Privacy Policy

Last updated: 5/13/2026

1. Introduction & Data Controller

Welcome to May's Bakery. We respect your privacy and are committed to protecting your personal data. This privacy policy will inform you as to how we look after your personal data when you visit our website and tell you about your privacy rights and how the law protects you.

The Data Controller responsible for your personal data is Elliot trading as May's Bakery.

2. The Data We Collect About You

We may collect, use, store and transfer different kinds of personal data about you which we have grouped together as follows:

  • Identity Data includes first name, last name, or similar identifier.
  • Contact Data includes billing address, delivery address, email address, and telephone numbers.
  • Financial Data is collected securely and directly by our payment processor, Stripe. We do not store your credit card details on our servers.
  • Transaction Data includes details about payments to and from you and other details of products you have purchased from us.

3. Legal Basis for Processing Your Data

Under UK data protection law, we must have a "Legal Basis" to process your data. We rely on the following bases:

  • Performance of Contract: We use your Identity, Contact, and Transaction data to process your order, bake your goods, and deliver them to your specified address.
  • Legal Obligation: We are required by HMRC and UK tax laws to retain basic transaction and billing information for accounting and tax purposes.

Note: We do not use your data for marketing or send promotional emails unless you explicitly provide consent to receive them.

4. Third-Party Data Processors

To operate our business and fulfill your orders, we share your data with trusted third-party "Data Processors." We only share the minimum data necessary for them to perform their functions:

  • Stripe: All payment transactions are processed through Stripe. Stripe uses TLS encryption to protect your data during transfer and AES-256 encryption for data at rest. You can view their Privacy Policy at stripe.com/gb/privacy.
  • Netlify: Our website is hosted securely on Netlify infrastructure.
  • Microsoft / Hotmail: We use this service to manage our direct email communications with customers.

5. Data Retention (How long we keep it)

We will only retain your personal data for as long as necessary to fulfill the purposes we collected it for, including for the purposes of satisfying any legal, accounting, or reporting requirements.

By law, we have to keep basic information about our customers (including Contact, Identity, Financial, and Transaction Data) for 6 years after they stop being customers for UK tax and HMRC purposes.

6. Cookies

Our website uses "Essential Cookies" only. We do not use invasive marketing or tracking cookies.

The cookies present on this site are strictly necessary for the website to function properly, including secure checkout cookies provided by Stripe (for fraud prevention) and session cookies required by our hosting provider, Netlify. You can set your browser to refuse all or some browser cookies, but please note that if you do, the checkout functionality may become inaccessible or not function properly.

7. Your Legal Rights

Under certain circumstances, you have rights under data protection laws in relation to your personal data, including the right to request access, correction, erasure, restriction, transfer, to object to processing, to portability of data and to withdraw consent.

If you wish to exercise any of the rights set out above, or if you have any questions about this privacy policy, please contact us at: maysbakery@hotmail.com.