Privacy policy
Last updated 11 November 2026
This policy explains how Espresso Group Ltd, trading as Espresso Cloud, uses personal data when you visit our website, create an account or buy from us. We are the controller of this data.
What we collect
- Account details: your name, company name, email address, phone number (if you give one) and password (stored scrambled, never in plain text).
- Orders and billing: what you bought, seats, prices, invoices, and a reference to your Stripe customer record. We do not see or store your full card number.
- Setup details: the identifier for your software account, such as your Microsoft 365 tenant, which you give us so we can provision your licences.
- Requests and support: seat-change and cancellation requests, the reasons you give, and what you tell us when you contact us.
- Technical data: your IP address and basic browser information in server logs, and the cookies described in our cookie policy.
- Email records: the emails we send you, and whether an address has bounced or complained, so we stop sending to it.
Why we use it
| Purpose | Lawful basis |
|---|---|
| Creating your account, taking payment, supplying and managing your licences, giving support | Contract |
| Keeping invoices and financial records, and tax compliance | Legal obligation |
| Order confirmations, invoices, renewal reminders and payment problems | Contract |
| Security, preventing fraud and abuse, and improving the service | Legitimate interests |
We do not use your data for marketing emails unless you ask us to, and we do not sell personal data.
Who we share it with
- Stripe processes payments and holds your payment details.
- Amazon Web Services hosts our website and database and sends our emails.
- Software vendors, such as Microsoft, receive the details needed to set up and manage your licences.
- Professional advisers, such as accountants and lawyers, and authorities where the law requires.
Our staff see your data only as needed to do their work.
Where it is held
Our systems are hosted in the UK (London). Some of our providers, such as Stripe, may process data outside the UK. Where they do, we rely on safeguards such as approved contractual terms.
How long we keep it
- Invoices and financial records: 6 years, as tax law expects.
- Account and order information: while you have an account with us and for a reasonable period afterwards.
- Server logs: kept for a short period for security.
Your rights
You can ask to see the data we hold about you, correct it, delete it, restrict or object to how we use it, or receive it in a portable format. Some of these rights are limited where we must keep data by law. To use them, contact us using the details below.
Complaints
If you are unhappy with how we handle your data, please tell us first. You can also complain to the Information Commissioner's Office at ico.org.uk.
Security
We protect your data with encrypted connections, restricted access and payment handling by Stripe. No system is perfectly secure, but we take reasonable steps to protect it.
Changes
We may update this policy. The date at the top shows when it last changed.
Contact
Espresso Group Ltd, trading as Espresso Cloud, company number 16232595, registered office Suite 8, Bourne Gate, 25 Bourne Valley Road, Dorset, BH12 1DY, VAT registration number 502674409.
Phone 0333 112 0599, email hello@espressocloud.co.uk.