c)) |
| Defending or pursuing legal claims | Legitimate Interest |
| Aggregated, anonymised analytics for business decisions | Legitimate Interest |
You can withdraw any consent at any time by emailing hello@dreambrew.com or using the unsubscribe link in any marketing email.
4. Who we share your data with
We share personal data only with carefully selected processors and partners under written agreements (UK GDPR Article 28). Categories:
- Shopify — hosts the storefront, processes orders and payments (via Shopify Payments), and holds your account data. Shopify Privacy Policy.
- Bretton Foods Sp. z o.o. (Poland) — manufactures the product. They don't access your customer data directly.
- Couriers / fulfilment partners — to deliver your order (name, delivery address, contact details only).
- Professional advisers — lawyers, accountants, auditors, where reasonably needed.
- Authorities — when required by law (e.g. HMRC, court orders, regulators).
We never sell your personal data. If we add new subprocessors (e.g. an email-marketing tool, analytics or advertising pixel), we'll update this Policy and the list above.
5. International transfers
Some of our service providers process data outside the UK and EU.
- Where data is transferred to the EU/EEA from the UK, we rely on the UK's adequacy regulations.
- Where data is transferred outside the UK and EU/EEA (for example to the US), we rely on the UK International Data Transfer Addendum to the EU Standard Contractual Clauses, or another approved mechanism. Where the destination country has been deemed adequate (e.g. via the UK Data Bridge), we rely on that adequacy decision.
You can request a copy of the relevant safeguards by emailing hello@dreambrew.com.
6. How long we keep your data
| Category | Retention |
|---|---|
| Order records (for tax, accounting, consumer-law) | 7 years from end of accounting year |
| Account data while account is active | Until you delete your account |
| Account data after deletion | 30 days, then permanently deleted (except where retention is legally required) |
| Marketing list (active) | Until you unsubscribe |
| Marketing list (after unsubscribe) | We keep a record of your unsubscribe so we don't email you again — no marketing content |
| Customer support conversations | 3 years from last contact |
| Cookies | See our Cookie Policy for the lifetime of each cookie |
If a longer period is required by law, we'll keep your data for that longer period and then delete it.
7. Your rights
Under UK GDPR you have the right to:
- Access your personal data (a copy).
- Rectify any inaccurate data.
- Erase ("right to be forgotten") in certain circumstances.
- Restrict processing in certain circumstances.
- Object to processing based on legitimate interests, including direct marketing.
- Portability — receive your data in a portable format.
- Withdraw consent at any time where we rely on consent.
- Not be subject to a decision based solely on automated processing that has legal or similarly significant effects on you — we don't currently do this.
To exercise any of these, email hello@dreambrew.com. We'll respond within one month (we may extend by two months for complex requests; we'll tell you if so). There's no fee unless your request is manifestly unfounded or excessive.
Complain directly to us (DUAA 2025)
Under the Data (Use and Access) Act 2025, you now have a statutory right to complain directly to us about how we handle your data, in addition to your existing right to complain to the ICO or your local supervisory authority. To raise a complaint:
- Email hello@dreambrew.com with the subject "Data complaint".
- We'll acknowledge your complaint within 30 days.
- We'll respond substantively as soon as reasonably possible.
Complain to a regulator
You can also complain to the UK Information Commissioner's Office (ICO) at any time.
8. Cookies and tracking
We use cookies and similar technologies on dreambrew.com. Detail of every cookie, what it does, who sets it, and how long it lasts is in our Cookie Policy.
When you first visit, you'll see a cookie banner with three options:
- Accept all — accepts strictly necessary, functional, analytics and marketing cookies.
- Decline — only strictly necessary cookies are set; nothing else fires.
- Manage preferences — choose category by category.
You can change your choice at any time via the "Cookie preferences" link in the footer.
9. Marketing
We'll only send you marketing emails if:
- You ticked the marketing consent box on signup, or
- You've bought from us before and we're marketing similar products (PECR "soft opt-in"), with a clear unsubscribe in every email.
Every marketing email has an unsubscribe link. You can also email hello@dreambrew.com to opt out.
For SMS marketing, you need to give specific consent — we don't rely on soft opt-in for text messages.
10. Children
We don't market to under-16s, and DreamBrew is not recommended for children due to its high caffeine content. If you're under 16, please don't buy from us or sign up to our marketing.
If we learn we hold data about a child without parental consent, we'll delete it.
11. Security
We use industry-standard security measures (TLS encryption for traffic, encryption at rest with our hosting providers, access controls, audit logging). No system is perfect — if we ever experience a breach affecting your data, we'll notify the ICO within 72 hours where required, and notify you directly without undue delay where the risk to you is high.
12. Changes to this Policy
We may update this Policy from time to time. The update date is at the top. Material changes will be notified to active subscribers and account holders by email.
13. Contact us
DREAM BREW LIMITED (trading as DreamBrew)
Seven Grange Lane
Pitsford
Northampton
NN6 9AP
United Kingdom
Company number: 15982899
Email: hello@dreambrew.com