Privacy & Cookie Policy

Last updated: 31 July 2026

Who we are

This website is operated by Boujon Bakery, trading as "Boujon Bakery" ("we", "us", "our"). We are the data controller responsible for your personal data.

Trading address: 267 Gloucester Road, Bristol, BS7 8NY
Contact email: info@boujonbakery.co.uk

This policy explains what personal data we collect when you visit our website, place an order, book a decorating class, make a wholesale enquiry, or sign up to our newsletter, and how we use, share, and protect it.

Information we collect

Information you give us directly

Name, delivery and billing address, email address and phone number, when you place an order or make an enquiry
Order details, including products purchased, delivery instructions and any personalisation or message details you provide
Class booking details, including names of attendees, date/time selected, and any allergy or dietary information you choose to share with us
Wholesale and corporate enquiry details, including company name and contact information
Your email address and marketing preferences, if you sign up to our newsletter
Any information you send us directly, for example via email or our contact form

Information collected automatically

Technical information such as IP address, browser type and device information
Usage information such as pages visited, time spent on the site, and how you arrived at our website, collected via cookies and similar technologies (see "Cookies and similar technologies" below)

Payment information

Payments are processed securely by Shopify Payments (or another payment provider shown at checkout). We do not see or store your full card details; these are handled directly by our payment processor in line with PCI-DSS standards.

How we use your information

We only use your personal data where we have a lawful basis to do so:

To fulfil your order or class booking: processing payment, preparing your order, arranging delivery or collection, and sending you order/booking confirmations and updates (necessary to perform our contract with you)
To respond to enquiries: answering wholesale, corporate or general enquiries you send us (necessary to perform a contract, or our legitimate interest in responding to enquiries)
To send marketing emails: only where you have opted in to our newsletter; you can unsubscribe at any time using the link in every email (based on your consent)
To improve our website and service: understanding how visitors use our site so we can improve it (our legitimate interest, balanced against your rights)
To prevent fraud and keep our business secure: our legitimate interest in protecting our business and customers
To meet our legal obligations: for example keeping financial records for tax purposes

Allergy and dietary information

If you share allergy, intolerance or dietary information with us (for example when booking a class or placing a bespoke order), we use this only to prepare your order or class safely and will not use it for any other purpose.

Cookies and similar technologies

Our website uses cookies and similar technologies. Under UK PECR rules, we ask for your consent before setting any cookies that are not strictly necessary, via the cookie banner shown when you first visit the site.

Strictly necessary cookies: required for the website and shopping cart/checkout to function (for example, Shopify session and security cookies). These cannot be switched off and do not require consent
Analytics cookies: Google Analytics, which helps us understand how visitors use our website (for example, which pages are most popular) so we can improve it. Set only with your consent
Marketing cookies: Meta (Facebook/Instagram) Pixel, which helps us understand the effectiveness of our social media advertising and show you relevant ads. Set only with your consent

You can change or withdraw your cookie consent at any time using the cookie settings link on our website, or by adjusting your browser settings to block or delete cookies (note this may affect how the site works).

Who we share your information with

We share personal data with trusted third parties who help us run our business. We do not sell your personal data to anyone.

Shopify: our website, e-commerce and payments platform
Payment providers: to process payments securely (for example Shopify Payments/Stripe)
Delivery couriers: to deliver your order, we share the name, address and contact details needed for delivery
Email marketing provider: if you opt in to our newsletter (for example, Mailchimp)
Google and Meta: for website analytics and advertising, where you have consented to analytics/marketing cookies
Professional advisers and authorities: such as our accountant, or law enforcement/regulators, where we are legally required to

International data transfers

Some of the third parties we use (such as Shopify, Google and Meta) may store or process data outside the UK. Where this happens, we rely on safeguards recognised under UK data protection law, such as the UK's International Data Transfer Addendum or the provider's own approved data transfer mechanisms.

How long we keep your information

Order and transaction records: kept for 6 years to meet our legal and tax obligations
Class booking records: kept for as long as needed to deliver the class and handle any follow-up, then securely deleted
Marketing data: kept until you unsubscribe or ask us to delete it
Enquiry details: kept only as long as needed to respond, unless you become a customer

Your rights

Under UK GDPR, you have the right to:

Access: request a copy of the personal data we hold about you
Rectification: ask us to correct inaccurate or incomplete data
Erasure: ask us to delete your data, where there is no legal reason for us to keep it
Restriction: ask us to limit how we use your data
Objection: object to us using your data for direct marketing or legitimate interests
Portability: ask for your data in a portable format, where technically feasible
Withdraw consent: where we rely on consent (for example marketing emails or non-essential cookies), you can withdraw this at any time

To exercise any of these rights, contact us at info@boujonbakery.co.uk. If you are unhappy with how we have handled your data, you also have the right to complain to the Information Commissioner's Office (ICO) at ico.org.uk.

Children

Our website and decorating classes are not directed at children, and our online shop is intended for use by adults. Where children attend a class, this is arranged and consented to by a parent or guardian, who provides any necessary information on the child's behalf.

Keeping your data secure

We use appropriate technical and organisational measures to protect your personal data, including secure hosting via Shopify and encrypted payment processing. No method of transmission over the internet is completely secure, but we work to protect your information to industry standards.

Changes to this policy

We may update this policy from time to time, for example if we change how we use data or add new tools to our website. The "last updated" date at the top of this page will reflect the most recent version.