Privacy Policy

Privacy Policy for Everything Pastry LTD

Last updated: May 13, 2026

This Privacy Policy describes Our policies and procedures on the collection, use, and disclosure of Your information when You use the Service and tells You about Your privacy rights and how the law protects You under UK GDPR and the Data Protection Act 2018.

1. Interpretation and Definitions

Company: (referred to as “the Company”, “We”, “Us” or “Our”) refers to Everything Pastry LTD, Harrow, United Kingdom.
Personal Data: Any information relating to an identified or identifiable individual (e.g., name, email, phone number).
Service: Refers to the Website everythingpastry.com.

2. Collecting and Using Your Personal Data

Types of Data Collected

Contact Information: First name, last name, email address, and mobile phone number.
Order Details: Products purchased, chosen Saturday collection location, and preferred time slot.
Usage Data: Collected automatically (IP address, browser type, etc.) to improve site performance.

Why We Collect This Data (Lawful Basis)

Under UK GDPR, we process your data based on:

Contractual Necessity: We cannot fulfill your pastry order or provide collection details without your contact info.
Legal Obligation: We must keep records of transactions for tax purposes.
Consent: For marketing emails (only if you explicitly opt-in).

3. Payment Processing

We process payments online to secure your order. Everything Pastry LTD does not store or see your credit or debit card details.

Payments are processed through a secure third-party provider (e.g., Stripe/WooPayments).
Your financial data is encrypted and governed by the payment processor’s own Privacy Policy.

4. Use of Your Personal Data

We use your data to:

Fulfill Orders: Manage your purchase and prepare your bake.
Collection Reminders: Send SMS or email notifications regarding your chosen Saturday slot.
Customer Support: Respond to your inquiries or quality feedback.

5. Retention of Your Personal Data

Transactional Data: We are legally required by HMRC to retain records of sales and financial transactions for 6 years plus the current tax year.
Communication Data: We keep general inquiries for up to 24 months unless a deletion request is made.

6. Disclosure & Sharing of Data

We do not sell your data. We only share information with:

Service Providers: Website hosting, email delivery services, and payment processors.
Law Enforcement: Only if required by UK law or to protect our legal rights.

7. Your Rights Under UK GDPR

You have the following rights regarding your data:

The Right to Access: Request a copy of the data we hold about you.
The Right to Rectification: Request that we correct inaccurate information.
The Right to Erasure: Request that we delete your data (subject to our 6-year HMRC retention requirement).
The Right to Withdraw Consent: Unsubscribe from marketing at any time.

To exercise these rights, please contact us at [email protected].

8. Security of Your Personal Data

We use commercially acceptable security measures to protect your data. However, as your order involves fresh-baked goods and physical collection, please ensure your contact details are accurate to avoid service disruptions.