Privacy Policy

Cesca's Bakes is a home-based bakery operated by Francesca Farrugia as a self-employed sole trader in Naxxar, Malta. I am committed to protecting the privacy of everyone who visits my website, places an order, or gets in touch with me. This policy explains what personal data I collect, why I collect it, and how I keep it safe.

Information Collected

I may collect the following personal information when you interact with me:

• Contact details - your name, email address and phone number

• Order information - details of the products you order, customisation requests, flavour preferences, and any allergy or dietary information you share with me

• Payment information - all payments are made via Revolut and never directly through my site

• Communication records - messages you send me via email, WhatsApp, Instagram, or the website order form

• Technical data - your IP address, browser type, and basic usage data collected automatically when you visit my site

How I Use Your Information

• Process and fulfil your orders, including bespoke/custom cake requests

• Communicate with you about your order status, pickup details, and any questions

• Send you an email with updates and limited edition drops (only if you have consented to this)

• Improve my website, products, and service

• Comply with legal obligations

I will never sell your information to third parties or use it for purposes unrelated to Cesca’s Bakes.

Allergies and Dietary Needs

The order form asks you to tick any allergens that apply, and lets you add a line of detail. Information about your health is a special category of personal data under Article 9, and it gets handled more carefully than the rest:

• I rely on your explicit consent under Article 9(2)(a).
• I use it for one thing: preparing your order safely.
• I do not share it, and I delete it with the rest of your order.

You do not have to tell me. But I bake in a domestic kitchen where I cannot guarantee the absence of any allergen, and I would much rather know, so please read the allergen information before you order.

Information Sharing

I only share your data with third parties when it is necessary to fulfil my service:

• Website hosting - my site is hosted by a third-party provider, which may process basic technical data (IP address, etc.) and stores the orders placed through it

• Email service - I use a third-party email provider to send order confirmation emails

I do not share your data with any marketing or advertising platforms.

Analytics

Only if you accept them. See the cookie policy for exactly what is set and for how long. The lawful basis is your consent, and you can change your mind at any time using the Cookie Settings link in the footer.

Server Logs

My hosting provider records the usual things a web server records: IP address, the page requested, the time, and your browser's user-agent string, to keep the site running and to spot abuse. The lawful basis is legitimate interests under Article 6(1)(f). The interest is keeping the site available and secure, and I have weighed that against the fact that these logs are short-lived and are never used to build a profile of you.

Who Else Sees It

As few people as possible:

• My hosting provider, which stores the site, its logs, and the orders placed through it.
• My email provider, because a quote can be an email and your order details are in it.
• Google, but only if you accept analytics.

Each of these is a processor acting on my instructions. I do not sell your data, I do not share it for anyone else's marketing, and no decision about you is made automatically or by profiling.

Some of these providers may process data outside the European Economic Area. Where they do, the transfer relies on an adequacy decision by the European Commission or on Standard Contractual Clauses.

Data Retention

I keep your personal data only for as long as necessary to fulfil the purposes outlined in this policy. Order records are retained for accounting and legal purposes as required by Maltese law. If you'd like me to delete your data, please get in touch and I'll do so where legally permitted.

Your Rights

Under the General Data Protection Regulation (GDPR), you have the right to:

• Access the personal data I hold about you

• Request correction of inaccurate data

• Request deletion of your data (where legally permitted)

• Object to or restrict certain processing of your data

• Withdraw consent at any time where processing is based on consent

To exercise any of these rights, email me at cescasbakes2@gmail.com

Third-Party Links

My website may contain links to external sites such as Instagram or WhatsApp. I am not responsible for the privacy practices of those platforms. I encourage you to read their privacy policies before sharing any personal information.

Changes to This Policy

I may update this Privacy Policy from time to time. Any changes will be posted on this page with an updated "Last updated" date. I encourage you to review this page periodically.