Privacy and cookie policy

1. Who is responsible for your information?

The person responsible for personal information collected through this website is:

Email: monkeybakesbuxton@gmail.com

In data-protection terminology, Monkey Bakes Buxton is the data controller.

2. Information we collect

Depending on how you use the website, we may collect:

• Your name, email address and telephone number.
• Your billing and delivery address.
• Order contents, prices, payment status, dispatch information and tracking details.
• Custom-cake and local-bakes enquiry details.
• Inspiration photographs submitted with a custom-cake enquiry.
• Allergy, intolerance or dietary information that you choose to provide.
• Subscription choices, skips, payment status and delivery history.
• Newsletter consent and unsubscribe status.
• Technical information needed to operate and secure the website, such as session data, IP address, browser information and server logs.

Monkey Bakes does not directly receive or store your complete payment-card number. Card details are handled by the payment provider.

3. How we use your information

Personal information may be used to:

• Process and fulfil orders.
• Take and confirm payment.
• Send order, payment and dispatch emails.
• Respond to cake and local-bakes enquiries.
• Discuss allergen or dietary requirements.
• Operate subscriptions, skips and waiting lists.
• Prevent fraud, spam and misuse of the website.
• Maintain accounting and tax records.
• Deal with complaints, disputes or legal claims.
• Send newsletters where valid marketing consent has been provided.

4. Our lawful reasons for using information

We use personal information only where there is a lawful reason to do so. The main reasons are:

• Contract: to process an order, subscription or requested enquiry.
• Legal obligation: to maintain records required for accounting, tax, food safety or other legal purposes.
• Legitimate interests: to operate and secure the business, prevent fraud, respond to complaints and establish or defend legal claims.
• Consent: for optional newsletters and other processing where consent is specifically requested.

5. Allergy and health information

Allergy, intolerance and some dietary information may reveal information about your health. This is treated with additional care.

We use information you voluntarily provide to assess whether an order can be accepted, discuss requirements and prepare or identify products as safely as reasonably possible.

Where required, we rely on your explicit consent to process this information. You may withdraw consent, but doing so may mean we cannot safely continue with the affected enquiry or order.

Allergen information may still be retained where legally necessary for food-safety records, a complaint or a legal claim.

6. Who receives your information?

We share information only where reasonably necessary. Recipients may include:

• Stripe or another displayed payment provider.
• Website-hosting, database and email providers.
• Postal and courier services completing deliveries.
• Accountants, insurers, legal advisers or other professional advisers.
• Government, tax, food-safety, law-enforcement or regulatory bodies where legally required.

We do not sell customer information.

7. International processing

Some service providers may process information outside the United Kingdom. Where this happens, we take reasonable steps to use providers that apply an appropriate legal safeguard for the information.

8. How long information is retained

We retain information only for as long as it is reasonably needed:

• Completed order, payment and accounting records may normally be retained for up to six years for tax, accounting and legal purposes.
• Enquiries that do not become orders are normally retained for up to 12 months.
• Inspiration photographs are not permanently stored in the public website folders. They may remain with the received enquiry email for up to 12 months, or longer if the enquiry becomes an order or a dispute requires them.
• Active subscription information is retained while the subscription operates. Related transaction records may be retained for up to six years.
• Newsletter details are retained until you unsubscribe or consent is otherwise withdrawn. A minimal suppression record may be retained to ensure no further marketing is sent.
• Security and server records are retained only for as long as reasonably required to operate and protect the website.

9. Marketing

Newsletter marketing is optional and is not a condition of placing an order.

Marketing consent must be provided through a separate choice. You can unsubscribe at any time using the link in an email or by contacting Monkey Bakes.

Withdrawing marketing consent does not affect necessary order, payment, safety or dispatch communications.

10. Cookies and website sessions

The website uses strictly necessary session technology to provide functions requested by visitors, such as maintaining a basket, securing forms, processing checkout and managing a logged-in or subscription session.

Payment providers may also use technology that is necessary to process payments securely and prevent fraud.

Monkey Bakes does not currently use optional advertising or behavioural-tracking cookies. If optional analytics, advertising or similar technology is introduced, this policy and the website’s consent controls will be updated before it is enabled.

Following a link to an external website, including Facebook, may allow that external service to use its own cookies under its own privacy policy.

11. Keeping information secure

Reasonable technical and organisational measures are used to protect personal information, including restricted administrative access, password protection, secure payment processing and validation of website submissions.

No internet service can guarantee absolute security. Please do not send unnecessary confidential information through free-text forms or email.

12. Your data-protection rights

Depending on the circumstances, you may have the right to:

• Ask for a copy of your information.
• Correct inaccurate information.
• Request deletion of information.
• Restrict how information is used.
• Object to certain processing.
• Receive certain information in a portable format.
• Withdraw consent at any time.

Some rights are subject to legal exceptions. For example, we may need to retain transaction records for tax or legal purposes.

To make a request, email: monkeybakesbuxton@gmail.com .

13. Complaints

Please contact Monkey Bakes first if you have a concern about how your information has been used.

You also have the right to complain to the Information Commissioner’s Office:

Make a complaint to the ICO

14. Changes to this policy

This policy may be updated when website functions, service providers or legal requirements change. The latest version and update date will be displayed on this page.