Privacy Policy

Last updated: 22 August 2026

1. Who we are

The website is operated by Brazenose Limited, trading as Heidi (referred to in this policy as Heidi, we, us or our).

Brazenose Limited is registered in England and Wales under company number 06920274. Our registered office is Arches 35–38 Alma Road, Windsor, SL4 1QZ, United Kingdom.

For UK data-protection law, Brazenose Limited is the controller of the personal information described in this policy.

If you have a privacy question or want to exercise one of your rights, email team@heidibakery.co.uk.

2. What this policy covers

This policy covers:

• your use of www.heidibakery.co.uk and its subdomains;
• technical information collected when you visit the website;
• celebration-cake orders placed through the website; and
• emails or other communications relating to the website or a celebration-cake order.

It does not cover the Heidi app, Heidi Loyalty, gift cards, wholesale customers, recruitment, CCTV, guest Wi-Fi or information collected independently from customers in our shops. Information used at a shop to hand over or resolve a website cake order remains covered by this policy. Those other activities may have their own notices or terms.

The website may link to services operated by other organisations. Their privacy policies apply when you use those services.

3. Information we collect

Information you give us

When you order a celebration cake or contact us about an order, we may collect:

• your name;
• email address and telephone number;
• billing information;
• the cake, size, personalisation, collection shop, date and time you choose;
• the wording requested for a cake plaque or other personalisation;
• messages you send us about the order;
• information needed to resolve a complaint, refund or payment dispute; and
• allergy or dietary information you choose to provide.

Please avoid including unnecessary personal or sensitive information in a cake message or communication.

Payment information

Payments are processed by Stripe. Your complete card details are entered into Stripe’s secure payment service and are not stored by Heidi. We receive limited information needed to administer the transaction, such as payment status, transaction reference, card type and sometimes the last four digits of the card.

Stripe also processes device, transaction and fraud-prevention information under its own privacy arrangements. You can read Stripe’s Privacy Policy.

Information collected automatically

When you use the website, we and our service providers may collect:

• IP address;
• browser, device and operating-system information;
• date and time of access;
• pages viewed, links followed and referring page;
• approximate location derived from an IP address;
• website performance, security and error information; and
• cookie identifiers and your cookie or analytics preferences.

More information appears in our Cookie Policy.

4. How we use information and our legal bases

UK data-protection law requires us to have a lawful basis for using personal information.

Our legitimate interests include operating and improving the website, protecting it from misuse, understanding aggregate use, supporting customers and managing legal claims. We consider the effect on your rights before relying on legitimate interests.

Allergy and dietary information

Allergy or dietary information may reveal information about health and can receive additional protection under data-protection law. If you voluntarily provide it for a cake order, we use it only to respond to your request, advise you and prepare or administer the order. We rely on your explicit consent for this use. You can withdraw that consent, but doing so may mean we cannot fulfil a requested adjustment.

Please remember that our cakes are made in a small, busy kitchen that handles all 14 regulated allergens. We cannot guarantee the absence of any allergen.

Marketing

We do not currently use information collected through this website to send marketing emails or text messages. If this is introduced, it will use a clear, separate opt-in and this policy will be updated before that processing begins. This is separate from consent-controlled advertising measurement described below.

5. Cookies, analytics and embedded services

We use cookies and similar technologies for security, payment processing, website operation and analytics. Some are necessary for the website or checkout to work. Others are used only with consent or, for limited aggregate analytics, where the law permits use subject to a simple opt-out.

The website may use:

• Google Analytics to produce statistics about use of the website;
• Google Maps to display shop locations;
• Cloudflare Stream to deliver video;
• Stripe to provide secure payments and fraud prevention; and
• a preference control to remember your cookie and analytics choices.

We also use Google Ads, Meta and HubSpot to measure advertising, understand customer journeys and improve our campaigns. Advertising and tracking technologies operate only after the relevant consent has been given.

See our Cookie Policy for more detail and information about your choices.

6. Who we share information with

We share personal information only where needed with:

• Stripe, for payment processing, authentication, fraud prevention, refunds and disputes;
• Vercel, which hosts and delivers the website;
• Sanity, which provides the website’s content-management infrastructure;
• Google, where Google Analytics or Google Maps is used;
• Cloudflare, where Cloudflare Stream delivers video;
• Meta, for advertising measurement and audience services where you have consented;
• HubSpot, for website analytics and campaign measurement where you have consented;
• employees and contractors who need information to make, transport or hand over a cake, administer an order or support the website;
• accountants, insurers, legal advisers and other professional advisers;
• fraud-prevention, security and technical-support providers; and
• courts, regulators, law-enforcement agencies or other authorities where disclosure is required or permitted by law.

We do not sell personal information.

7. International transfers

Some service providers operate internationally, so personal information may be accessed or processed outside the United Kingdom.

Where UK data-protection law treats a transfer as restricted, we use an approved safeguard. Depending on the destination and provider, this may include UK adequacy regulations, the UK International Data Transfer Agreement, the UK Addendum to the European Commission’s standard contractual clauses, or another safeguard permitted by law.

You can contact team@heidibakery.co.uk for more information about safeguards relevant to your personal information.

8. How long we keep information

We keep personal information only for as long as reasonably necessary for the purpose for which it was collected, including legal, accounting and dispute-resolution requirements.

As a guide:

• cake order, payment, refund and accounting records are normally kept for six years after the relevant financial year;
• routine order correspondence is normally kept with the order record;
• complaint, chargeback or legal-claim information may be kept until the matter is resolved and any relevant claim period has expired;
• allergy or dietary details are removed when they are no longer needed to fulfil or deal with the order, unless they are relevant to an ongoing complaint or legal obligation;
• identifiable Google Analytics event data is retained for no longer than the period configured in our Analytics account, which will not exceed 14 months, while non-identifying aggregate reports may be kept for longer; and
• security and technical logs are kept for a limited period determined by operational and security needs and our providers’ settings.

We may retain a minimal record where needed to demonstrate that a deletion, objection or other rights request was respected.

9. Security

We use reasonable technical and organisational measures designed to protect personal information. These include access controls, secure hosting, encryption in transit, payment processing through Stripe and limiting access to people who need the information.

No online service is completely secure. Please contact us promptly at team@heidibakery.co.uk if you believe personal information connected with the website or an order has been misused.

10. Your rights

Depending on the circumstances, UK data-protection law gives you the right to:

• ask for a copy of personal information we hold about you;
• ask us to correct inaccurate or incomplete information;
• ask us to delete personal information;
• ask us to restrict how information is used;
• object to processing based on legitimate interests;
• receive certain information in a portable format;
• withdraw consent at any time, where processing is based on consent; and
• complain to a data-protection regulator.

These rights are not absolute, and an exemption may apply in some circumstances. We may need to confirm your identity before acting on a request.

To exercise a right, email team@heidibakery.co.uk.

You can also complain to the Information Commissioner’s Office (ICO). Details are available at ico.org.uk/make-a-complaint. We would appreciate the opportunity to resolve your concern first.

11. Children

The website provides general information that may be viewed by anyone, but online cake ordering is intended only for people aged 18 or over. We do not knowingly collect personal information through the cake checkout from children.

12. Changes to this policy

We may update this policy when the website, our services or the law changes. The latest version will always appear on this page, with its revision date shown at the top.