Privacy Policy

 1) This privacy policy applies to the Eggfree Cakebox’s website at www.eggfreecake.co.uk (the “Website”). We at the Eggfree Cakebox take your privacy seriously. This policy covers the collection, processing and other use of personal data under the Data Protection Act 1998 (“DPA”) and the General Data Protection Regulations (“GDPR”).

2) For the purpose of the DPA and GDPR we are the data controller and any enquiry regarding the collection or processing of your data should be addressed to Brand Manager at our address 20-22 Jute Lane, Enfield EN3 5PJ.

3) By using the Website you consent to this policy. We are registered with the Information Commissioner’s Office for this purpose.

Information we collect

4) We will collect personal data on this Website only if it is directly provided to us by you the user, e.g. your e-mail address, name, home or work address and telephone number, and therefore has been provided by you with your consent. Normally you will only provide such details if you wish to sign up for our free e-newsletter or other resources, or are making a purchase from us.

5) We also use analytical and statistical tools that monitor details of your visits to our website and the resources that you access, including, but not limited to, traffic data, location data, weblogs and other communication data (but this data will not identify you personally).

6) Your payment information (e.g. credit card details) provided when you make a purchase from our website is not received or stored by us. That information is processed securely and privately by the third party payment processors that we use. The Eggfree Cakebox will not have access to that information at any time. We may share your personal data with our payment processors, but only for the purpose of completing the relevant payment transaction. Such payment processors are banned from using your personal data, except to provide these necessary payment services to us, and they are required to maintain the confidentiality of your personal data and payment information.

Use of your information

7)  We may hold and process personal data that you provide to us in accordance with the DPA and GDPR.

8)  The information that we collect and store relating to you is primarily used to enable us to provide our services to you, and to meet our contractual commitments to you. In addition, we may use the information for the following purposes:

8.1)  To notify you about any changes to our website, such as improvements or service/product changes, that may affect our service;

8.2)  If you are an existing customer, we may contact you with information about goods and services similar to those that were the subject of a previous sale to you;

8.3) Where you have consented to receive our e-newsletters, from time to time to provide that to you.

8.4 ) All photos sent to any of our shops are only held for the duration of the order and are deleted straight after to comply with GDPR.

Disclosure of your information

9) We may disclose your information to regulatory bodies to enable us to comply with the law and to assist fraud protection and minimise credit risk.

10) Please be advised that we do not reveal information about identifiable individuals to our advertisers but we may, on occasion, provide them with aggregate statistical information about our visitors.

Controlling the use of your data

11) If you have given us consent to use your data for a particular purpose you can revoke or vary that consent at any time. If you do not want us to use your data or want to vary the consent that you have provided you can write to us at the address detailed in clause 2 or email us at info@eggfreecake.co.uk at any time.

Where we store and transfer your data

12)  We do not use or disclose sensitive personal data, such as race, religion, or political affiliations, without your explicit consent.

13) We may disclose your personal data outside of our group: (a) in the event that we sell or buy any business or assets, in which case we may disclose your personal data to the prospective seller or buyer of such business or assets; and (b) if the Eggfree Cakebox’s business is bought by a third party, in which case personal data held by it about its customers will be one of the assets to transfer to the buyer.  However any such transfer will only be on terms that the confidentiality of your personal data is protected and that the terms of this privacy policy will continue to be complied with by the recipient.

14) Otherwise, we will process, disclose or share your personal data only if required to do so by law or in the good faith belief that such action is necessary to comply with legal requirements or legal process served on us or the website.

15) You have the right to opt out of our processing your personal data for marketing purposes at any time by contacting us at Info@eggfreecake.co.uk ? Or by logging into your account and updating your details online

Security

16) The transmission of information via the Internet or email is not completely secure.  Although we will do our best to protect your personal data, we cannot guarantee the security of data while you are transmitting it to our site; any such transmission is at your own risk.  Once we have received your personal data, we will use strict procedures and security features to try to prevent unauthorised access.

17) Where we have given you (or where you have chosen) a password so that you can access certain parts of our site, you are responsible for keeping this password confidential.  You should choose a password it is not easy for someone to guess.

Third party links

18) You might find links to third party websites on our website. We do not accept any responsibility or liability for their policies whatsoever as we have no control over them.

Use of cookies

19) Our Website uses cookies. We use cookies to gather information about your computer for our services and to provide statistical information regarding the use of our Website. Such information will not identify you personally - it is statistical data about our visitors and their use of our Website. This statistical data does not identify any personal details whatsoever. We may also gather information about your general Internet use by using a cookie file. Where used, these cookies are downloaded to your computer automatically. This cookie file is stored on the hard drive of your computer, as cookies contain information that is transferred to your computer's hard drive. They help us to improve our Website and the service that we provide to you. All computers have the ability to decline cookies. This can be done by activating the setting on your browser which enables you to decline the cookies. Please note that should you choose to decline cookies, you may be unable to access particular parts of our Website. Where we work with advertisers on our Website, our advertisers may also use cookies, over which we have no control. Such cookies (if used) would be downloaded once you click on advertisements on our Website.]

Cookie name: _gcl_au Cookie purpose: These cookies are used by Google to improve and measure the website actions taken by a site visitor. Cookies may be used to show advertising within Paid Search, Display and Video platforms subsequent to the website visit. When are cookies set on a visitor’s device? On initial visit to the website. Expiry time of cookie: 90 days

Your rights

20) The DPA and GDPR give you the right to access information held about you by us. Please write to us or contact us by email if you wish to request confirmation of what personal information we hold relating to you. You can write to us at the address detailed in clause 2, above, or by email to info@eggfreecake.co.uk. There is no charge for requesting that we provide you with details of the personal data that we hold. We will provide this information within one month of your requesting the data.

21) You have the right to change the permissions that you have given us in relation to how we may use your data. You also have the right to request that we cease using your data or that we delete all personal data records that we hold relating to you. You can exercise these rights at any time by writing to us at the address detailed in clause 2, above, or by email to info@eggfreecake.co.uk

Changes to this policy

22) We may update these policies to reflect changes to the website and customer feedback. Please regularly review these policies to be informed of how we are protecting your personal data.

We welcome any queries, comments or requests you may have regarding this Privacy Policy. Please do not hesitate to contact us at 20-22 Jute Lane Enfield EN3 7PJ or info@eggfreecake.co.uk.

Version:  24 May 2018

2017 version : https://www.eggfreecake.co.uk/privacy-policy-2017

This Privacy Policy describes how your personal information is collected. used and shared when you visit or make a purchase from Website

Privacy Policy for Eggfree Cakebox

Effective Date: June 26, 2025 Version: 2.0

1. Who We Are

2. The Personal Data We Collect

• Sign up for our e-newsletter or other resources:
• Data Collected: Email address, Name.
• Purpose: To send you our e-newsletter, updates, and relevant resources you requested.
• Lawful Basis: Your Consent.
• Make a purchase from our website:
• Data Collected: Name, billing address, delivery address, telephone number, email address.
• Purpose: To process your order, deliver your products, manage your account, and fulfil our contractual obligations to you.
• Lawful Basis: Performance of a Contract with you.
• Send photos to our shops for orders:
• Data Collected: Photos containing personal images (of you or others).
• Purpose: To fulfil your specific order requirements (e.g., printing on a cake).
• Lawful Basis: Your Consent (implied by providing the photo for a specific order). If the photo contains special category data (e.g., revealing racial origin through skin tone, or health data through a disability visible in the photo), explicit consent will be sought if necessary, or another Article 9 condition will be relied upon.
• Contact us via email, phone, or post:
• Data Collected: Your name, contact details, and the content of your communication.
• Purpose: To respond to your enquiries, provide customer support, and improve our services.
• Lawful Basis: Our Legitimate Interests in effectively managing customer service and inquiries.

• Data Collected (but not identifying you personally, unless combined with other data): Traffic data, location data (general, not precise GPS), weblogs, browser type, device type, operating system, pages viewed, time spent on pages, referring URLs, and potentially anonymized or pseudonymous IP addresses.
• Purpose: To analyze website performance, understand user behaviour, enhance website functionality, and detect potential security threats.
• Lawful Basis:
• For strictly necessary cookies (e.g., for security, load balancing, or remembering items in your shopping cart): Legitimate Interests or Performance of a Contract.
• For analytical/statistical cookies (used to improve the service) and functional cookies (relating to website appearance/preferences, authentication): The DUAA 2025 clarifies that consent may no longer be required for these specific categories, provided they are used solely for those purposes and you provide clear information about them. We rely on our Legitimate Interests for these, balanced against your rights and freedoms.
• For marketing/profiling cookies or other non-essential cookies: Your Consent.
• Note on Payment Information: Your payment information (e.g., credit card details) provided when you make a purchase from our website is not received or stored by us. That information is processed securely and privately by the third-party payment processors we use (e.g., [mention specific payment processors if you wish, e.g., Stripe, PayPal]). We may share your personal data with our payment processors, but only for the purpose of completing the relevant payment transaction. Such payment processors are contractually bound to use your personal data only to provide these necessary payment services to us and are required to maintain the confidentiality and security of your personal data and payment information.

3. How We Use Your Information

• To provide our services and fulfil contractual commitments: This includes processing your orders, arranging delivery, managing your account, and providing customer support related to your purchases. (Lawful Basis: Performance of a Contract)
• To notify you of service changes: To inform you about any changes to our website, improvements, or service/product changes that may affect our service to you. (Lawful Basis: Legitimate Interests in keeping you informed about our services).
• For marketing communications:
• If you are an existing customer, we may contact you with information about goods and services similar to those that were the subject of a previous sale to you ("soft opt-in"). (Lawful Basis: Legitimate Interests, unless you have opted out).
• Where you have specifically consented to receive our e-newsletters, we will provide them to you from time to time. (Lawful Basis: Consent).
• To manage and delete photos for orders: All photos sent to any of our shops are held only for the duration of the order and are deleted straight after to comply with data minimisation principles under UK GDPR. (Lawful Basis: Performance of a Contract; Consent for special category data if applicable).
• For website improvement and analytics: To monitor and analyze website usage, improve functionality, and understand user preferences. (Lawful Basis: Legitimate Interests for analytical/statistical and functional cookies as per DUAA 2025; Consent for other non-essential cookies).

4. How We Share Your Information

• Payment Processors: As noted above, we share necessary transaction data with our secure third-party payment processors to complete your purchases.
• Service Providers: We engage third-party service providers who perform functions on our behalf, such as website hosting, email delivery, IT support, and potentially analytics providers. These providers are only given access to personal data necessary to perform their functions and are contractually obligated to keep it secure and confidential.
• Regulatory Bodies and Law Enforcement: We may disclose your information to regulatory bodies, law enforcement agencies, or other authorities to enable us to comply with the law, assist fraud protection, and minimise credit risk, or if we are legally compelled to do so. (Lawful Basis: Legal Obligation or Legitimate Interests in preventing fraud/crime).
• Business Transfers: In the event that we sell or buy any business or assets, we may disclose your personal data to the prospective seller or buyer of such business or assets. If Eggfree Cakebox’s business is bought by a third party, personal data held by it about its customers will be one of the assets transferred to the buyer. Any such transfer will only be on terms that the confidentiality and security of your personal data is protected, and that the terms of this privacy policy will continue to be complied with by the recipient. (Lawful Basis: Legitimate Interests in business continuity).
• Aggregated Statistical Information: We may provide our advertisers or partners with aggregate statistical information about our visitors, but this data will not identify you personally.

• UK Adequacy Regulations (where the UK government has deemed a country's data protection laws to be adequate).
• Standard Contractual Clauses (SCCs) or the International Data Transfer Agreement (IDTA) approved by the Information Commissioner's Office (ICO).

5. How Long We Store Your Data (Data Retention)

• Order-related data: Retained for as long as necessary to fulfil the order, process returns, handle warranty claims, and comply with tax and accounting laws (typically 6-7 years after the transaction).
• Photos for orders: Deleted immediately after the order is fulfilled.
• Marketing consent records: Retained until you withdraw your consent or for a reasonable period thereafter to ensure your preferences are respected.
• Website analytics data: Retained for a period necessary for analysis, often anonymized or aggregated after a certain time.

6. Your Rights

• The Right to Be Informed: To receive clear, transparent, and easily understandable information about how we use your personal data and your rights. This Privacy Policy serves that purpose.
• The Right of Access (Subject Access Request - SAR): To request confirmation of what personal data we hold relating to you and to receive a copy of that data. There is no charge for requesting this information. We will provide this information within one month of your request, or inform you if we need more time (up to a total of two months) or if your request is manifestly unfounded or excessive.
• The DUAA clarifies that we only need to make "reasonable and proportionate" searches when responding to SARs and can "stop the clock" if further information or ID verification is needed from you.
• The Right to Rectification: To request that inaccurate or incomplete personal data we hold about you is corrected or completed.
• The Right to Erasure ('Right to be Forgotten'): To request that we delete or remove your personal data where there is no compelling reason for its continued processing (e.g., if you withdraw consent, or the data is no longer necessary for the purpose it was collected).
• The Right to Restrict Processing: To request that we 'block' or suppress the processing of your personal data in certain circumstances (e.g., if you contest the accuracy of the data, or you object to processing based on legitimate interests).
• The Right to Data Portability: To obtain and reuse your personal data for your own purposes across different services, typically in a structured, commonly used, machine-readable format.
• The Right to Object: To object to the processing of your personal data in certain circumstances, particularly where we rely on "legitimate interests" as our lawful basis, or for direct marketing purposes (you have an absolute right to object to direct marketing).
• Rights in relation to Automated Decision Making and Profiling: If we make significant decisions about you using solely automated means (without human involvement) that have legal or similarly significant effects, you have the right to challenge this, express your point of view, and obtain human intervention. (Note: We do not currently use such automated decision-making processes).

7. Complaints

8. Security of Your Data

9. Third Party Links

10. Use of Cookies and Similar Technologies

• Strictly Necessary Cookies: These are essential for our website to function and cannot be switched off in our systems. They are usually only set in response to actions made by you, such as setting your privacy preferences, logging in, or filling in forms (e.g., maintaining items in your shopping basket). You can set your browser to block or alert you about these cookies, but some parts of the site will not work. (Lawful Basis: Legitimate Interests/Performance of Contract; No consent required under PECR/DUAA).
• Analytical/Statistical Cookies: These allow us to count visits and traffic sources so we can measure and improve the performance of our site. They help us to know which pages are the most and least popular and see how visitors move around the site. The DUAA 2025 clarifies that consent may not be required for these if used solely for statistical purposes to improve the service.
• Example: _gcl_au (Google Analytics cookie for website actions, advertising - expires 90 days).
• Purpose: To improve and measure website actions taken by a site visitor. May be used to show advertising within Paid Search, Display, and Video platforms subsequent to the website visit.
• Lawful Basis: Legitimate Interests (as per DUAA 2025 for statistical purposes).
• Functional Cookies: These enable the website to provide enhanced functionality and personalisation. They may be set by us or by third-party providers whose services we have added to our pages (e.g., remembering your preferences, allowing social media sharing). The DUAA 2025 clarifies that consent may not be required for these.
• Lawful Basis: Legitimate Interests.
• Marketing/Targeting Cookies: These cookies may be set through our site by our advertising partners. They may be used by those companies to build a profile of your interests and show you relevant adverts on other sites. They do not store direct personal information but are based on uniquely identifying your browser and internet device.
• Lawful Basis: Your Consent.

11. Changes to This Policy

12. Contact Us