Privacy notice
Last updated
When you order a cake we collect your name, email address, phone number, the date you need it, and your delivery address. For bespoke orders we also keep the design notes and any reference photographs you upload. We use this only to make and deliver your cake, and to keep the accounting records the law requires. We do not sell it, and we do not use it for advertising.
Who is responsible for your data
The data controller is Tinu Shibin trading as Vivi's Cakery.
Business structure: Sole trader.
Companies House number: Not applicable — Vivi's Cakery is a sole trader, not a registered company.
Registered trading address: 25E Oak Hill Park, Liverpool, L13 4BL.
You can contact us about anything on this page at natandrosh@gmail.com.
What we collect, and why
These are the only categories of personal data this website stores.
When you place an order
- Your name, email address and phone number
- The date and time you need the cake
- Your delivery address
- Any inscription you want piped onto the cake
- Any allergy information you tell us about
- Any other notes you add to the order
- A payment reference from Stripe. We never see or store your card details — those go directly to Stripe.
When you request a bespoke quote
- Your name, email address and phone number
- The occasion, the date, how many people it needs to serve, and your budget
- Flavour preferences and design notes
- Any reference photographs you upload
Allergy information
If you tell us about an allergy or intolerance, that is information about your health. Under UK GDPR it is a “special category” of data and gets extra protection. We collect it only because you have chosen to give it to us so that we can make your cake safely, we use it for nothing else, and we do not share it beyond the kitchen.
What we do not do
There are no advertising trackers, no analytics profiling and no third-party cookies on this website. We do not build a marketing profile of you and we do not sell or rent your details to anyone.
Our lawful basis
- Performance of a contract (UK GDPR Art. 6(1)(b)) — for the details we need to actually make and hand over the cake you ordered.
- Legal obligation (Art. 6(1)(c)) — for keeping sales records for tax purposes.
- Explicit consent (Art. 6(1)(a), and Art. 9(2)(a) for health data) — for allergy information, which you choose to give us. You can withdraw that consent, though we may then be unable to make your cake safely.
- Legitimate interests (Art. 6(1)(f)) — for keeping the site secure and preventing fraudulent orders.
Who else sees it
Your data is shared only with the suppliers needed to run the business:
- Our hosting provider. The website and its database run on a private server: Hostinger International Limited, on a server located in Manchester, England, United Kingdom. Your data is therefore stored in the United Kingdom, so hosting it does not in itself involve a transfer overseas. Our hosting provider is an international company, and we cannot rule out that its support staff access the server from outside the UK.
- Stripe Payments UK, Ltd.— processes card payments. Stripe is a controller in its own right for payment data; see Stripe’s own privacy policy.
- Resend (Plus Five Five, Inc.).— sends your order confirmation and quote emails. Our sending domain is configured in Resend’s EU region, so the messages themselves are handled there. Resend is nevertheless a United States company and its data processing agreement states that its primary processing takes place in the United States, so we treat this as a transfer to the United States, made under the UK extension to the EU–US Data Privacy Framework and the International Data Transfer Addendum.
- Delivery. Whoever brings the cake is given your name, address and phone number so they can find you.
We do not give your data to anyone else unless we are legally required to.
How long we keep it
Order and invoice records: kept for 6 years after the order is fulfilled, in line with HMRC's requirement to retain tax records.
Bespoke quote requests that do not become orders, including any reference photographs you uploaded, are deleted within 12 months.
Allergy notes are kept with the order record for as long as that order record is kept, because they form part of the food-safety history of what we made.
Your rights
Under UK GDPR you can ask us to:
- give you a copy of the personal data we hold about you (right of access)
- correct anything that is wrong (rectification)
- delete it (erasure), where we are not legally required to keep it
- restrict or object to how we use it
- send it to you or another provider in a portable format
- withdraw consent you have given, at any time
Email natandrosh@gmail.com and we will respond within one month. There is no charge.
If you are unhappy with how we have handled your data you can complain to the Information Commissioner’s Office at ico.org.uk, or by calling 0303 123 1113. We would rather you told us first so we can put it right.