Privacy Notice

1. Who We Are

This Privacy Notice explains how personal data is collected and used by Pastry Masters Co. (“we”, “us”, “our”). The website is owned and operated by Confectionery Enterprises, confectionery artisans registered in Shrewsbury, Shropshire, United Kingdom. The name Pastry Masters Co. is used as a trading brand. We are the data controller for the purposes of UK data protection law.

2. Introduction

We are committed to protecting your privacy and handling your personal data responsibly. This Privacy Notice explains:

What personal data we collect
How and why we use it
How we store and protect it
Your legal rights

“Personal data” means any information that can identify you directly or indirectly. “Processing” means collecting, using, storing, sharing, or deleting personal data.

This notice applies to data collected through:

Our website
Enquiry and trade contact forms
Business communications
Social media and third-party platforms where applicable

We do not sell personal data.

3. Personal Data We Collect

a) Data You Provide to Us

When you contact us, place a trade enquiry, or place a direct order allocation, we may collect:

Name and job title
Business name, billing address, and delivery address
Email address and telephone number
Order, transaction reference, enquiry, or correspondence details
Marketing preferences

b) Data Collected Automatically

When you use our website, we may collect:

IP address
Browser type and device information
Pages visited and time spent on the site

This information is used for security, analytics, and website improvement.

c) Data from Third Parties

We receive limited transaction-related data from our payment gateway providers (PayPal), logistics partners, fraud prevention services, and publicly available business registers.

4. If You Do Not Provide Required Data

Where personal data is required to respond to an enquiry, fulfil a contract, or comply with legal obligations, and you do not provide it, we may be unable to proceed with the relevant service or transaction.

5. Legal Bases for Processing

We process personal data under the following lawful bases:

Contractual necessity – to fulfil orders, direct allocations, or trade agreements
Legitimate interests – to operate, improve, and protect our business
Legal obligation – to comply with UK tax, accounting, or regulatory requirements
Consent – where you have actively opted in (e.g. non-essential cookies)

Where consent is used, it may be withdrawn at any time via our contact page.

6. How We Use Your Data

We use personal data to:

Respond to trade enquiries and process order allocations
Process transactions and manage customer accounts
Communicate with customers, stockists, and partners
Improve our products, services, and website
Prevent fraud and protect our legal rights

7. Sharing of Personal Data

We only share personal data where strictly necessary, including with:

Secure payment processors (PayPal)
Delivery and logistics providers
Professional advisers (legal, accounting)
Fraud prevention and security services

All third parties are required to process data securely and lawfully.

8. Payment Information

Payments are processed securely by third-party payment providers (PayPal). We do not collect or store credit card numbers. We receive only transaction-related data from our payment processor, such as payment status, transaction identifiers, and associated billing details required to fulfil your order allocation.

9. Cookies

Our website uses cookies to ensure core functionality, analyse site performance, and remember user preferences. Non-essential cookies are only used with your consent. You may control or disable cookies through your browser settings.

10. Data Security

We use appropriate technical and organisational measures to protect personal data, including SSL encryption, secure hosting and access controls.

11. Data Retention

We retain personal data only for as long as necessary to fulfil business purposes, meet UK statutory financial reporting obligations, or resolve disputes.

12. Your Rights

Under UK data protection law, you have the right to access your personal data, request correction or deletion, object to or restrict processing, and withdraw consent where applicable. Requests can be made via our Contact page. Identity verification may be required.

13. Complaints

If you have concerns about how we handle your personal data, please contact us via our Contact page. We will acknowledge any data privacy complaints within 30 days. You also maintain the statutory right to raise a complaint with the Information Commissioner’s Office (ICO).

14. International Transfers

Our website is hosted in the UK. Where data is processed outside the UK by essential sub-processors (such as international payment routing networks), appropriate standard contractual safeguards are used to ensure lawful protection.

15. Updates to This Privacy Notice

We may update this Privacy Notice from time to time to reflect regulatory alignment. The current version will always be published on this website.

Learn more about Pastry Masters Co., our heritage and craft, on our brand site.