Privacy Policy

This privacy notice tells you what to expect us to do with your personal information.

Contact Details

What Information We Collect, Use, and Why

1. Provision of Services and Goods

We collect or use the following information to provide services and goods, including delivery:

  • Names and contact details
  • Addresses
  • Purchase or account history
  • Payment details, including card or bank information for transfers and direct debits
  • Health information, including dietary requirements, allergies and health conditions
  • Website user information, including user journeys and cookie tracking

We also collect or use the following special category information to provide services and goods, including delivery. This information is subject to additional protection due to its sensitive nature:

  • Health information, including dietary requirements and food allergies

2. Service Updates or Marketing Purposes

We collect or use the following information for service updates or marketing purposes:

  • Names and contact details
  • Addresses
  • Marketing preferences
  • Purchase or viewing history
  • IP addresses
  • Website and app user journey information
  • Records of consent, where appropriate

3. Legal Requirements

We collect or use the following information to comply with legal requirements:

  • Name
  • Contact information
  • Financial transaction information
  • Any other personal information required to comply with legal obligations
  • Health and safety information

We also collect or use the following special category information to comply with legal requirements:

  • Health information

4. Queries, Complaints or Claims

We collect or use the following personal information for dealing with queries, complaints or claims:

  • Names and contact details
  • Purchase or service history
  • Information relating to health and safety
  • Correspondence

We also collect the following special category information for dealing with queries, complaints or claims:

  • Health information

Lawful Bases and Data Protection Rights

Under UK data protection law, we must have a "lawful basis" for collecting and using your personal information. There is a list of possible lawful bases in the UK GDPR. Which lawful basis we rely on may affect your data protection rights which are set out in brief below:

  • Your right of access - You have the right to ask us for copies of your personal information. You can request other information such as details about where we get personal information from and who we share personal information with.
  • Your right to rectification - You have the right to ask us to correct or delete personal information you think is inaccurate or incomplete.
  • Your right to erasure - You have the right to ask us to delete your personal information.
  • Your right to restriction of processing - You have the right to ask us to limit how we can use your personal information.
  • Your right to object to processing - You have the right to object to the processing of your personal data.
  • Your right to data portability - You have the right to ask that we transfer the personal information you gave us to another organisation, or to you.
  • Your right to withdraw consent - When we use consent as our lawful basis you have the right to withdraw your consent at any time.

If you make a request, we must respond to you without undue delay and in any event within one month. To make a data protection rights request, please contact us using the contact details at the top of this privacy notice.

Our Lawful Bases for the Collection and Use of Your Data

A. Providing Services and Goods

Our lawful bases for collecting or using personal information to provide services and goods are:

  • Contract - we have to collect or use the information so we can enter into or carry out a contract with you. All of your data protection rights may apply except the right to object.
  • Legitimate interests - we're collecting or using your information because it benefits you, our organisation or someone else, without causing an undue risk of harm to anyone.
We have a legitimate interest in using customers' personal information to respond to enquiries, discuss bespoke cake and dessert table orders, provide quotes, manage bookings, arrange collection or delivery, keep records of order communications, and provide good customer service. Collecting and using this information benefits both the customer and our business because it allows us to understand the customer's specific requirements, confirm availability, prepare accurate quotes, create the bespoke order as requested, communicate important details, and address any questions before or after the event. We only collect and use the information that is necessary for these purposes, such as contact details, event date, event type, delivery or collection details, order preferences, and messages sent to us. We do not use this information in a way that customers would not reasonably expect, and we do not use it for unrelated purposes. We consider that the benefit of using this information to provide our services is greater than any limited impact on customers, because the information is used solely to handle their enquiry or order and provide the service they have requested.

B. Service Updates or Marketing Purposes

Our lawful bases for collecting or using personal information for service updates or marketing purposes are:

  • Consent - we have permission from you after we gave you all the relevant information. All of your data protection rights may apply, except the right to object. You have the right to withdraw your consent at any time.
  • Legitimate interests - we're collecting or using your information because it benefits you, our organisation or someone else, without causing an undue risk of harm to anyone.
We have a legitimate interest in using customers' personal information to send service updates related to their enquiry or order, such as availability, quote updates, design discussions, payment reminders, delivery or collection arrangements, and important changes affecting their booking. We may also use customer contact details to send occasional updates about similar cakes, dessert tables, seasonal availability, or services that may be relevant to previous customers or people who have made a direct enquiry, where this is permitted by law and where the person would reasonably expect this type of communication. This benefits customers by helping them receive important information about their order or enquiry and, where appropriate, relevant updates about similar services they may be interested in. It also benefits our business by helping us manage customer relationships and inform people about services connected to the products they have asked about or previously ordered. We only use the minimum information necessary, such as name, contact details, and order or enquiry history. We do not send unrelated marketing, we do not sell personal information, and we do not use personal information in ways customers would not reasonably expect. Customers can opt out of marketing communications at any time, and if they object or opt out, we will stop using their information for marketing purposes.

C. Legal Requirements

Our lawful bases for collecting or using personal information for legal requirements are:

  • Legal obligation - we have to collect or use your information so we can comply with the law. All of your data protection rights may apply, except the right to erasure, the right to object and the right to data portability.

D. Dealing with Queries, Complaints or Claims

Our lawful bases for collecting or using personal information for dealing with queries, complaints or claims are:

  • Legitimate interests - we're collecting or using your information because it benefits you, our organisation or someone else, without causing an undue risk of harm to anyone.
We have a legitimate interest in using customers' personal information to respond to queries, manage complaints, resolve issues, handle refund or order-related discussions, and deal with any claims or disputes that may arise. This may include using records of enquiries, orders, messages, quotes, invoices, payments, delivery or collection details, allergen-related communications, photographs of completed orders, and any complaint or dispute correspondence. Using this information benefits both customers and our business because it allows us to understand what happened, respond fairly, investigate concerns, provide appropriate solutions, protect our legal rights, and demonstrate how an enquiry or order was handled. We only use the information that is necessary for these purposes and do not use it for unrelated reasons. We consider the impact on customers to be limited because the information is used only where needed to answer their query, resolve a complaint, manage a dispute, or deal with a claim. We also keep this information only for as long as necessary.

Where We Get Personal Information From

We collect personal information directly from you.

How Long We Keep Information

  • Financial and tax records, including invoices, payments, and financial transaction information: kept for 6 years to comply with HMRC requirements.
  • Order details and communications: all correspondence, specifications, and specific health and safety communication regarding food allergies or dietary requirements are kept for 3 years from the date of the event or order completion to protect against potential health and safety, food safety, or legal claims.
  • General inquiries: contact form messages and emails where a booking or bespoke order was not final or completed are permanently deleted after 12 months.
  • Marketing preferences and analytics data: kept until consent is withdrawn, the user unsubscribes from updates, or requests erasure.

For more information on how long we store your personal information or the criteria we use to determine this please contact us using the details provided above.

Who We Share Information With

We share information with the following data processors who perform activities on our behalf:

Google Ireland Limited (Google Analytics, Google Tag Manager, Google Search Console)

Google provides website analytics, tag management, and search performance reporting services. Google may process limited website usage data, cookie identifiers, and IP addresses to help us understand how visitors interact with our website, measure performance, and optimize the user experience. Google processes this information on our behalf strictly for these purposes, subject to Google's standard data processing terms.

GMG Digital Innovation SRL (Website Support & Digital Analytics Provider)

GMG Digital Innovation SRL provides technical website development, maintenance, analytics setup, and performance optimization services. They may access limited website traffic data, configuration logs, and performance metrics to ensure the website runs efficiently, troubleshoot technical issues, manage analytics tags, and provide technical reporting. They process this data strictly under our explicit instructions and only to maintain and secure the website platform.

Sharing Information Outside the UK

Where necessary, we will transfer personal information outside of the UK. When doing so, we comply with the UK GDPR, making sure appropriate safeguards are in place.

  • Organisation name: GMG Digital Innovation SRL
  • Category of recipient: Website design, technical support and digital analytics service provider
  • Country the personal information is sent to: Romania
  • How the transfer complies with UK data protection law: The country or sector has been assessed as providing adequate protection to data subjects, also known as Adequacy Regulations or UK data bridge.

How to Complain

If you have any concerns about our use of your personal information, you can make a data protection complaint to us directly:

If you remain unhappy with how we've used your data after raising a complaint with us, you can also complain to the ICO.

The ICO's address:

Information Commissioner's Office
Wycliffe House, Water Lane
Wilmslow, Cheshire, SK9 5AF