1. Who we are
This website is operated by:
Business name: Lucy’s Little Bakes
Website: lucyslittlebakes.co.uk
Contact email: [email protected]
We are the “data controller” responsible for your personal data under UK data protection law.
2. What data we collect
We may collect and process the following information:
Information you provide to us:
- Name
- Billing and delivery address
- Email address
- Phone number (if provided)
- Payment information (processed securely by our payment providers, we do not store full card details)
- Order details (products purchased, order notes, preferences)
Information collected automatically:
- IP address
- Browser type and device information
- Cookies and usage data (e.g. pages visited, time spent)
3. How we use your data
We use your personal data to:
- Process and fulfil your orders
- Deliver goods to your address
- Communicate with you about your order
- Provide customer support
- Prevent fraud and ensure website security
- Comply with legal and tax obligations
- Improve our website and services
We do not sell your personal data.
4. Legal basis for processing (UK GDPR)
We process your data under the following lawful bases:
- Contract: to fulfil your order
- Legal obligation: for tax and accounting requirements
- Legitimate interests: improving services and preventing fraud
- Consent: for marketing emails (if you opt in)
5. Sharing your data
We may share your data with trusted third parties, including:
- Payment processors
- Delivery couriers
- Email marketing services
These providers only access the data necessary to perform their services.
6. Cookies
We use cookies to:
- Enable website functionality (e.g. shopping cart)
- Remember user preferences
- Analyse website traffic
You can disable cookies in your browser settings, but some features may not work properly.
7. Data retention
We keep your personal data only as long as necessary:
- Order and transaction data: typically 6 years (tax/legal requirements)
- Customer support communications: up to 2 years
- Marketing data: until you unsubscribe or withdraw consent
8. Your rights
Under UK GDPR, you have the right to:
- Access your personal data
- Request correction of inaccurate data
- Request deletion of your data (where applicable)
- Object to processing
- Withdraw consent for marketing
- Request data portability
To exercise these rights, contact us at [email protected]
9. Data security
We take appropriate technical and organisational measures to protect your data, including:
- Secure hosting
- SSL encryption
- Restricted access to personal data
- Secure payment processing via third parties
10. International transfers
Some service providers may process data outside the UK. Where this occurs, we ensure appropriate safeguards are in place (such as UK adequacy regulations or standard contractual clauses).
11. Third-party links
Our website may contain links to other websites. We are not responsible for their privacy practices.
12. Changes to this policy
We may update this policy from time to time. The latest version will always be posted on this page.
13. Contact us
If you have any questions about this policy or your data, contact:
Email: [email protected]