NINJA COFFEE COMPANY LTD CUSTOMER MESSAGING PRIVACY NOTICE Last updated 10 October 2026 PUBLIC NOTICE 1. Who is responsible for your information? Ninja Coffee Company Ltd is responsible for the personal information covered by this notice. Address: 331 Burnley Road, Rossendale, BB4 8LA, United Kingdom. Data protection contact: Matthew Devlin, Company Data Protection Officer. Email: Contact@Ninjacoffeecompany.co.uk 2. What this notice covers This notice explains how we handle information when you contact Ninja Coffee through Instagram messages, Facebook Messenger, WhatsApp or our Nina customer care assistant. It also covers related customer enquiries passed to our team. Public social media comments remain visible according to the platform's settings; avoid posting private information in comments. 3. Information we collect We receive the information you send, such as your name or profile name, platform account identifiers, contact details, message content and any attachments. Depending on your enquiry, this may include booking requirements, delivery details, feedback or complaint information. Our systems also record message dates, channel details and information about handling and responding to enquiries. Please avoid sending payment card details, passwords or unnecessary sensitive personal information. We may ask for information needed to respond; if you do not provide it, we may be unable to complete your request. 4. Why we use your information We use information to answer questions, arrange requested services or bookings, follow up enquiries, investigate complaints and pass matters to the appropriate team member. We also use relevant records to maintain service continuity, troubleshoot our messaging systems and protect them against misuse. We rely on taking steps at your request before entering into a contract, or performing a contract, for booking and service enquiries. For other customer support activities, we rely on our legitimate interests in answering enquiries, managing complaints, improving customer support and maintaining secure, reliable systems. Where a legal obligation requires us to retain particular records, we rely on that obligation. Any separate use based on consent will be explained when consent is requested. 5. Nina and human support Nina is an AI customer care assistant. Your messages and relevant conversation context may be processed by an AI service to generate responses. Nina may pass enquiries to authorised Ninja Coffee team members. You can ask to speak to a person using the same messaging channel or the contact email above. We review customer conversations to identify improvements to Nina’s guidance and future replies. Proposed learning changes require approval from Matthew Devlin before they are applied. This is an internal customer service improvement process. 6. Who receives information? Information may be accessed by authorised team members who need it to handle your enquiry, and by service providers supporting our messaging, AI processing and technical infrastructure. These include Meta for Instagram, Facebook Messenger and WhatsApp, ngrok for delivering webhook events, and OpenAI for processing customer messages and generating Nina’s responses. OpenClaw runs our assistant on a business computer. The platforms also handle information under their own privacy notices. We may disclose relevant information where required by law or necessary to establish, exercise or defend legal claims. 7. International processing Our messaging and AI service providers operate internationally. Customer information may be processed outside the United Kingdom, including in the United States. OpenAI and ngrok publish data processing agreements containing contractual safeguards for UK international transfers, including Standard Contractual Clauses with the UK Addendum. Meta’s handling of information is governed by its applicable platform terms and privacy policies. For information about the countries involved and the safeguards applicable to your information, contact Matthew Devlin at Contact@Ninjacoffeecompany.co.uk. 8. How long we keep conversations Our maximum retention period for customer conversations is six years from closure of the enquiry. We keep records only for as long as needed for the enquiry, related follow-up, complaints or a justified record-keeping purpose, and delete or anonymise them earlier when they are no longer needed. Six years is a ceiling, rather than a requirement to keep every conversation for that long. Copies held independently by social media platforms are governed by their own retention policies. Any legally required records outside this conversation policy are handled under the applicable requirements and relevant notice. 9. Your rights and objections Depending on the circumstances, you can request access to your personal information, correction, erasure, restriction of processing or a portable copy. You can object to processing based on legitimate interests. Where we rely on consent, you can withdraw it without affecting earlier lawful processing. To make a request, email Contact@Ninjacoffeecompany.co.uk and explain what you would like us to do. We may request proportionate information to verify your identity. These rights have conditions and exceptions; we will explain any reason we cannot fully meet a request. 10. Data deletion instructions Email Contact@Ninjacoffeecompany.co.uk with the subject 'Nina data deletion request'. Tell us which channel you used and the account name or contact number associated with your conversation. Do not send passwords or access tokens. We will assess your request, verify identity where necessary and explain the outcome, including any information we must retain. Deleting our records does not delete copies controlled independently by Meta or remove your social media account. 11. Questions and complaints Contact Matthew Devlin at Contact@Ninjacoffeecompany.co.uk with any privacy concern or complaint. You also have the right to complain to the Information Commissioner's Office: https://ico.org.uk/make-a-complaint/ 12. Updates We will update this notice when our customer messaging practices change and display the current version and date on the published page. Template acknowledgement: This notice was prepared with reference to the privacy policy template supplied by Matthew from SEQ Legal: https://seqlegal.com/free-legal-documents/privacy-policy