Privacy notice

1. Who is responsible

The data controller is the business named at the end of this page. You can contact us about your data at the email address shown there.

2. What we collect and why

We collect only what we need to run the shop.

• Orders: your name, email, phone number (optional), delivery address and what you bought. Legal basis: performance of a contract. We keep order records for six years because tax law requires it.
• Waitlist: your email address, optional postcode, and the time you consented. Legal basis: consent, which you can withdraw with the unsubscribe link in any email.
• Marketing: only if you tick the optional box at checkout do we email you about new flavours and offers. Legal basis: consent. Every email has an unsubscribe link.
• Enquiries: your name, email, organisation and message, so we can reply. Legal basis: legitimate interests.
• Batch traceability: which oven batch went into your order, so we can contact you in the unlikely event of a product recall. Legal basis: legal obligation under food law.
• Analytics: with your consent only, anonymous usage data (pages visited, device type) through PostHog. We never send names, emails or addresses to analytics.

3. Who we share data with

We use trusted processors to run the shop: Stripe (payments), Royal Mail (delivery labels and tracking), Resend (transactional email) and PostHog (analytics, EU hosting, only after consent). Our servers are hosted in the European Union. We never sell personal data.

4. International transfers

Some processors may process data outside the UK. Where they do, transfers are protected by the UK International Data Transfer Agreement or UK adequacy regulations.

5. Your rights

You have the right to access the personal data we hold about you, to have it corrected, to have it erased where we no longer need it, to restrict or object to processing, and to data portability. To exercise any right, email us. We respond within one month. Where we erase data we keep the financial record of an order, with personal details removed, for as long as tax law requires.

6. Complaints

If you are unhappy with how we handle your data, you can complain to the Information Commissioner's Office at ico.org.uk. We would appreciate the chance to address your concern first.

7. Changes

We will update this notice when our practices change and show the date of the latest version at the top of the page.