Privacy Policy for Permafrost Patisserie

At Permafrost Patisserie, we are committed to protecting your privacy. This Privacy Policy explains how we collect, use, disclose, and safeguard your information when you visit our patisserie, use our online platform, or engage with our services.

1. Information We Collect

We may collect personal information that you voluntarily provide to us when you:

• Place an order for our speciality cakes, bespoke celebration cakes, or other products.
• Make a reservation for an event or catering service.
• Sign up for our newsletter or promotional offers.
• Communicate with us through our online platform, phone, or in person.
• Participate in surveys, competitions, or promotions.

The types of personal information we may collect include:

• Contact details (such as your name, email address, postal address, and telephone number).
• Payment information (processed securely by third-party payment processors, we do not store sensitive payment details).
• Order details and preferences (e.g., cake customisation requests, dietary requirements).
• Any other information you choose to provide to us.

We may also collect non-personal information automatically when you access our online platform, such as your IP address, browser type, operating system, and browsing behaviour. This data helps us improve our online experience but does not identify you personally.

2. How We Use Your Information

We use the information we collect for various purposes, including:

• To process and fulfil your orders for our products and services.
• To provide catering services and manage event bookings.
• To communicate with you about your orders, bookings, and inquiries.
• To send you promotional materials, newsletters, and updates about our new products or seasonal desserts, where you have consented to receive them.
• To improve our products, services, and your overall experience with Permafrost Patisserie.
• To comply with legal obligations and protect our legitimate business interests.
• To personalize your experience and provide tailored recommendations.

3. Legal Basis for Processing (GDPR)

Our legal basis for collecting and using your personal information depends on the specific context in which we collect it. We will generally collect personal information from you where:

• We need the personal information to perform a contract with you (e.g., to process your order).
• The processing is in our legitimate interests and not overridden by your rights (e.g., for direct marketing with your consent, or for improving services).
• We have your explicit consent to do so.

4. Disclosure of Your Information

We do not sell, trade, or otherwise transfer your personal information to outside parties without your explicit consent, except in the following circumstances:

• Service Providers: We may share your information with trusted third-party service providers who assist us in operating our business (e.g., payment processors, delivery services, IT support). These third parties are obligated to maintain the confidentiality of your information and are prohibited from using it for any other purpose.
• Legal Requirements: We may disclose your information if required to do so by law or in response to valid requests by public authorities (e.g., a court order or government agency).
• Business Transfers: In the event of a merger, acquisition, or sale of all or a portion of our assets, your personal information may be transferred as part of the transaction.

5. Data Security

We implement appropriate technical and organisational measures to protect your personal information from unauthorised access, disclosure, alteration, or destruction. While we strive to protect your personal data, no method of transmission over the internet or electronic storage is 100% secure.

6. Your Data Protection Rights (GDPR)

Under data protection laws, you have specific rights concerning your personal data. These rights include:

• The right to access: You have the right to request copies of your personal data.
• The right to rectification: You have the right to request that we correct any information you believe is inaccurate or complete information you believe is incomplete.
• The right to erasure: You have the right to request that we erase your personal data, under certain conditions.
• The right to restrict processing: You have the right to request that we restrict the processing of your personal data, under certain conditions.
• The right to object to processing: You have the right to object to our processing of your personal data, under certain conditions.
• The right to data portability: You have the right to request that we transfer the data that we have collected to another organization, or directly to you, under certain conditions.
• The right to withdraw consent: Where we rely on your consent to process your personal information, you have the right to withdraw that consent at any time.

If you make a request, we have one month to respond to you. If you would like to exercise any of these rights, please contact us using the details provided below.

7. Data Retention

We will retain your personal information only for as long as is necessary for the purposes set out in this Privacy Policy, unless a longer retention period is required or permitted by law (such as tax, accounting, or other legal requirements). When we no longer have a legitimate business need to process your personal information, we will either delete or anonymise it.

8. Cookies

Our online platform may use "cookies" to enhance your experience. Cookies are small data files placed on your device. You can set your browser to refuse all or some browser cookies, or to alert you when cookies are being sent. If you disable or refuse cookies, please note that some parts of our online platform may become inaccessible or not function properly.

9. Changes to This Privacy Policy

We may update our Privacy Policy from time to time. We will notify you of any changes by posting the new Privacy Policy on this page. You are advised to review this Privacy Policy periodically for any changes. Changes to this Privacy Policy are effective when they are posted on this page.

10. Contact Us

If you have any questions about this Privacy Policy or our data practices, please contact us at:

Permafrost Patisserie

79 Braehead Lane, Unit 3A

Glasgow, Scotland, G44 5BX

UK

11. Complaints

If you are not satisfied with our response or believe we are processing your personal data unfairly or unlawfully, you have the right to complain to the Information Commissioner's Office (ICO). You can find their contact details on the ICO website.