Privacy Policy

Bramber Bakehouse is committed to respecting your privacy and protecting your personal information.

This Privacy Policy explains what information we collect, why we collect it, how we use and share it, how long we keep it and the rights you have in relation to your personal information.

It applies to people who visit our website, buy from our online shop, make a donation, subscribe to our communications, contact us, make a corporate or bespoke enquiry, volunteer or apply to work with us, use our services or otherwise interact with Bramber Bakehouse.

1. Who We Are

Bramber Bakehouse is a registered charity and company in England and Wales.

Bramber Bakehouse
Registered Charity No. 1172837
Registered Company No. 09437477

Kings Centre
Unit 27
Edison Road
Eastbourne
East Sussex
BN23 6PT

Telephone: 0333 344 7532
Email: hello@bramberbakehouse.co.uk

Bramber Bakehouse is the data controller for the personal information described in this policy.

If you have any questions about this policy or how we use your personal information, please contact us using the details above.

2. How We Collect Personal Information

We may collect information about you in several ways.

When you give information to us directly

This includes when you:

• make a donation;
• complete a Gift Aid declaration;
• buy brownies or another product through our website;
• sign up to receive our news or other communications;
• contact us by email, telephone, post, through our website or in person;
• submit a corporate or bespoke bakery enquiry;
• register for an event or activity;
• volunteer with us;
• apply for a job or other opportunity;
• access or enquire about our support services; or
• otherwise provide information to us.

When someone places an order for you

If somebody sends brownies to you as a gift, we may receive information about you from the person placing the order.

This could include your name, delivery address, telephone number, email address and any relevant delivery instructions.

We use this information to fulfil and manage the delivery.

When you interact with us through another organisation

We may receive personal information through organisations we work with, such as fundraising platforms, referral partners or other organisations providing services on our behalf.

For example, where you donate through a fundraising platform such as Enthuse, information may be passed to us in accordance with the choices you make when donating.

When you use our website

We may automatically collect technical information about how you use our website.

Depending on your cookie choices, this may include information such as:

• your IP address;
• browser and device information;
• pages visited;
• how you arrived at our website;
• actions taken on the website; and
• information collected through cookies and similar technologies.

More information is available in the Cookies section below.

3. What Personal Information We Collect

The information we collect depends on how you interact with us.

It may include:

• your name;
• postal, billing and delivery addresses;
• email address;
• telephone number;
• details of products or services you have ordered;
• your selected brownie delivery date and delivery service;
• delivery instructions;
• correspondence and customer-service history;
• donation details;
• Gift Aid information;
• communication and marketing preferences;
• corporate or organisation details;
• information provided in enquiry forms;
• information relating to volunteering, recruitment or participation in our activities;
• website and technical information;
• transaction and payment information; and
• other information you choose to provide to us.

Payment information

When you pay through our website, payment is processed securely through our payment provider.

We do not normally receive or store your full payment card number. We may receive information such as confirmation that payment has been made, the amount paid, a transaction reference and limited payment-method information.

4. Brownie Shop and Ecommerce Orders

When you place a brownie order through our website, we use the information you provide to:

• process your order and payment;
• record the products and quantities ordered;
• record your selected Thursday delivery date;
• provide the delivery service you selected;
• send order confirmations and service messages;
• arrange packing, dispatch and delivery;
• create shipping labels;
• provide tracking information;
• handle cancellations, refunds or complaints;
• prevent fraud and maintain the security of our website; and
• maintain appropriate financial and transaction records.

Our ecommerce website uses WordPress and WooCommerce.

We also use ShipStation to help manage dispatch and shipping and DPD to deliver brownie orders.

Information necessary to fulfil your order may therefore be passed between our website, our payment provider, ShipStation and DPD.

For example, this may include:

• your name;
• delivery address;
• telephone number;
• email address;
• order reference;
• parcel information;
• selected delivery service; and
• delivery instructions.

We only share the information reasonably necessary to process and deliver your order.

5. Corporate and Bespoke Bakery Enquiries

If you submit a corporate or bespoke bakery enquiry, we may collect information including:

• your name;
• company or organisation;
• email address;
• telephone number;
• type and approximate size of order;
• required date;
• delivery location or postcode;
• whether delivery is to one or multiple addresses; and
• any bespoke requirements or other information you provide.

We use this information to respond to your enquiry, discuss your requirements, prepare a quotation where appropriate and manage any resulting order.

6. Donations and Supporters

If you donate to Bramber Bakehouse, we may use your information to:

• process and acknowledge your donation;
• keep appropriate financial records;
• claim Gift Aid where you have provided a valid declaration;
• manage our relationship with you as a supporter;
• respond to your questions;
• meet our legal and regulatory responsibilities; and
• communicate with you about our charitable work where permitted.

We may also be required to carry out appropriate checks in relation to significant donations in accordance with our legal, regulatory and governance responsibilities.

7. People Who Use or Enquire About Our Services

Our charitable work involves supporting women rebuilding their lives after abuse, exploitation and displacement.

Where you enquire about or use our services, we may need to collect information necessary to understand your circumstances, provide support, manage our services and keep people safe.

This may include more sensitive information about your circumstances.

Access to this information is restricted to people who need it for their role, and we take additional care when handling it.

Where appropriate, more detailed privacy information may also be provided in connection with a particular service or programme.

8. Special Category and Sensitive Personal Information

Some personal information receives additional protection under data protection law.

This may include information about:

• health;
• racial or ethnic origin;
• religion or beliefs;
• sexual orientation; or
• other particularly sensitive aspects of someone’s circumstances.

We may receive this type of information in connection with our charitable services, safeguarding work, an enquiry, a personal story or other interaction with us.

We will only use this information where it is necessary and where an appropriate additional legal condition for processing applies.

We will not publish an identifiable personal story, case study or sensitive experience without appropriate permission.

There may be limited circumstances where we need to share information without consent, for example where this is necessary to comply with a legal or safeguarding obligation or to protect someone from serious harm.

9. Why We Use Your Information and Our Lawful Bases

Data protection law requires us to have a lawful basis for using personal information.

The lawful basis will depend on why we are using the information.

Contract

We may use your information where it is necessary to enter into or fulfil a contract with you.

This includes:

• processing and delivering brownie orders;
• taking payment;
• responding to an enquiry before an order is agreed; and
• dealing with cancellations, refunds and customer-service issues.

Legal obligation

We may process information where we need to comply with the law.

This can include:

• financial and accounting records;
• Gift Aid records;
• tax requirements;
• regulatory responsibilities;
• safeguarding responsibilities; and
• responding to lawful requests from public authorities.

Legitimate interests

We may use your information where this is reasonably necessary for the legitimate interests of Bramber Bakehouse or another person and those interests are not overridden by your rights.

Examples may include:

• managing and improving our services;
• responding to enquiries and complaints;
• maintaining appropriate records of our relationship with supporters and customers;
• protecting our website and systems;
• preventing fraud;
• analysing how our services and website are used;
• planning and evaluating our work; and
• establishing, exercising or defending legal claims.

Consent

We rely on consent where this is required or is the most appropriate basis, including for certain marketing communications, non-essential cookies and some uses of sensitive information.

Where we rely on consent, you can withdraw it at any time.

Vital interests and other lawful conditions

In limited circumstances, we may need to use or share information to protect someone’s life or safety or for another purpose permitted by data protection law.

10. Marketing and Keeping in Touch

If you sign up to receive news from Bramber Bakehouse, we may contact you about our work, fundraising, events and other ways to support us.

We may also contact people about our products or charitable work where data protection and electronic marketing law allows us to do so.

Where the law requires us to obtain your consent, we will do so.

Where the law allows us to contact you without prior consent, we will provide an appropriate opportunity to opt out when your details are collected and in subsequent marketing communications.

You can stop receiving marketing communications at any time by:

• using the unsubscribe option in an email;
• following the opt-out instructions provided in a message; or
• contacting hello@bramberbakehouse.co.uk.

Stopping marketing messages will not stop administrative messages that we need to send in connection with an order, donation, service or other relationship with you.

11. Who We Share Personal Information With

We do not sell your personal information.

We may share information with trusted organisations where this is necessary to run Bramber Bakehouse, provide our services or comply with the law.

These may include:

Ecommerce and delivery providers

For brownie orders this includes providers involved in:

• website hosting and ecommerce;
• payment processing;
• order and shipping management, including ShipStation; and
• courier and delivery services, including DPD.

Professional and operational suppliers

We may also use providers for:

• IT and website support;
• email and communications;
• accounting and financial administration;
• fundraising and donations;
• data storage and backups;
• analytics;
• professional advice; and
• other services necessary to operate the charity.

Partners and public bodies

Where appropriate, we may share information with referral partners, funders, safeguarding organisations, regulators, law-enforcement bodies or other authorities.

We will only do this where there is an appropriate reason and lawful basis.

Where suppliers process personal information on our behalf, we require them to protect it appropriately and use it only in accordance with their role and applicable data protection law.

12. International Transfers

Some of the organisations and technology providers we use may process or store personal information outside the United Kingdom.

Where personal information is transferred internationally, we take steps to ensure that the transfer is permitted by UK data protection law and that appropriate protections are in place.

These may include transfers to countries recognised as providing an adequate level of protection or the use of approved contractual safeguards.

You can contact us if you would like further information about the safeguards relevant to your personal information.

13. How Long We Keep Personal Information

We do not keep personal information for longer than we reasonably need it.

How long we retain information depends on why it was collected, any legal or regulatory requirements and whether it may be needed to establish or defend a legal claim.

As a guide:

• Orders, payments and financial transaction records: normally retained for up to six years after the relevant financial year, or longer where required by law.
• Gift Aid and related tax records: retained for the period required by HM Revenue & Customs.
• Customer complaints and disputes: retained for as long as necessary to resolve the issue and for an appropriate period afterwards.
• Unsuccessful corporate or bakery enquiries: deleted when they are no longer reasonably needed unless you ask us to retain your details or an ongoing relationship develops.
• Marketing information: kept while you remain subscribed or while we have another lawful basis to contact you. We may retain a minimal suppression record after you opt out so that we can respect your preference.
• Website and analytics information: retained in accordance with our cookie settings and the retention periods of the relevant technology.
• Service-user and safeguarding information: retained in accordance with our safeguarding, service and records-retention requirements.

We periodically review the information we hold and securely delete or anonymise information we no longer need.

14. Keeping Your Information Secure

We take the security of personal information seriously.

We use appropriate organisational and technical measures designed to protect personal information from unauthorised access, alteration, disclosure, loss or destruction.

Access to personal information is restricted according to people’s roles and responsibilities.

No method of transmitting or storing information can be guaranteed to be completely secure, but we take reasonable steps to protect the information entrusted to us.

15. Cookies and Similar Technologies

Our website uses cookies and similar technologies.

Some cookies are necessary for the website and online shop to function. For example, they may be required to operate the shopping basket, checkout or cookie preferences.

Other technologies may be used for analytics, functionality or advertising.

Where consent is required for non-essential cookies or similar technologies, they will not be used unless you have made the relevant choice through our cookie controls.

You can review or change your cookie choices through the cookie settings available on our website.

Our use of cookies and analytics should be read alongside any separate Cookie Policy or cookie information displayed through our website.

16. Links to Other Websites

Our website may contain links to websites operated by other organisations.

Those organisations are responsible for their own privacy practices.

We recommend reviewing their privacy information when providing personal information through another website or service.

17. Your Data Protection Rights

Depending on the circumstances, you may have the right to:

• ask us for a copy of the personal information we hold about you;
• ask us to correct inaccurate or incomplete information;
• ask us to delete your information;
• ask us to restrict how we use your information;
• object to certain uses of your information;
• receive certain information in a portable electronic format;
• withdraw consent where we rely on consent; and
• object at any time to the use of your personal information for direct marketing.

Some rights do not apply in every situation, and there may be circumstances where the law permits or requires us to keep or continue using information.

You will not normally have to pay to exercise your rights.

We may ask you for information reasonably necessary to confirm your identity before responding to a request.

To exercise a data protection right, contact:

hello@bramberbakehouse.co.uk

18. Automated Decision-Making

We do not currently use solely automated decision-making that produces legal or similarly significant effects on individuals.

Our website may automatically apply operational rules, such as identifying available delivery dates, delivery areas or whether a weekly brownie drop has reached capacity. These are ecommerce functions rather than decisions based on profiling you as an individual.

19. Complaints

If you have a concern about how Bramber Bakehouse has used your personal information, please contact us first so that we have an opportunity to investigate.

You also have the right to raise a complaint with the Information Commissioner’s Office (ICO), the UK’s data protection regulator.

20. Changes to This Privacy Policy

We may update this policy from time to time to reflect changes to our services, technology, suppliers or legal obligations.

The latest version will always be published on our website and will show the date on which it was last updated.

If we make a significant change to how we use personal information, we will take reasonable steps to bring it to the attention of people affected where appropriate.

21. Contact Us

For questions about this Privacy Policy or how we use personal information, please contact:

Bramber Bakehouse
Kings Centre
Unit 27
Edison Road
Eastbourne
East Sussex
BN23 6PT

Email: hello@bramberbakehouse.co.uk
Telephone: 0333 344 7532