Privacy policy
About this policy
This explains what personal information Bread Shed Walton collects when you use this website, why, who we share it with, and your rights. It is written to follow UK data protection law (the UK GDPR and the Data Protection Act 2018).
Who is responsible for your information
Bread Shed Walton
25 Ambleside Avenue
Walton-on-Thames
Email: stu.trout@gmail.com
Phone: 07796995898
What we collect
When you place an order:
- Your name, email address and, if you give it, your phone number.
- What you ordered, your collection date, any notes you add, and any discount code you used.
- A payment reference from SumUp and whether your payment succeeded. We do not see or store your card number.
- Whether you ticked the box to receive marketing emails, and when.
We also keep ordinary technical records that our hosting needs to run the site and keep it secure, such as your IP address and the pages requested. If you contact us we keep your message and our reply.
Why we use it, and our legal basis
- To take and fulfil your order, send your confirmation, and contact you about it. (Contract.)
- To keep our accounts and records as the law requires. (Legal obligation.)
- To keep the site secure, prevent fraud and fix problems. (Legitimate interests.)
- To answer your questions. (Legitimate interests.)
We do not sell your information.
Marketing emails
If you tick the box at checkout, we will use your name and email address to send you news about new bakes, events and offers. This is optional and is never a condition of ordering, and your consent is our legal basis. You can unsubscribe at any time using the link in every email, or by contacting us, and we will stop. We never send marketing emails to anyone who has not asked for them.
Who we share it with
We share information only with the services we need to run the shop:
- SumUp, who take your payment. They process your card details and are responsible for them. See SumUp's privacy policy.
- The email provider that delivers our order emails.
- Our email marketing service, for people who have opted in to marketing emails.
- Our own bakery management system, run by us, where your order details (your name, phone number and what you ordered) are also kept so we can prepare your order and hand it over, and refund it if needed.
- Our hosting and IT providers, who keep the site running.
- Our accountants and, if the law requires it, authorities such as HMRC.
Some of these providers may handle data outside the UK. Where they do, we expect proper safeguards to be in place.
How long we keep it
- Order records: 6 years, which is how long we need to keep business accounts.
- Messages you send us: up to 12 months after we last dealt with you.
- Technical logs: a short time, normally 30 days or less.
- Marketing sign-ups: until you unsubscribe or withdraw your consent, after which we keep only a note that you opted out.
Your rights
You can ask to see the information we hold about you, have it corrected or deleted, restrict or object to how we use it, or receive a copy you can move elsewhere. Some of these have limits, for example we cannot delete records we must legally keep. To use a right, contact us. We will reply within one month.
If you are unhappy with how we have handled your information, please tell us first. You can also complain to the Information Commissioner's Office at ico.org.uk or on 0303 123 1113.
Cookies
This site only uses the cookies it needs to work. See our Cookie Policy.
Changes
We may update this policy. The date at the bottom shows when it last changed.
Last updated 1 November 2026