Privacy Policy

Privacy Policy

Last updated: 20 July 2026

1. About this privacy policy

This privacy policy explains how Happy Crumb Bakery Ltd collects, uses, stores and shares personal information when you:

  • visit our website;

  • place an order;

  • create a customer account;

  • purchase or manage a subscription;

  • sign up for marketing;

  • contact us;

  • submit a corporate, wholesale or event enquiry;

  • upload artwork or personalisation details;

  • leave a review;

  • apply for work with us; or

  • otherwise interact with our business.

This policy applies to the website at:

https://www.happycrumbbakery.co.uk

It also applies to personal information collected through forms, email, telephone, social media, recruitment platforms and other services used by Happy Crumb Bakery.


2. Who we are

Happy Crumb Bakery Ltd is the controller responsible for the personal information described in this policy.

Company name: Happy Crumb Bakery Ltd
Company number: 15817046
Registered office: 124 City Road, London, EC1V 2NX
Privacy contact: [email protected]

Our registered office is our official company address. Privacy enquiries and requests should be sent by email to [email protected].


3. Personal information we collect

The information we collect depends on how you interact with us.

Website and technical information

We may collect:

  • IP address;

  • browser type and version;

  • device type;

  • operating system;

  • approximate location derived from your IP address;

  • pages viewed;

  • links clicked;

  • visit dates and times;

  • referring website or advertising campaign;

  • cookie preferences;

  • shopping basket activity; and

  • information generated through analytics, advertising and security technologies.

Customer and account information

We may collect:

  • name;

  • email address;

  • telephone number;

  • billing address;

  • delivery address;

  • account username;

  • encrypted account password;

  • communication preferences;

  • order history;

  • saved account information;

  • customer notes; and

  • communications with our team.

We do not have access to your unencrypted account password.

Order and delivery information

We may collect:

  • products ordered;

  • quantities;

  • prices and discounts;

  • delivery date;

  • delivery address;

  • recipient name;

  • recipient telephone number;

  • delivery instructions;

  • gift messages;

  • dispatch and tracking information;

  • failed delivery information;

  • refund or replacement information; and

  • complaints or customer-service correspondence.

When you order a gift for another person, you are responsible for providing their information appropriately. We use that information to prepare and deliver the order and to resolve any delivery issue.

Payment and subscription information

We may collect:

  • payment method;

  • payment status;

  • transaction references;

  • refund information;

  • subscription status;

  • renewal dates;

  • failed payment records;

  • payment processor identifiers; and

  • limited card information, such as the card type and final digits, where supplied by the payment provider.

Payments and recurring subscription charges are processed by payment providers such as Stripe and any other payment options shown at checkout.

We do not normally receive or store complete payment-card numbers or card security codes.

Personalised product and artwork information

Where you purchase a personalised or branded product, we may collect:

  • logos;

  • photographs;

  • names;

  • messages;

  • design files;

  • brand guidelines;

  • event details;

  • printing instructions; and

  • correspondence about artwork approval.

Please avoid including sensitive personal information in uploaded files unless it is genuinely necessary for your order.

You must have permission to provide any personal information, photographs or artwork relating to another person.

Corporate, wholesale and event enquiries

We may collect:

  • business or organisation name;

  • contact name;

  • job title or position;

  • business email address;

  • telephone number;

  • delivery or event requirements;

  • anticipated order quantities;

  • requested dates;

  • budget information;

  • product preferences; and

  • enquiry correspondence.

Marketing information

We may collect:

  • email address;

  • name;

  • subscription date;

  • source of signup;

  • marketing preferences;

  • consent records;

  • unsubscribe records;

  • emails delivered;

  • emails opened;

  • links clicked;

  • campaign engagement; and

  • purchasing or website activity used to create relevant customer segments.

Abandoned-basket information

Where permitted by law and your communication preferences, we may use Brevo and WooCommerce information to remind you about products left in your basket.

This may include:

  • email address;

  • basket contents;

  • basket value;

  • date and time of basket activity;

  • whether a reminder was delivered or opened; and

  • whether the order was later completed.

Reviews and feedback

We may collect or receive:

  • your name or username;

  • review content;

  • rating;

  • order information;

  • email address;

  • responses to review requests; and

  • correspondence about a review.

Reviews may be collected through our website, Google, Trustpilot or another review service clearly identified when you submit the review.

Recruitment information

When you apply for work with us, we may collect:

  • name;

  • contact details;

  • CV;

  • employment history;

  • qualifications;

  • availability;

  • right-to-work information;

  • answers to application questions;

  • interview notes;

  • references;

  • driving information, where relevant to the role; and

  • other information you choose to provide.

Applications may be collected through services including Indeed, Connecteam and Google-hosted forms or spreadsheets.

The relevant platform may also process your information under its own privacy policy.

Information from other sources

We may receive information from:

  • payment providers;

  • delivery companies;

  • Shippo;

  • advertising and analytics platforms;

  • review platforms;

  • recruitment platforms;

  • social media platforms;

  • fraud-prevention services;

  • business customers;

  • gift purchasers;

  • event organisers; and

  • people authorised to contact us on your behalf.


4. Why we use personal information

We use personal information for the purposes below.

Processing and fulfilling orders

We use customer, order, payment and delivery information to:

  • accept and process orders;

  • take payment;

  • prepare products;

  • arrange delivery or collection;

  • provide tracking information;

  • communicate about an order;

  • manage refunds, replacements and complaints; and

  • provide customer support.

Lawful basis: performance of a contract or taking steps at your request before entering into a contract.

Creating and managing customer accounts

We use account information to:

  • create your account;

  • provide access to account features;

  • display previous orders;

  • save permitted customer preferences; and

  • protect account security.

Lawful basis: performance of a contract and our legitimate interests in operating a secure and convenient customer-account service.

Managing subscriptions

We use subscription and payment information to:

  • create and administer subscriptions;

  • process recurring payments;

  • schedule deliveries;

  • send renewal or payment notifications;

  • manage failed payments;

  • process cancellations; and

  • provide subscription support.

Lawful basis: performance of a contract, compliance with legal obligations and our legitimate interests in administering subscriptions and preventing payment fraud.

Delivering orders

We share the minimum information required with delivery providers to:

  • create shipping labels;

  • route deliveries;

  • provide delivery updates;

  • contact the recipient where necessary;

  • verify delivery; and

  • investigate delayed, lost or damaged parcels.

Lawful basis: performance of a contract and our legitimate interests in completing deliveries and resolving delivery problems.

Producing personalised products

We use uploaded artwork and personalisation information to:

  • prepare product proofs;

  • obtain approval;

  • print or produce the requested design;

  • communicate with you about production; and

  • investigate quality or order issues.

Lawful basis: performance of a contract or taking steps at your request before entering into a contract.

Responding to enquiries

We use contact and enquiry information to:

  • answer questions;

  • prepare quotes;

  • discuss product requirements;

  • manage corporate, wholesale and event opportunities; and

  • maintain records of business discussions.

Lawful basis: taking steps at your request before entering into a contract and our legitimate interests in responding to enquiries and developing our business.

Sending transactional communications

We may send service messages about:

  • orders;

  • deliveries;

  • customer accounts;

  • subscriptions;

  • payments;

  • refunds;

  • changes to products or services; and

  • information required to operate our contractual relationship.

These communications are not marketing messages.

Lawful basis: performance of a contract, compliance with legal obligations and our legitimate interests in administering customer relationships.

Sending marketing

We use marketing information to send news, offers, product announcements and other promotional communications to people who have subscribed or where another lawful marketing rule applies.

For individual subscribers, including consumers, sole traders and some partnerships, we send electronic marketing where:

  • you have consented; or

  • all requirements of the customer soft opt-in are satisfied.

When relying on the customer soft opt-in, your details must have been obtained directly during a sale or genuine negotiation for a sale, the marketing must concern our own similar products or services, and you must have been given a clear opportunity to opt out when your details were collected and in every later marketing message.

We may send relevant business marketing to employees of limited companies and other corporate subscribers where permitted by law. Every marketing message will include an unsubscribe option.

Lawful basis: consent where required, or legitimate interests where electronic privacy rules permit marketing without consent.

You can unsubscribe using the link in any marketing email or by contacting [email protected].

Measuring marketing engagement

We may use Brevo or similar services to understand whether marketing emails are delivered, opened or clicked.

We use this information to:

  • measure campaign performance;

  • understand customer interests;

  • avoid sending irrelevant communications;

  • manage mailing lists;

  • identify inactive contacts; and

  • improve our marketing.

Email tracking may use pixels and similar technologies. Where consent is required for these technologies, they should only operate after valid consent has been obtained.

Lawful basis: consent where required by electronic privacy rules and legitimate interests where the activity is legally permitted without consent.

Sending abandoned-basket reminders

We may send an abandoned-basket reminder where you have consented to marketing or where another applicable electronic-marketing rule permits it.

Receiving a transactional email from us does not automatically subscribe you to marketing.

Lawful basis: consent, or legitimate interests where the customer soft opt-in or another applicable rule permits the communication.

Operating and improving the website

We use technical and usage information to:

  • provide website functions;

  • maintain shopping baskets and customer sessions;

  • secure the website;

  • detect errors;

  • prevent fraud and misuse;

  • understand website performance;

  • improve navigation and checkout; and

  • measure sales and conversions.

Lawful basis: legitimate interests for essential website administration and security, and consent for non-essential analytics or advertising technologies where consent is required.

Advertising and conversion measurement

Where you consent through our cookie controls, we may use advertising, remarketing and conversion-tracking technologies.

These technologies may:

  • record visits and purchases;

  • measure advertising results;

  • create or contribute to advertising audiences;

  • show relevant advertisements on other websites or platforms; and

  • connect activity across devices or services.

Lawful basis: consent where required.

You can change your preferences using the website’s cookie controls.

Reviews and customer feedback

We use review and feedback information to:

  • request reviews;

  • publish reviews;

  • respond to feedback;

  • verify that reviews relate to genuine experiences;

  • improve products and services; and

  • investigate complaints.

Lawful basis: legitimate interests in understanding customer experiences, improving our services and maintaining trustworthy reviews.

Recruitment

We use applicant information to:

  • assess applications;

  • arrange interviews;

  • communicate with candidates;

  • check eligibility for a role;

  • obtain references;

  • make recruitment decisions; and

  • maintain appropriate recruitment records.

Lawful basis: taking steps at your request before entering into a contract, compliance with legal obligations and our legitimate interests in recruiting suitable workers.

Where recruitment involves special-category information, criminal-offence information or formal right-to-work checks, we will only process it where an additional legal condition applies.

Accounting, taxation and legal compliance

We use relevant information to:

  • maintain financial records;

  • comply with tax and accounting duties;

  • comply with food-safety or product-recall requirements;

  • respond to regulators and public authorities;

  • establish, exercise or defend legal claims; and

  • comply with other legal obligations.

Lawful basis: compliance with legal obligations and our legitimate interests in protecting the business and enforcing our rights.

Fraud prevention and security

We may use order, payment, device and account information to:

  • prevent fraudulent transactions;

  • protect customers and our business;

  • secure accounts;

  • investigate suspicious activity; and

  • enforce our terms.

Lawful basis: legitimate interests, performance of a contract and compliance with legal obligations where applicable.


5. When we require your information

Some information is required to enter into or perform a contract with you.

For example, we need your contact, payment and delivery information to process most orders. Where required information is not supplied, we may be unable to accept or fulfil the order.

Optional fields will normally be identified as optional.


6. Who we share personal information with

We may share relevant information with:

  • employees, workers and contractors who need it to perform their duties;

  • WooCommerce, WordPress and website-service providers;

  • GoDaddy;

  • Simply Solve IT;

  • Stripe and other payment providers displayed at checkout;

  • Brevo;

  • Google, including Google Analytics and Google-hosted business tools;

  • advertising and conversion-tracking providers used on the website;

  • Shippo;

  • DPD;

  • Royal Mail;

  • Pedal Me;

  • other couriers or delivery providers selected for an order;

  • Trustpilot;

  • accountants, insurers, solicitors and other professional advisers;

  • IT, hosting, security and website-support providers;

  • printing or production suppliers involved in personalised orders;

  • fraud-prevention and payment-security providers;

  • recruitment services including Indeed and Connecteam;

  • regulators, courts, law-enforcement bodies and public authorities where required; and

  • a buyer, investor or successor if our business or assets are sold, reorganised or transferred.

We only share information reasonably required for the relevant purpose.

Some recipients act as processors on our instructions. Other recipients, including payment providers, couriers, review platforms and recruitment platforms, may act as separate controllers for some activities and will have their own privacy notices.

We do not sell personal information.


7. International transfers

Some suppliers may process or permit access to personal information from countries outside the United Kingdom.

Where a restricted international transfer occurs, we require an appropriate legal safeguard. Depending on the destination and provider, this may include:

  • UK adequacy regulations;

  • the UK International Data Transfer Agreement;

  • the UK Addendum to the European Commission’s Standard Contractual Clauses;

  • another transfer mechanism permitted by UK data-protection law; or

  • a specific legal exception where applicable.

Further information about safeguards used for a particular provider can be requested by emailing [email protected].


8. How long we keep personal information

We retain information for the period reasonably required for the purpose for which it was collected and to meet legal, accounting and operational obligations.

Our normal retention periods are:

Orders, invoices and financial records

Normally six years after the end of the relevant financial year or accounting period, unless a longer period is required for a dispute, investigation or legal obligation.

Customer accounts

For as long as the account remains active and normally for up to six years after the last order or meaningful account activity.

You may ask us to close your account earlier. We may retain order and financial records where required by law.

Subscription records

For the duration of the subscription and normally for up to six years after it ends, where required for financial, contractual or legal records.

Customer-service enquiries and complaints

Normally for up to six years after the matter is closed where the information may be relevant to a contract, complaint or legal claim. Routine enquiries with no continuing relevance may be deleted sooner.

Corporate, wholesale and event enquiries

Normally for up to three years after the last meaningful contact, unless a contract is entered into or an ongoing business relationship continues.

Uploaded artwork and personalisation files

Normally for up to 12 months after the order is completed, unless:

  • you request that we retain reusable brand artwork;

  • it forms part of a continuing corporate relationship;

  • it is needed to resolve a complaint; or

  • a longer period is required by law.

Marketing records

We retain active marketing information until you unsubscribe, withdraw consent or the information is no longer useful.

After an unsubscribe request, we may retain limited information on a suppression list so that we can respect your preference and avoid contacting you again.

Abandoned baskets

Normally for no longer than 90 days, unless the related information becomes part of a completed order or another customer record.

Analytics and advertising data

According to the retention periods configured within the relevant analytics or advertising platform. We periodically review these settings and aim to avoid retaining identifiable analytics information longer than reasonably necessary.

Recruitment information

Unsuccessful application information is normally retained for up to six months after the recruitment process ends, unless you consent to a longer talent-pool period or a longer period is needed to address a legal claim.

Information relating to successful applicants becomes part of their worker or employment record and is covered by our internal staff privacy information.

Security logs

Normally for up to 12 months, unless required for an active security investigation, fraud investigation or legal claim.

Backups may retain information for a limited additional period before they are overwritten.


9. Cookies and similar technologies

Our website uses cookies and similar technologies, which may include pixels, scripts, local storage and tracking links.

These technologies may be used for:

  • website security;

  • customer login;

  • shopping baskets;

  • checkout functions;

  • remembering preferences;

  • analytics;

  • email measurement;

  • advertising;

  • remarketing; and

  • conversion tracking.

Strictly necessary technologies may operate without consent where they are essential to provide a service requested by you or another legal exception applies.

Non-essential analytics, advertising, remarketing and similar tracking technologies are only used where permitted by law and, where required, after you have given valid consent.

You should be able to:

  • accept non-essential technologies;

  • reject non-essential technologies;

  • choose categories;

  • change your preferences later; and

  • access information about the technologies in use.

More detailed information, including technology names, providers, purposes and expiry periods, should be available through our cookie settings or cookie policy.

Browser settings can also be used to block or delete cookies. Blocking essential cookies may prevent parts of the website or checkout from operating correctly.


10. Security

We use appropriate technical and organisational measures designed to protect personal information.

These measures may include:

  • access controls;

  • password protection;

  • encrypted connections;

  • secure hosting;

  • software updates;

  • payment processing through established providers;

  • restricted staff access;

  • backups;

  • monitoring; and

  • procedures for responding to suspected personal-data breaches.

No online service can guarantee complete security. You are responsible for keeping your account password confidential and should contact us if you believe your account has been compromised.


11. Automated decisions and profiling

We may use limited profiling to:

  • create marketing segments;

  • measure customer engagement;

  • recommend relevant products;

  • identify abandoned baskets;

  • measure advertising performance; and

  • identify potentially fraudulent activity.

We do not currently make decisions producing legal or similarly significant effects about customers using solely automated processing.

Where this changes, we will provide the information and safeguards required by law.


12. Your data-protection rights

Depending on the circumstances, you may have the right to:

  • be informed about how your information is used;

  • obtain access to your personal information;

  • correct inaccurate or incomplete information;

  • request deletion of information;

  • restrict how information is used;

  • object to processing based on legitimate interests;

  • object to direct marketing;

  • receive certain information in a portable format;

  • withdraw consent at any time where processing relies on consent;

  • request human intervention in relation to qualifying automated decisions; and

  • complain to the Information Commissioner’s Office.

These rights are subject to legal conditions and exemptions. For example, we may need to retain financial information despite a deletion request.

You will not normally have to pay a fee to exercise your rights. We may charge a reasonable fee or refuse a request where the law allows us to do so, including where a request is manifestly unfounded or excessive.

We may ask for information needed to confirm your identity.

We normally respond without undue delay and within one calendar month. The period may be extended by up to two further months where a request is complex or numerous. We will tell you where an extension applies.

To exercise a right, email:

[email protected]


13. Marketing choices

You can stop marketing communications at any time by:

  • selecting the unsubscribe link in an email;

  • changing any available communication preferences; or

  • emailing [email protected].

Unsubscribing from marketing will not prevent essential service communications about an order, account, payment or subscription.


14. Complaints

Please contact us first if you have a concern about how we use your information:

[email protected]

You also have the right to complain to the Information Commissioner’s Office.

Information Commissioner’s Office
Wycliffe House
Water Lane
Wilmslow
Cheshire
SK9 5AF

Telephone: 0303 123 1113

Website: https://ico.org.uk


15. Third-party websites and services

Our website may link to external websites, social networks, review services, payment providers and recruitment platforms.

Those organisations may collect and use information under their own privacy policies. We do not control their independent processing.


16. Children’s information

Our products and website are directed primarily at adults purchasing bakery products.

We do not knowingly use the website to collect personal information directly from children for marketing purposes.

Where an adult provides a child’s name, image or other information for a personalised product, the adult must have authority to provide it and should only provide information necessary to complete the order.


17. Changes to this policy

We may update this privacy policy to reflect changes to our services, suppliers, website or legal obligations.

The latest version will be published on this page with its updated date.

Where a change significantly affects how we use personal information, we will provide additional notice where appropriate.

A change to this policy does not override your data-protection rights or create consent where valid consent is legally required.


18. Contact us

For questions, requests or complaints concerning personal information, contact:

Happy Crumb Bakery Ltd
Email: [email protected]
Registered office: 124 City Road, London, EC1V 2NX
Company number: 15817046

Shopping Basket