Auburn Whisk

Privacy Policy

Last updated: 15 October 2026

Auburn Whisk (“I”, “me”, “my”) is a home-based bespoke cake business in Surrey, UK. I take your privacy seriously and only collect the information I need to answer your enquiry and make your order. This policy explains what I collect, why, and your rights under UK data protection law (UK GDPR and the Data Protection Act 2018).

Who is responsible for your data

Auburn Whisk Ltd is the data controller. You can contact me about anything in this policy at [email protected].

What information I collect

When you send an enquiry through the website form, or contact me by email or social media, I collect:

  • your name, email address and, if you give it, phone number;
  • details of your order: date needed, occasion, order type, number of servings, budget, preferred flavours and design ideas;
  • any allergies, intolerances or dietary needs you tell me about. This can be information about your health, which the law treats as especially sensitive;
  • photos or inspiration images you choose to send;
  • payment details such as the date and amount of a deposit. Payments are arranged outside this website, and I never collect or store card details through it.

How and why I use it

What I doMy legal reason
Reply to your enquiry and give you a quoteTaking steps at your request before a contract
Make, deliver or arrange collection of your order and take paymentPerforming our contract
Make your cake safe for any allergy or dietary need you discloseYour explicit consent, which you give by telling me
Keep business and tax recordsLegal obligation
Keep the website secure and stop spamLegitimate interests

I do not sell your information, and I do not use it for automated decision-making. I will only send you marketing if you ask me to.

Allergy and health information

If you tell me about an allergy or dietary requirement, I use it only to decide whether I can make your order safely and to prepare it. By including it in your enquiry you give your explicit consent for me to do this. You can withdraw that consent at any time, but I may then be unable to take or fulfil the order. See also the allergen information.

Who I share it with

I only share information with services that help me run the business, and only what they need:

  • Website form provider: your enquiry is sent through Formspree, which delivers it to my email inbox. CONFIRM before launch: update this if a different form service is used.
  • Email provider: Google (Gmail) stores the emails you and I exchange.
  • Website host: the site is hosted by Cloudflare, which processes technical data such as your IP address in order to serve pages. CONFIRM before launch: update this if a different host is used.
  • Fonts: the site loads its typefaces from Google Fonts, which means your IP address is sent to Google when a page loads.
  • Authorities and advisers: accountants or HMRC where required by law.

Some of these providers are based outside the UK, for example in the United States. Where that happens, I rely on safeguards such as the UK–US data bridge or approved standard contractual clauses.

Cookies

This website does not set advertising or tracking cookies and does not use analytics. If that changes, I will update this page and ask for your consent where the law requires it. Links to Instagram and TikTok take you to their own sites, which have their own privacy policies.

How long I keep it

  • Enquiries that do not become orders: up to 12 months, then deleted.
  • Orders and payment records: 6 years, as required for tax and accounting.
  • Allergy information: deleted when your order is complete, unless you ask me to keep it for future orders.
  • Photos you send: deleted after your order is complete, unless you agree otherwise.

How I protect it

Your information is held in password-protected email and devices, and the website uses an encrypted (HTTPS) connection. No system is completely secure, but I take reasonable steps to protect your information and will tell you and the ICO if there is a breach that puts your rights at risk.

Your rights

You have the right to:

  • ask for a copy of the personal information I hold about you;
  • ask me to correct anything that is wrong or incomplete;
  • ask me to delete your information, or restrict how I use it;
  • object to my use of your information where I rely on legitimate interests;
  • ask for your information in a portable format;
  • withdraw your consent at any time, where I rely on it.

To use any of these rights, email [email protected]. I will reply within one month. Some information, such as tax records, I am legally required to keep.

If you are unhappy with how I have handled your information, please tell me first so I can put it right. You also have the right to complain to the Information Commissioner’s Office (ICO) at ico.org.uk or on 0303 123 1113.

Children

The website is for adults placing orders. I do not knowingly collect information from children under 13. If a cake is for a child, please enquire as the parent or guardian.

Changes to this policy

I may update this policy from time to time. The date at the top shows when it was last changed.

Contact

Auburn Whisk Ltd, Surrey, UK
[email protected]

Enquire about a cake