Privacy Policy

[Add your full legal trading name] ([Add: sole trader / limited company]), trading as SugarblissNmore, is the data controller for the personal data described here.

• Address: [Add your trading address]
• Email: sugarblissnmore@gmail.com
• Phone: 07901 887 399

If you have a question about your data, email us and we will answer within one month, which is the time UK GDPR allows.

We only collect what we need to make and deliver your order.

• When you order: your name, email address, phone number, delivery address if you are having something delivered, the date you need it, and the details of what you have ordered including any message on the cake.
• Allergy and dietary notes: anything you tell us in the allergy field. This can be health information, which the law treats as a special category needing extra care. Section 4 explains how we handle it.
• When you enquire or book a class: your name, email, phone number, and whatever you write in your message.
• Payment: handled entirely by Stripe. We receive confirmation that you paid and the last four digits of your card. We never see or store your full card number.
• Anonymous page counts: how many times a cake page has been viewed. It is a number with no identifier attached and cannot be traced back to anyone.

We do not buy personal data, we do not build profiles, and we make no automated decisions about you.

• To fulfil your order — name, contact details, address, order details. Lawful basis: performance of a contract with you.
• To answer your enquiry — name, contact details, your message. Lawful basis: legitimate interests, namely responding to someone who has asked us a question.
• To keep accounting records — order and payment records. Lawful basis: legal obligation under tax law.
• To keep food safety records — allergen and order information. Lawful basis: legal obligation under food safety law.
• To keep the site working — anonymous page counts. Lawful basis: legitimate interests, namely understanding which pages are used.

We do not send marketing emails. If that ever changes we will ask for your consent first, and you will be able to withdraw it at any time.

Information about allergies is health data, and UK GDPR treats it as a special category requiring an additional lawful basis. Ours is your explicit consent, given when you choose to tell us.

We use it for one thing only: making and labelling your order safely. It is shared with nobody outside our kitchen. You do not have to give it — but if you do not, we cannot advise you on whether something is safe for you to eat.

You can withdraw your consent at any time by emailing us, though we may need to keep a record as part of our food safety obligations.

We do not sell your data and we do not share it for anyone else's marketing. We use a small number of service providers who process data on our instructions:

• Stripe — takes payments and handles card details.
• Resend — sends your order confirmation and our enquiry emails.
• Neon — the database holding order records.
• Upstash — stores the anonymous page counts.
• Vercel — hosts this website.

Some of these providers process data outside the UK. Where that happens, it is protected by UK adequacy regulations or by standard contractual clauses, as UK GDPR requires.

We will also disclose data where the law requires it — for example to environmental health, HMRC, or in response to a court order.

• Order and payment records — six years after the end of the tax year they fall in, because HMRC requires it.
• Enquiries that did not become orders — 12 months, then deleted.
• Allergy notes — kept with the order they relate to.
• Anonymous page counts — kept indefinitely, as they identify nobody.

This site sets one cookie, and only for the shop owner: a session cookie that keeps them signed in to the admin area. It is strictly necessary for that page to work, so no consent is required for it under the Privacy and Electronic Communications Regulations.

We use no advertising cookies, no tracking pixels and no third-party analytics. That is why you have not been asked to accept anything. If we ever add analytics or advertising, we will ask for your consent before setting those cookies and update this page.

Stripe may set its own cookies during checkout, on Stripe's own pages.

Under UK GDPR you have the right to:

• ask what data we hold about you, and get a copy
• have inaccurate data corrected
• have data deleted, where we do not have to keep it by law
• restrict or object to how we use it
• receive your data in a portable format
• withdraw consent, where consent is what we relied on

To use any of these, email sugarblissnmore@gmail.com. It is free, and we will respond within one month.

If you think we have handled your data badly, please tell us first so we can put it right. You also have the right to complain to the Information Commissioner's Office at ico.org.uk, or on 0303 123 1113.

See also our Terms of Sale.