Privacy policy
About this policy
This explains what personal information Bread Shed Walton collects when you use this website, why, who we share it with, and your rights. It is written to follow UK data protection law (the UK GDPR and the Data Protection Act 2018).
Who is responsible for your information
Bread Shed Walton
25 Ambleside Avenue
Walton-on-Thames
Email: stu.trout@gmail.com
Phone: 07796995898
What we collect
When you place an order:
- Your name, email address and, if you give it, your phone number.
- What you ordered, your collection date, any notes you add, and any discount code you used.
- A payment reference from SumUp and whether your payment succeeded. We do not see or store your card number.
- Whether you chose not to receive marketing emails, and when.
We also keep ordinary technical records that our hosting needs to run the site and keep it secure, such as your IP address and the pages requested. If you contact us we keep your message and our reply.
Why we use it, and our legal basis
- To take and fulfil your order, send your confirmation, and contact you about it. (Contract.)
- To keep our accounts and records as the law requires. (Legal obligation.)
- To keep the site secure, prevent fraud and fix problems. (Legitimate interests.)
- To answer your questions. (Legitimate interests.)
- To send you news about our bakes, events and offers unless you opt out at checkout. (Legitimate interests, using the "soft opt-in" for existing customers.)
We do not sell your information.
Marketing emails
When you order, we may use your name and email address to send you news about our bakes, events and offers, similar to what you bought. This is sometimes called a "soft opt-in". You are given the chance to say no at checkout (tick "Don't send me news about new bakes and offers"), it is never a condition of ordering, and every marketing email has an unsubscribe link. You can also opt out at any time by contacting us, and we will stop. We do not send marketing emails to anyone who has opted out, or to customers who ordered before this option was added unless they ticked the box then.
Who we share it with
We share information only with the services we need to run the shop:
- SumUp, who take your payment. They process your card details and are responsible for them. See SumUp's privacy policy.
- The email provider that delivers our order emails.
- Our email marketing service, for people we send marketing emails to.
- Our own bakery management system, run by us, where your order details (your name, phone number and what you ordered) are also kept so we can prepare your order and hand it over, and refund it if needed.
- Our hosting and IT providers, who keep the site running.
- Our accountants and, if the law requires it, authorities such as HMRC.
Some of these providers may handle data outside the UK. Where they do, we expect proper safeguards to be in place.
How long we keep it
- Order records: 6 years, which is how long we need to keep business accounts.
- Messages you send us: up to 12 months after we last dealt with you.
- Technical logs: a short time, normally 30 days or less.
- Marketing preferences: until you opt out or unsubscribe, after which we keep only a note that you opted out.
Your rights
You can ask to see the information we hold about you, have it corrected or deleted, restrict or object to how we use it, or receive a copy you can move elsewhere. Some of these have limits, for example we cannot delete records we must legally keep. To use a right, contact us. We will reply within one month.
If you are unhappy with how we have handled your information, please tell us first. You can also complain to the Information Commissioner's Office at ico.org.uk or on 0303 123 1113.
Cookies
This site only uses the cookies it needs to work. See our Cookie Policy.
Changes
We may update this policy. The date at the bottom shows when it last changed.
Last updated 1 November 2026