Privacy Notice

01Who we are

Barista School Ireland is run by Waco Coffee Company Ltd, a company registered in Ireland (company no. 570483, VAT no. IE 3391828WH), trading as Barista School Ireland, with its registered office at 9–11 Pearse Street, Bandon, Co. Cork, P72 CF24. We are the controller of the personal data described in this notice.

For anything about your data, email info@baristaschoolireland.ie or call 021 424 8717.

02What we collect

When you book a course: your name, email address, mobile number, the course, date and number of places, the amount paid, any gift voucher used, and whether you asked to receive course news. If you book for others, we may also hold the names of the people attending.
When you pay: payments are taken by Stripe. We receive confirmation that you have paid and a payment reference, but never your card number or card details.
When you buy a gift voucher: your name and email, the recipient’s name and email, your message, and the delivery date.
When you contact us: your name, email, phone number (if given) and your message.
During your course: your assessment results, and anything you choose to tell us, such as an allergy. We only use health information you give us to keep you safe on the day.
When you join our mailing list: your email address (and name, if you give it), where you signed up, and when you confirmed. We only add you once you click the link in our confirmation email.
How you found us: your optional answer to “How did you hear about us?”, and if you arrived from one of our ad or campaign links, the name of that link (for example “facebook / new-traffic”). We note the link only for your current visit, in your own browser, and save it only if you book or buy a voucher.
Your cookie choice: whether you accepted analytics or marketing cookies. If you did, and you book or buy a voucher, we also keep the analytics and advertising identifiers set by those cookies with your booking, so the payment can be reported to Google or Meta (see section 08).
The Owner’s Line membership: your name, email address, WhatsApp number, business name and type, VAT number (if you give it), what you’d like help with, and the Stripe references for your subscription. Your WhatsApp number is stored with your membership so we can reach you, and is kept with your membership record.
Online courses: see section 13.
Friend codes: if you book with a friend’s code, we record whose code it was. After your course we send your friend a thank-you voucher that mentions your first name.

03How we use it, and our legal basis

To provide your course or voucher (performing our contract with you): confirming your booking, sending your calendar invite, a “getting ready” email a week before, a reminder the day before, a thank-you afterwards, four weeks of email support, and contacting you if anything about your course changes.
To keep accounts and records (legal obligation): we keep booking and payment records as required by Irish tax law.
To answer your questions (our legitimate interest in replying to people who contact us): including an automatic reply confirming we received your message.
To ask for a review (legitimate interest): our thank-you email includes an optional link to review us.
To keep you safe (your explicit consent): any allergy or health information you choose to tell us.
To send you course news (your consent): see below.

04Course news and marketing

We only send you news about courses and new dates if you ask us to, for example by ticking the box when you book or joining our mailing list. You can opt out at any time by clicking “unsubscribe” in any email, replying “stop”, or emailing us. Opting out doesn’t affect emails about a course you have booked.

We never sell your data. We share it only with service providers who process it for us under contract, and only as far as they need to:

Stripe: card payments and refunds.
Google (Google Workspace and Google Cloud): our email, the system that stores bookings and sends booking emails, and hosting this website. The website also loads its fonts from Google Fonts, which means your browser’s IP address is sent to Google.
WhatsApp (WhatsApp Ireland Limited, part of Meta): if you’re an Owner’s Line member, our conversations with you happen on WhatsApp, under WhatsApp’s own terms and privacy policy.
Brevo: sending our mailing-list emails, if you have joined the list.
Anthropic (Anthropic, PBC): the AI model (Claude) behind Ollie, the chat assistant on this website, if you use the chat, and behind the Barista CV Builder when you ask Ollie to write your CV, cover letter or interview answers. See section 11.
Google (Google Analytics and Google Ads) and Meta (Meta Pixel and Conversions API): only if you accept analytics or marketing cookies. See section 08.

We may also disclose data where the law requires it, for example to Revenue or in response to a court order.

06Transfers outside the EEA

Some of our providers may process data outside the European Economic Area, including in the United States. Where they do, the transfer is protected by an EU adequacy decision (such as the EU-US Data Privacy Framework) or the European Commission’s standard contractual clauses.

07How long we keep it

Bookings, payments and gift vouchers: six years after the end of the year of the course or voucher, as required for tax records, then deleted.
Messages and enquiries: up to two years, unless they become part of a booking.
Chats with Ollie: 90 days, then deleted automatically. If you ask Ollie to pass something to the team or to email you dates, those details are kept as an enquiry (above).
Allergy or health information: only until your course is finished.
Cookie choices and identifiers: your choice for 12 months in your own browser; identifiers saved with a booking are kept with that booking.
Mailing list: until you unsubscribe. We then keep your email address on a suppression list so you aren’t added again by mistake.

08Cookies

When you first visit, we ask whether you accept analytics and marketing cookies. Until you choose, and if you say no, none of the tools below run and no analytics or advertising cookies are set. “Reject all” is as easy as “Accept all”.

Necessary (always on): what the site needs to work, such as keeping your place while you book and remembering your cookie choice in your browser. Your choice is kept for 12 months, then we ask again.
Visit count (no cookies): our own website counts page views so we know which pages are used and where visits come from (for example Google, Instagram or an email). For each page view it records only the page, the kind of site you came from, the type of device (phone, tablet or computer), how long the page was open, whether you went on to another page, and the date. It sets no cookies, stores nothing in your browser and records nothing that identifies you, such as your IP address. Daily totals are kept; the detailed counts are deleted after 60 days.
Analytics: Google Analytics (Google Ireland Limited). Counts visits and shows which pages are used, so we can improve the site. It sets cookies starting “_ga” that last up to two years. We keep Google Analytics data for 14 months.
Marketing: Google Ads and the Meta Pixel (Google Ireland Limited; Meta Platforms Ireland Limited, for Facebook and Instagram). They tell us whether our ads lead to bookings, and help show our ads to people likely to be interested. They set cookies such as “_gcl_au” (Google Ads) and “_fbp” and “_fbc” (Meta), which last about 90 days.
Meta Conversions API: if you accepted marketing cookies and then book or buy a gift voucher, our booking system also tells Meta about the purchase directly (the booking reference, amount and the advertising identifiers above), so it is counted once even if you close the page. Your email address, phone number and name are scrambled (“hashed”) before they are sent, so Meta can only match them to an account it already holds. If you didn’t accept marketing cookies, nothing is sent.

Our legal basis for these tools is your consent. Google and Meta also use this data under their own privacy policies, and Meta is jointly responsible with us for collecting it through the pixel. You can change your mind at any time: use Cookie settings (also at the bottom of every page). Withdrawing consent stops the tools from then on and removes their cookies from this site.

Stripe’s payment page sets its own cookies to process your payment securely and prevent fraud; see Stripe’s privacy policy for details. Google Fonts, used for the website’s fonts, doesn’t set cookies.

09Security

This website is served over an encrypted connection (HTTPS). Card payments are handled entirely by Stripe, a certified payment provider, so we never see or store your card details. Bookings are kept in our Google Workspace account, and only the people who run the school can see them. No system is completely secure, but we take reasonable technical and organisational steps to protect your data.

10Your rights

Under data protection law (the GDPR and the Data Protection Act 2018) you have the right to:

ask for a copy of the personal data we hold about you;
have inaccurate data corrected;
have your data deleted, where we no longer need to keep it;
restrict or object to how we use it, including objecting to marketing at any time;
receive your data in a portable format;
withdraw consent at any time, where we rely on it.

To use any of these rights, email info@baristaschoolireland.ie. It’s free, and we’ll reply within one month. If you’re unhappy with how we handle your data, you can complain to the Data Protection Commission at dataprotection.ie.

11Ollie, our AI chat assistant

The chat on this website is Ollie, an AI assistant, not a person. Ollie is provided using Claude, an AI model made by Anthropic, and answers from the information on this website and our live course dates. It can make mistakes, so please check anything important on the course page or the booking terms.

What we keep: the messages in the chat, the page you were on, and whether you asked to be passed to the team, asked for dates by email, or tapped a booking button. We don’t record your IP address. If you type something that looks like a card number, it’s removed before the chat is saved or sent to the AI model.
Why: to answer your questions, so the team can follow up when you ask them to, and to improve Ollie’s answers (our legitimate interest). If you ask Ollie to pass your details to the team or to email you dates, we use your name, email and phone (if given) for that, with your consent.
How long: 90 days, then the chat is deleted automatically.
Who processes it: the chat is stored in our Google Workspace account; each message is sent to Anthropic to produce Ollie’s reply. Anthropic processes it on our behalf under contract and doesn’t use it to train its models. Anthropic may process data in the United States, protected as described in section 06.
Please don’t share card numbers, passwords or health details in the chat. Payment only ever happens on our secure booking page.
Your choice: the chat is optional and isn’t used for advertising or tracking. If you tap a booking button in the chat, that tap is counted with your cookie choice in the usual way (section 08). To see or delete a chat, email info@baristaschoolireland.ie.

12Changes to this notice

We will post any changes on this page and update the date at the top of the contents list. If we make a significant change to how we use your data, we will tell you by email.

13Online courses (Level 1 HACCP, Allergen Awareness)

The Barista CV Builder: what you type is saved on your own device, not by us. When you press “Build my CV”, “Write my cover letter” or “Personalise my answers”, your answers are sent once to Ollie (Claude, by Anthropic) to write the text and sent straight back to you; we don’t keep them. The demo doesn’t send anything.

This section covers our online courses, whether you buy one, take one through a link from your employer, or take one through a link someone bought for you.

What we keep: the name and email address you enter at the final quiz, your score, the date you passed, the certificate ID, the certificate PDF, the course link you used and, if your workplace’s training app sent you, its reference. If you buy a course: your name, email, business name (team packs), the order, the consent you gave to start straight away (with its time), and the Stripe payment reference. Your progress through the lessons is saved only in your own browser.
Why, and our legal basis: to run the quiz, issue your certificate, email it to you and re-send it when you ask (performing the contract with you or with the person who bought your place; for workplace links, our and your employer’s legitimate interest in keeping training records); to keep sales records (legal obligation, tax); and to send the buyer a reminder before a refresher date (legitimate interest in helping them keep their training records; they can turn it off at any time).
Who sees your result: you; the person or business who gave you the course link (their records page, or their training app, shows your name, pass date, score, certificate and refresher date); and our team. You’re told this before you submit the quiz. Once your employer holds your result in its own records, it’s responsible for that copy.
Who processes it for us: Google (Google Workspace: our email, the Google Sheet with the results and the Google Drive folder with the certificates), and Stripe for payments. See sections 05 and 06.
“Request your certificate again”: it’s only ever emailed to the address you entered, and the page gives the same answer whatever address is typed, so nobody can use it to find out who has done a course.
How long: course results and certificates are kept for 6 years from the date you passed, then deleted automatically. Sales records are kept for 6 years after the end of the tax year, as required by tax law.
Emails: we don’t send course news or offers unless you ask for them. The certificate email and refresher reminders are service emails, not marketing.
Your rights: as in section 10. Email info@baristaschoolireland.ie.

14Latte Art Academy

Latte Art Academy is our online latte art training for business teams. When a business owner adds a member of staff, we hold the following for that person.

What we keep: their name and email address (added by the owner), their progress (lessons, quiz results, level, badges, certificate), and a few still pictures taken from each pour they film. The video itself never leaves their phone: the app takes up to 9 still pictures in the browser (with no location or camera details) and sends only those.
AI feedback: the pictures are sent to Claude, an AI model made by Anthropic, which scores the pour against our training rubric and suggests the next fix. Anthropic processes them on our behalf under contract and doesn’t use them to train its models. Our trainers review pours where the AI is unsure, every certificate, and any pour a business’s owner or the staff member queries. The feedback is AI-assisted, and we say so in the app.
Ollie, the barista coach in the app: questions typed to Ollie are sent to Anthropic (Claude) to produce the answer, with the person’s first name, level and recent pour feedback so the answer fits. We don’t keep the conversation: it stays on the screen until they leave it. We only count questions towards the business’s monthly limit.
Who sees it: the staff member, their business’s owner (the team page shows each person’s level, scores and pours), and our trainers. If the business chooses, its name (never a person’s) appears on the business leaderboard.
Why: to provide the training the business has paid for (our contract with the business) and our legitimate interest in giving accurate feedback. The owner confirms each person has agreed to take part before adding them.
How long: pour pictures are deleted after 90 days, except the pours that earned a certificate, which we keep while the business stays subscribed and for 30 days after. Progress and certificates are kept while the business is subscribed and for 12 months after, so a returning business can pick up where it left off; ask us and we’ll delete them sooner.
Where: in our Google Workspace account (sheets and a private Drive folder), and Stripe for the business’s billing.
Your rights: the rights in section 10 apply. A staff member can ask us directly, or ask their business owner to remove them from the team.