1. Who we are
WeConnect provides WhatsApp-based loyalty cards, menus, pre-orders and table bookings to independent cafes in the United Kingdom.
WeConnect is a trading name of Osman Batuhan Ural, operating as a sole trader in the United Kingdom, at Flat 103, Northways Parade, 22 College Crescent, London NW3 5DR, United Kingdom.
For questions about this policy or about your data, contact osmanbatu9898@gmail.com.
2. Our two roles
Data protection law distinguishes between deciding why data is used (a "controller") and simply handling it on someone else's instructions (a "processor"). We act in both roles depending on whose data it is.
| Whose data | Our role | What that means |
|---|---|---|
| Cafe customers who join a loyalty programme | Processor | The cafe decides how the data is used; we process it on their behalf under a written agreement. The cafe is the controller. |
| Cafe owners and staff with a WeConnect account | Controller | We decide how account and billing data is used. |
| People who submit the demo request form on our website | Controller | We decide how enquiry data is used. |
3. What we collect
If you join a cafe's loyalty programme
- Your name and mobile number
- Whether you opted in to marketing messages from that cafe
- Your stamps, rewards and visit dates
- Any table bookings or pre-orders you make
- The messages you send to the cafe's WhatsApp number, so the service can reply
We do not collect your email address, payment details, location or ID for a loyalty card.
If you request a demo on our website
- Your name, cafe name and mobile number (required)
- Your email address and any note you write (optional)
If you have a WeConnect account
- Your email address and a securely hashed password
- Your cafe, plan and message credit history
- Sign-in timestamps
We never store passwords in a readable form.
4. Why we use it, and our lawful basis
| What we do | Lawful basis |
|---|---|
| Run your loyalty card, stamps and rewards | Performance of a contract with you |
| Handle your table booking or pre-order | Performance of a contract with you |
| Reply to messages you send the cafe | Performance of a contract with you |
| Send you offers and cafe news | Your consent — and only if you opted in |
| Respond to a demo request you submitted | Steps taken at your request before a contract |
| Keep the service secure and prevent abuse | Our legitimate interests |
| Meet our legal and tax obligations | Legal obligation |
We do not sell personal data, and we do not use it for automated decisions that produce legal effects.
5. WhatsApp and Meta
The service runs on the WhatsApp Business Platform, provided by Meta. When you message a cafe, your message passes through Meta's systems so it can be delivered, in the same way as any other WhatsApp message.
This means Meta processes your data as well, under its own terms. Meta's handling of WhatsApp messages is covered by the WhatsApp Privacy Policy.
Meta may transfer data outside the UK. Those transfers rely on the safeguards Meta puts in place, such as the UK International Data Transfer Addendum.
7. Where data is stored
Customer and cafe data is stored in our database hosted in the European Union. Access is restricted to the cafe's own records: each cafe can see only its own customers, enforced at the database level.
Passwords are hashed with PBKDF2-SHA256. Connections to the service use HTTPS, and incoming WhatsApp messages are cryptographically verified before we process them.
8. How long we keep it
| Data | Kept for |
|---|---|
| Loyalty card, stamps and visit history | While you are a member, then deleted within 12 months of your last visit |
| Bookings and pre-orders | 24 months, for the cafe's records |
| Marketing opt-in and opt-out records | Kept as long as needed to prove we honoured your choice |
| Demo requests | 24 months from your enquiry, unless you become a customer |
| Account and billing records | 6 years after the account closes, as UK tax law requires |
If a cafe stops using WeConnect, we delete or return its customer data within 90 days of the account closing.
9. Your rights
Under UK GDPR you have the right to:
- Access the personal data we hold about you
- Correct it if it is wrong
- Delete it ("right to be forgotten")
- Restrict or object to how we use it
- Withdraw consent to marketing at any time
- Receive a copy of your data in a portable format
To exercise any of these, contact us at osmanbatu9898@gmail.com. We respond within one month, and it is free.
If you are unhappy with our response, you can complain to the Information Commissioner's Office (ICO), the UK's data protection regulator.
10. Stopping messages
Your loyalty card keeps working normally after you opt out — you will simply stop receiving marketing messages. You can opt back in by asking the cafe.
Messages you actively request, such as a booking confirmation or your stamp card, are service messages, not marketing, and are not affected by opting out.
12. Children
The service is not directed at children under 13, and we do not knowingly collect their data. If you believe a child has joined a loyalty programme, contact us and we will delete the record.
13. Changes to this policy
If we change this policy we will update the date at the top of this page. Where a change materially affects how we use your data, we will tell affected cafes directly so they can inform their customers.
14. Contact
For any question about this policy, your data, or to exercise your rights:
- Email: osmanbatu9898@gmail.com
- Post: Flat 103, Northways Parade, 22 College Crescent, London NW3 5DR, United Kingdom
If your question is about a specific cafe's loyalty programme, contacting the cafe directly is usually fastest — but you can always come to us.