Privacy policy

About this policy

This explains what personal information Bread Shed Walton collects when you use this website, why, who we share it with, and your rights. It is written to follow UK data protection law (the UK GDPR and the Data Protection Act 2018).

Who is responsible for your information

Bread Shed Walton
25 Ambleside Avenue
Walton-on-Thames
Email: shop@breadshedwalton.co.uk
Phone: 07796995898

What we collect

When you place an order:

• Your name, email address and, if you give it, your phone number.
• What you ordered, your collection date, any notes you add, and any discount code you used.
• A payment reference from SumUp and whether your payment succeeded. We do not see or store your card number.
• Whether you chose not to receive marketing emails, and when.

If you join the Sourdough Club:

• Your name, email address and, if you give it, your phone number.
• Your weekly order (what, how many and which days), and any weeks you skip or pause.
• A customer reference and a token for your saved card, held with SumUp so that we can take your weekly payment. We do not see or store your card number.
• The orders and payments made for you, including any that failed, and the reminder emails and notices we send you.
• Whether you asked for news about our bakes, and when.

If you leave your email on the Sourdough Club page without joining:

• Your email address and why you left it (before the club opened, the club was full, or you want delivery).
• Your postcode, only if you want delivery, so we can see whether we can deliver to you.

We also keep ordinary technical records that our hosting needs to run the site and keep it secure, such as your IP address and the pages requested. If you contact us we keep your message and our reply.

Why we use it, and our legal basis

• To take and fulfil your order, send your confirmation, and contact you about it. (Contract.)
• To keep our accounts and records as the law requires. (Legal obligation.)
• To keep the site secure, prevent fraud and fix problems. (Legitimate interests.)
• To answer your questions. (Legitimate interests.)
• To run your Sourdough Club membership: take your weekly order, send your reminders, take payment and tell you about weeks the club is not running. (Contract.)
• To keep a Sourdough Club waiting list, tell you when the club opens or a space becomes free, and see whether we can deliver to you. (Consent: you ask us to when you leave your email.)
• To understand how the site is used, only if you accept analytics cookies. (Consent.)
• To send you news about our bakes, events and offers unless you opt out at checkout. (Legitimate interests, using the "soft opt-in" for existing customers.)

We do not sell your information.

Marketing emails

When you order, we may use your name and email address to send you news about our bakes, events and offers, similar to what you bought. This is sometimes called a "soft opt-in". You are given the chance to say no at checkout (tick "Don't send me news about new bakes and offers"), it is never a condition of ordering, and every marketing email has an unsubscribe link. You can also opt out at any time by contacting us, and we will stop. We do not send marketing emails to anyone who has opted out, or to customers who ordered before this option was added unless they ticked the box then. Sourdough Club members only get marketing emails if they ticked the box to ask for them when joining. The reminders and notices about a weekly order are not marketing, and we send them to every member.

Who we share it with

We share information only with the services we need to run the shop:

• SumUp, who take your payment. They process your card details and are responsible for them. See SumUp's privacy policy. If you join the Sourdough Club, SumUp also keeps your saved card so that we can take your weekly payment.
• The email provider that delivers our order emails.
• Our email marketing service, for people we send marketing emails to.
• Our own bakery management system, run by us, where your order details (your name, phone number and what you ordered) are also kept so we can prepare your order and hand it over, and refund it if needed.
• Our hosting and IT providers, who keep the site running.
• PostHog, who help us understand how the site is used. We send them anonymous counts of what happens on the site (for example that an order was placed, and how many items it had), never your name, email address, phone number or payment details. If you accept analytics cookies, PostHog also records which pages you view and roughly where you are, using a cookie. You can say no, or change your mind, with Cookie settings at the bottom of any page.
• Our accountants and, if the law requires it, authorities such as HMRC.

Some of these providers may handle data outside the UK. Where they do, we expect proper safeguards to be in place.

How long we keep it

• Order records: 6 years, which is how long we need to keep business accounts.
• Messages you send us: up to 12 months after we last dealt with you.
• Technical logs: a short time, normally 30 days or less.
• Marketing preferences: until you opt out or unsubscribe, after which we keep only a note that you opted out.
• Sourdough Club membership details: while you are a member and for up to 12 months after you leave. When you leave we stop using your saved card. The orders and payments we made for you are kept for 6 years, like any other order.
• Sourdough Club waiting list (email and any postcode): until the club opens or a space is free and we have told you, or you ask us to remove you, and no longer than 12 months.

Your rights

You can ask to see the information we hold about you, have it corrected or deleted, restrict or object to how we use it, or receive a copy you can move elsewhere. Some of these have limits, for example we cannot delete records we must legally keep. To use a right, contact us. We will reply within one month.
If you are unhappy with how we have handled your information, please tell us first. You can also complain to the Information Commissioner's Office at ico.org.uk or on 0303 123 1113.

Cookies

This site only uses the cookies it needs to work. See our Cookie Policy.

Changes

We may update this policy. The date at the bottom shows when it last changed.

Last updated 4 November 2026