privacy policy

This website (the "Site") is operated by Maai Bakehouse Ltd ("we", "us", "our"), a company registered in England and Wales under company number 17142761, with its registered office at 15 Rigby Avenue, Blackburn, BB2 7GX. We are a bakery based in the North West of England, delivering by post to addresses within the United Kingdom only.

For the purposes of the UK General Data Protection Regulation and the Data Protection Act 2018, we are the data controller of the personal data described in this policy.

This policy covers personal data collected through the Site: newsletter sign ups, orders, gift messages, corporate enquiries and analytics data collected while browsing. Payment is taken on Shopify's checkout, and customer accounts are provided by Shopify. Shopify handles that data under its own privacy policy, available at shopify.com/legal/privacy. We never see or store your card details.

Newsletter. When you subscribe to our newsletter, we collect the email address you submit and when you signed up. It is kept in our own database and passed to Klaviyo, the service that sends our newsletter (see section 7). You can also sign up by ticking the email box at checkout, which is never ticked for you.

Orders. When you place an order we receive from Shopify your name, email address, phone number if you give one, delivery address, the items ordered, the dispatch date you chose and any gift message. If you take the monthly box, we also receive the status of your plan. If you create an account, Shopify holds your sign in details and order history.

Postcode check. The delivery postcode you type in the bag is sent to postcodes.io, a public postcode look up service, to confirm it is a valid UK postcode. Nothing else is sent with it.

Corporate enquiries. When you send the corporate order form, we collect the name, company, email address, phone number and order details you enter.

Information collected automatically. When you visit the Site, and only where you have consented via the cookie banner, we collect usage data through Google Analytics, including pages viewed, approximate location, device and browser type, and referral source.

Visit counts. We also count visits with Cloudflare Web Analytics, which uses no cookies and does not identify you: it records the page, the site you came from, your country, and your device and browser type.

Necessary cookies. Used to operate the Site, including remembering that you have responded to the cookie banner. These are set regardless of consent, as the Site cannot function correctly without them.

Analytics cookies. Set by Google Analytics to measure Site traffic and usage. These are not set until you actively accept them through the cookie banner, and remain off if you decline or take no action. Declining does not affect your ability to use the Site.

You can withdraw consent at any time by clearing cookies and site data for maaibakehouse.co.uk in your browser, which will cause the cookie banner to be shown again on your next visit.

We use order information to bake, pack and post your order, to write out your gift message, to send order and delivery updates, to run your monthly plan if you have one, and to deal with any problem with an order. We use enquiry details to reply to you. We use your email address to send newsletters about products and offers only where you have opted in. We use analytics data, in aggregate, to understand how the Site is used and to improve it.

We process order information because it is necessary for the performance of our contract with you, and we keep order records to meet our legal obligations for tax and accounting. We reply to enquiries on the basis of our legitimate interests in responding to people who contact us. We send newsletters and collect analytics data on the basis of your consent, given through the sign up form and the cookie banner. You may withdraw consent at any time (see section 9).

We use the following providers to operate the Site and fulfil orders. Each receives only the personal data it needs:

• Shopify: checkout, payment, customer accounts, monthly plans and order emails. Shopify also uses customer data from our checkout, together with other Shopify data, to improve its products and for ad targeting and personalisation for our shop (Shopify Network Intelligence). Other shops cannot see it.
• Our delivery courier: the recipient's name, address and contact details, to deliver your order and send tracking updates.
• Supabase: database hosting for newsletter sign ups and the order details our kitchen works from (EU region).
• Klaviyo: our email provider for the newsletter. When you sign up it receives your email address and the details of your sign up (when you signed up and that it was through our website), and uses them to send you the newsletter. Klaviyo is also connected to our Shopify shop, so it receives details of orders, including checkouts that were started but not finished and orders that were cancelled or refunded. We use these to send emails about your order and, if you have agreed to them, marketing emails. Data may be processed outside the UK, including in the United States, under standard contractual clauses.
• postcodes.io: postcode validation, as described in section 3.
• Cloudflare: delivers the Site securely and counts visits without cookies (Cloudflare Web Analytics).
• Google Analytics: site usage analytics, where consent has been given. Data may be processed outside the UK, including in the United States, under Google's standard contractual clauses.
• Cloudflare and Netlify: infrastructure, content delivery, hosting and the corporate enquiry form.

We do not sell personal data, and do not share it with third parties for their own marketing purposes.

We keep order records for six years after the order, as tax law requires, and then delete them. Gift messages are kept with the order. We keep corporate enquiries for up to two years. We retain your email address for as long as you remain subscribed to our newsletter, and delete it once you unsubscribe or ask us to remove it, apart from a record that you unsubscribed, which our email provider keeps so that you are not emailed again. Analytics data is retained according to Google Analytics' standard retention period.

Under UK data protection law, you have the right to request access to, correction of, or deletion of your personal data, and to object to or restrict our processing of it. Where processing is based on consent, you may withdraw that consent at any time, including by unsubscribing using the link in any newsletter email. To exercise any of these rights, contact us at [email protected].

You also have the right to lodge a complaint with the Information Commissioner's Office (ICO) at ico.org.uk.

The Site is not directed at children, and we do not knowingly collect personal data from anyone under 13.

We may update this policy as the Site develops. Any changes will be posted on this page with an updated effective date.

Questions about this policy or how we handle your data can be sent to [email protected].