This notice explains what we do with your personal information, why, and what you can ask us to do about it. It covers this website and orders placed through it.
Who we are
Brechin Dog Park Partnership, a partnership established in Scotland, of Brechin Dog Park c/o Hoodston Farm, Findowrie, Brechin, SCT, DD9 6RF, GB is the data controller for the information described here, for the purposes of the UK General Data Protection Regulation and the Data Protection Act 2018. Bones and Bakes is a sub-brand of the Partnership, not a separate business, and the same controller and the same policy apply across brechindogpark.uk and this site.
Email [email protected] for anything in this notice, or write to us at the address above. We are not required to appoint a Data Protection Officer and have not appointed one; enquiries come to the Partnership directly.
What we collect, why, and on what basis
UK GDPR requires us to name a lawful basis for each use of your information. Ours are these.
Orders
When you buy something we process your name, email address, telephone number, delivery address, and what you ordered. We need this to bake, pack and send your order, and to answer you if something goes wrong. This is collected and stored on our behalf by Shopify, which runs our checkout.
Lawful basis: performance of a contract. Without this information we cannot fulfil an order.
Payment is taken by Shopify. Card details never reach this website or us — they go directly to Shopify and their payment provider.
Order records for tax
We keep a record of what was sold, to whom, and for how much, because HMRC requires it.
Lawful basis: legal obligation.
Email you send us
If you email us we keep the message and our reply, so we have the history if you contact us again.
Lawful basis: legitimate interests — running a shop competently and being able to answer you.
Website security
Our host and our content delivery network record the IP address of visitors, to detect and block attacks and to serve pages quickly.
Lawful basis: legitimate interests — keeping the site up and secure.
Marketing email
If you ask us to, we will email you when a new batch is ready. You can unsubscribe from any of those emails, and we will not add you without asking.
Who else sees it
We do not sell your information, and we do not share it for anyone else’s marketing. It reaches these organisations because they do the work:
- Shopify — runs our shop, checkout and payments, and stores your order. Shopify is our processor for order data, and a controller in its own right for payment processing and for its own purposes such as fraud prevention and personalised advertising; its own privacy policy covers those. Shopify is based outside the UK, so some data is transferred internationally under the safeguards described below.
- SiteGround — hosts this website and holds the server logs.
- Royal Mail — receives your name and delivery address, to deliver your parcel.
- HMRC — receives sales records where we are required to report them.
- Cloudflare — our content delivery network, which sits in front of the site for performance and security.
We may also disclose information where the law requires it.
Sending information outside the UK
Shopify, Cloudflare and Google may process your information outside the United Kingdom. Where that happens, the transfer relies on the UK International Data Transfer Addendum to the EU Standard Contractual Clauses, or on UK adequacy regulations for the receiving country. You can ask us for a copy of the safeguards that apply.
Cookies
This site sets the cookies WordPress, Shopify, SiteGround and Cloudflare need to work — keeping your basket, keeping the site secure, and serving pages quickly. These are strictly necessary, so we do not ask consent for them.
We also use Google Analytics to understand how the site is used.
How long we keep it
- Order records: six years from the end of the tax year they fall in, because HMRC requires it.
- Email correspondence: two years, then deleted.
- Server logs: 30 days.
- Marketing list: until you unsubscribe, then removed within 30 days.
Your rights
Under UK GDPR you can ask us to:
- tell you what we hold about you, and give you a copy (a subject access request);
- correct anything that is wrong;
- delete information we no longer have a reason to keep;
- restrict what we do with it while a dispute is resolved;
- transfer it to you or another provider in a portable format;
- stop processing based on legitimate interests, where you object;
- withdraw consent at any time, where consent is the basis.
Some of these have limits: we cannot delete an order record we are required to keep for tax, for example. Email us and we will answer within one month, which is the statutory deadline. There is no charge.
Complaints
If we get this wrong, tell us first — we will sort it faster than anyone else can. If you are still unhappy you can complain to the Information Commissioner’s Office. You do not need our permission, and complaining to them does not affect any other right you have.
Children
This shop is intended for adults. We do not knowingly collect information from anyone under 16. If you believe we hold a child’s information, email us and we will delete it.
Changes to this notice
We may update this notice. The date at the top tells you when this version took effect. Where a change materially affects how we use your information, we will tell you rather than rely on you noticing.