Privacy policy

The Big Boy Bakery Ltd Privacy Notice

Last updated: October 2026

The Big Boy Bakery Ltd ("The Big Boy Bakery", "BBB", "we", "us" or "our") is the controller of your personal information.

This privacy notice explains how we collect, use, store and share your personal information when you visit our website, place an order, join our mailing list or contact us.

Contact details

If you have any questions about this privacy notice or how we use your personal information, you can contact us at:

Email: thebigboybakeryy@gmail.com

What information we collect, use and why

The personal information we collect depends on how you interact with The Big Boy Bakery.

When you place an order

When you place an order with us, we may collect:

• Your name and contact details
• Your billing and delivery address
• Your order and purchase history
• Payment and transaction information
• Information you provide in connection with your order

Payments are processed securely through the payment methods available through our Shopify store. We do not directly store your full credit or debit card details.

We use this information to process your order, take payment, communicate with you about your order and arrange delivery.

Our lawful basis for this processing is contract, as this information is necessary for us to enter into and fulfil our contract with you.

Fraud prevention and security

We may use your contact details, customer or order records and transaction information where necessary to prevent and detect fraudulent transactions, misuse of our website or other unlawful activity.

Our lawful basis for this processing is legitimate interests.

We have a legitimate interest in preventing and detecting fraudulent transactions and misuse of our website and services. This helps protect our business and our customers from fraud and financial loss.

We only use personal information where reasonably necessary for this purpose and consider this use proportionate to the potential impact on the individuals involved.

Marketing and our mailing list

If you sign up to our mailing list or otherwise choose to receive marketing from us, we may collect:

• Your name and email address
• Your marketing preferences
• Records of your consent

We use this information to send you news about The Big Boy Bakery, including upcoming cookie drops, launches, products and other marketing communications.

Our lawful basis for sending you marketing communications is consent.

Our mailing list and marketing emails are managed through Shopify.

You can withdraw your consent at any time by using the unsubscribe link in our marketing emails or by contacting us at thebigboybakeryy@gmail.com.

Withdrawing your consent will not affect the lawfulness of any processing carried out before you withdrew it.

Legal requirements

We may collect, use and retain information including your name, contact details, order information and financial transaction information where necessary to meet our legal, accounting, tax or regulatory obligations.

Our lawful basis for this processing is legal obligation.

Queries, complaints and claims

If you contact us with a question, complaint or claim, we may collect and use:

• Your name and contact details
• Your address, where relevant
• Your order or purchase history
• Customer and order records
• Relevant financial transaction information
• Correspondence between you and us
• Photographs or other information you choose to provide where relevant to resolving your issue

We use this information where necessary to respond to you, investigate what happened, resolve your query, complaint or claim and keep appropriate records of how the matter was handled.

Depending on the circumstances, our lawful basis is contract, where the processing relates to fulfilling our contract with you, or legitimate interests, where necessary to respond to enquiries, resolve disputes and protect both our customers and our business.

We have a legitimate interest in providing effective customer service, resolving issues fairly and maintaining appropriate records where a dispute or claim arises.

We only use information that is relevant and reasonably necessary for these purposes.

Where we get your personal information

We primarily receive personal information:

• Directly from you, for example when you place an order, join our mailing list, contact us or communicate with us about an order.
• From suppliers and service providers involved in operating our website, processing transactions, preventing fraud or fulfilling your order.

How long we keep your information

We only keep personal information for as long as reasonably necessary for the purpose for which it was collected, including satisfying any applicable legal, accounting, tax, reporting or dispute-resolution requirements.

When deciding how long to retain personal information, we consider the type and sensitivity of the information, why we collected it, whether we still need it for that purpose and any applicable legal requirements.

In particular:

• Order and transaction records are retained for as long as necessary to meet our accounting, tax and other legal obligations.
• Customer enquiries and correspondence are retained for as long as reasonably necessary to deal with the enquiry and any related issues.
• Complaints and claims information is retained for as long as reasonably necessary to resolve the matter and deal with any potential legal or regulatory requirements.
• Marketing information and preferences are retained while you remain subscribed to our marketing communications. If you unsubscribe, we may retain limited information where necessary to record and respect your preference not to receive further marketing.
• Cookie information is retained according to the applicable cookie retention period. Further information about the cookies used on our website is provided in our Cookie Policy.

We periodically review the information we hold and delete or anonymise personal information when we no longer have a reason to retain it.

Who we share personal information with

We only share personal information where necessary for the purposes described in this privacy notice.

We may share relevant personal information with:

• Shopify, which provides and hosts our ecommerce platform and processes information required to operate our online store, manage checkout and orders and provide our mailing list and email marketing functionality.
• Payment and accelerated checkout providers available through our Shopify store, where necessary to process transactions and provide the payment method you choose.
• Delivery providers, where necessary to deliver your order.
• Professional advisers, such as accountants or legal advisers, where necessary.
• Fraud prevention or financial investigation organisations, where necessary to prevent, detect or investigate fraudulent activity.
• Regulators, government authorities and other organisations, where we are legally required to disclose information.
• Other suppliers and service providers, where necessary to operate our business and provide our services.

Where another organisation processes personal information on our behalf, we require it to handle that information appropriately and in accordance with applicable data protection requirements.

Shopify

Our online store is powered by Shopify.

Shopify provides the ecommerce technology we use to operate our website, process and manage orders, provide checkout functionality and manage our mailing list and marketing emails.

When Shopify processes customer personal information on our behalf as part of its core merchant services, The Big Boy Bakery Ltd remains responsible for determining why and how that information is used.

Information processed through Shopify may include information such as your name, contact details, billing and delivery information, order and transaction information and information necessary to operate our online store.

You can find more information about how Shopify handles personal information in Shopify's Privacy Policy:
https://www.shopify.com/legal/privacy

International transfers

Some of the service providers we use may process personal information outside the UK.

Our ecommerce platform is provided by Shopify. For UK and other EMEA merchants, Shopify's primary contracting entity is Shopify International Limited, based in Ireland. Shopify may also process personal information through affiliated companies and third-party service providers located in other countries.

Where personal information is transferred outside the UK, appropriate safeguards are used as required by UK data protection law.

Depending on the destination and circumstances, these safeguards may include applicable UK adequacy regulations or approved contractual safeguards, such as the UK International Data Transfer Addendum to the European Commission's Standard Contractual Clauses.

Further information about Shopify's international data-transfer arrangements is available through Shopify's international data transfer information:
https://help.shopify.com/en/manual/privacy-and-security/privacy/international-data-transfers

You can also contact us at thebigboybakeryy@gmail.com if you would like further information about the safeguards applying to international transfers of your personal information.

Your data protection rights

Under UK data protection law, depending on the circumstances and the lawful basis we rely upon, you may have the right to:

• Access the personal information we hold about you.
• Rectification of inaccurate or incomplete personal information.
• Erasure of your personal information in certain circumstances.
• Restriction of the way we use your personal information in certain circumstances.
• Object to certain uses of your personal information, including certain processing based on legitimate interests.
• Data portability, allowing you in certain circumstances to ask us to provide or transfer personal information you have given us.
• Withdraw consent at any time where we rely on consent, including for marketing.

These rights do not apply in every circumstance and may be subject to exemptions under data protection law.

If you make a valid data protection rights request, we will respond without undue delay and normally within one month.

To exercise any of these rights, contact us at thebigboybakeryy@gmail.com.

How to complain

If you have any concerns about how we collect or use your personal information, please contact us first:

Email: thebigboybakeryy@gmail.com

If you remain unhappy with how we have handled your personal information, you can also complain to the Information Commissioner's Office (ICO).

Information Commissioner's Office
ICO Head Office
4th Floor, No.3 Circle Square
5 Hawkshaw Street
Manchester
M1 7BL

Helpline: 0303 123 1113

Make a complaint to the ICO:
https://ico.org.uk/make-a-complaint/

Changes to this privacy notice

We may update this privacy notice from time to time to reflect changes to our business, website, service providers or legal requirements.

When we make changes, we will update the "Last updated" date at the top of this privacy notice.