The short version. This website doesn't use cookies, analytics or advertising trackers. If you send an enquiry, we keep it securely so we can reply, and only the people who help run Richmond Bakes can see it. We only use your details to answer you and bake your order, and we never sell your information.
Who we are
Richmond Bakes is a home bakery in Worcester, England. In this policy, "we", "us" and "our" mean Richmond Bakes. We are the controller of the personal information described here, which means we decide how it's used and we're responsible for looking after it.
If you have any questions about this policy or your information, send a direct message to @richmondbakes on Instagram.
What we collect
When you send an enquiry
When you use the enquiry form, we store what you enter: your name, how you'd like us to contact you (email address, phone number or Instagram username), what you'd like, dates, quantities, your message and any allergy or dietary details. It's kept in our enquiry system, which runs on Google Firebase with data stored in London, UK.
To help block spam, your browser is given a random, anonymous ID for the submission. It isn't linked to you and nothing is saved on your device.
If you choose not to use the form, you can message us on Instagram instead.
When you contact us or place an order
Depending on how you get in touch and what you order, we may also hold:
- Order details: what you'd like, dates, occasion, design ideas and any inspiration photos you share.
- Collection or delivery details, including a delivery address if we deliver your order.
- Payment records, such as the amount, date and payment reference. We never see or store full card details.
- Notes about your order that help us look after you, such as when we replied.
Allergy and dietary information
Information about allergies, intolerances or medical dietary needs can count as health information, which UK law treats as a special category of personal data. We only ask for it so we can make your order safely, we only use it for that purpose, and we rely on your explicit consent, which you give by ticking the box on the form. You can withdraw your consent at any time, although we may then be unable to make your order safely.
When you visit this website
This website is hosted by Google Firebase Hosting. Like any web host, it automatically processes technical information such as your IP address, browser type and the pages you request, so it can deliver the site and protect it from abuse. We don't use this information to identify you, and we haven't added any analytics or tracking tools. Google's handling of this data is described in the Firebase privacy information.
How and why we use it
UK data protection law requires us to have a lawful basis for each way we use your information:
| What we do | Lawful basis |
|---|---|
| Reply to your enquiry, check availability and give you a quote | Taking steps at your request before entering into a contract, and our legitimate interest in answering people who contact us |
| Make your order and arrange collection or delivery | Performing our contract with you |
| Use allergy and dietary information to make your order safely | Your explicit consent |
| Keep financial and tax records | Complying with our legal obligations |
| Deal with questions, problems or complaints about an order | Performing our contract with you and our legitimate interests |
| Keep this website and our enquiry system secure | Our legitimate interest in providing a safe, working service |
We won't send you marketing messages unless you've asked us to. Whether you follow us on Instagram is entirely up to you and is covered by Instagram's own terms.
Who can see it
Enquiries can only be seen by people who help run Richmond Bakes and have been given access. Their access is limited to what they need, and changes they make are recorded in an audit log.
We never sell or rent your personal information. We only share it where we need to:
- Google (Firebase), which hosts this website and our enquiry system.
- Instagram (Meta): if you message us on Instagram, your messages are processed by Meta under the Instagram privacy policy.
- Banks and payment providers, to take and record payments.
- Delivery help: if anyone else ever helps deliver your order, we'll share only what they need to get it to you.
- Professional advisers and authorities, such as an accountant, HMRC or the local authority's environmental health team, where the law requires it or we need their advice.
International transfers
Our enquiry records are stored in London. Some of our service providers, such as Google and Meta, may process information outside the UK, for example to provide support or security. Where they do, they're required to use safeguards recognised by UK law, such as adequacy regulations or the International Data Transfer Addendum.
How long we keep it
- Enquiries that don't become orders: automatically deleted 12 months after you send them.
- Order and payment records: for as long as the law requires for tax and accounting purposes, usually six years.
- Allergy and dietary information: only as long as we need it for your order and any follow-up questions about it.
- Website hosting logs: kept by Google for a limited period, as set out in its terms.
Your rights
You have the right to:
- ask for a copy of the personal information we hold about you;
- ask us to correct information that's wrong or incomplete;
- ask us to delete your information;
- ask us to restrict how we use it, or object to us using it;
- ask for your information in a portable format; and
- withdraw your consent at any time, where we rely on consent.
To use any of these rights, message us on Instagram. There's usually no charge, and we'll reply within one month. Some rights have legal exceptions (for example, we have to keep tax records), and we'll explain if one applies.
Complaints
If you're unhappy with how we've handled your information, please tell us first so we can try to put it right. You also have the right to complain to the Information Commissioner's Office (ICO), the UK's data protection regulator, at ico.org.uk/make-a-complaint or on 0303 123 1113.
Children
Our orders are placed by adults. If you're under 18, please ask a parent or guardian to get in touch for you.
Changes to this policy
We'll update this policy if the way we handle personal information changes. The date at the top shows when it was last updated.
