This privacy notice explains how Sweet Crust Bakery processes personal data when you use the website, contact us, or place an order. It follows the data lifecycle from collection through use, sharing, retention, and deletion.
This introduction summarizes the subjects addressed in the policy and points to related internal guidance.
Data handling overview
This section outlines the categories of personal information we may process, where that information comes from, the types of cookies used on the site, and the controls available to you.
We may process name, email address, phone number if provided, inquiry messages, order specifications, event date or collection preferences, and allergen information that you choose to share. We also process limited technical data such as server request metadata and browser or device information to keep the website secure and functioning properly.
Data is collected when you submit a contact form, send an email, call us, or take part in a scheduled consultation. Technical data is generated automatically when you visit the website or use its forms. We do not rely on unconfirmed tracking or marketing tools for this notice.
Essential cookies support basic website operation, form handling, and technical delivery. Preference cookies remember privacy choices so the site can respect them on later visits. We do not state that analytics or advertising cookies are active in this policy.
We use only essential cookies for site operation and cookies that remember privacy preferences. You can manage or block cookies through your browser settings, but some site functions may not work as intended if essential cookies are disabled.
We use personal data to answer enquiries, confirm order details, manage collection or delivery preferences, review allergen information you provide, support production scheduling, maintain website security, and deliver technical functions needed for the site to operate. Where relevant, we also use data to keep records necessary for compliance and service administration.
We may share data with service providers that help us operate the website, deliver technical functions, or support communication and order handling. These recipients act only on our instructions for the relevant service and are expected to protect the information they receive.
We may disclose personal data to public authorities, courts, or other parties when required to comply with legal obligations, enforce our rights, protect website security, or respond to a lawful request. Any disclosure is limited to what is necessary for the specific purpose.
You may have rights to access your data, correct inaccurate information, request deletion, object to certain processing, or ask for restriction in appropriate cases. Some requests may not be fully granted if we must keep information for legal compliance, security, or the completion of an order already in progress.
To exercise a privacy right, send a clear request using one of the contact methods listed in this policy and include enough information for us to identify the relevant record. We may need to confirm your identity and clarify the scope of the request before responding. If a request is refused in whole or in part, we will explain the reason where the law requires it.
We retain personal data for the period needed to respond to enquiries, manage orders, support production and collection arrangements, maintain security records, and meet legal or accounting obligations where applicable. When the relevant purpose ends, data is deleted, anonymised, or archived only if a continuing legal basis requires it.
If we make material changes, we will update this page and may use reasonable service channels to draw attention to the revised notice where appropriate. The version in force is the one published on the website at the time of your visit or interaction.
Under GDPR, we process personal data on a lawful basis that fits the relevant activity, such as responding to enquiries, managing orders, maintaining website security, or meeting legal obligations. We keep processing limited to what is necessary for those purposes and review data through its lifecycle so it is deleted or anonymised when no longer needed.
Where GDPR applies, this notice explains how Sweet Crust Bakery processes personal data for users in the European Economic Area and, where relevant, in Portugal.
Where GDPR applies, you may request access, rectification, erasure, restriction, portability, or objection, subject to legal limits and the nature of the processing involved. If consent is used for a specific activity, you may withdraw it for future processing without affecting earlier lawful processing. We may ask for information needed to verify your identity before acting on a request.
