Privacy Policy

Last updated: 25th October 2026

Polar Bakes is a home bakery run by Erin Heathfield, based in Ebbw Vale, South Wales. This policy explains what personal data we collect, why we collect it, and what your rights are under UK data protection law (UK GDPR).

If you have any questions, please get in touch at privacy@polarbakes.uk.

Information We Collect

Information you give us. When you submit an enquiry, sign up to our newsletter, or place a postal box order, we collect the details you provide - such as your name, email address, delivery address, and any notes or messages you include.

Incomplete orders. When you start a postal box order, we capture your email address and basket contents before payment is taken. This allows us to send you a reminder if you don't complete your order. We assign each incomplete order a unique reference number (e.g. PB-XXXXX). If you do not complete payment, your order is automatically cancelled after 7 days and we stop sending reminders at that point.

Discount code usage. If you apply a discount code at checkout, we record which email address used that code and when, in order to enforce per-email usage limits and prevent abuse.

Payment information. Postal box payments are processed securely by Stripe. We do not see or store your card details - these are handled entirely by Stripe and are subject to their privacy policy.

Spam protection. We use Cloudflare Turnstile to protect our public forms from automated submissions. Cloudflare processes your IP address and browser connection information to detect bots. Our server sends Cloudflare a verification token and your IP address; it does not send your enquiry text, name, email address or telephone number for this check. See Cloudflare's Turnstile privacy notice.

Website analytics. We use Plausible Analytics (self-hosted) to understand how visitors use our site. Plausible is cookieless and does not collect any personally identifiable information - it records only aggregated data such as page views, referral sources, and device type. No data is shared with third parties through Plausible.

Enquiry and order attribution. When you submit a form, we attach the page you used, the referring website, the previous page on our site and campaign tags from the current URL to your enquiry or order. We use this to understand which content brings suitable enquiries and bookings. Your "Where did you hear about us?" answer may be suggested from an available source, and you can change it.

We also use self-hosted Lookout for site performance and aggregate journey events. Form-start and form-completion events contain no enquiry message, contact details or order access tokens.

Advertising and conversion tracking (only if you allow marketing cookies). The first time you visit, we ask which optional cookies we may use. Nothing below happens unless you allow marketing cookies, and you can change your choice at any time from "Cookie settings" in the footer or here.

Meta (Facebook) Pixel - collects information about your visit and actions on our site (such as submitting an enquiry or completing a purchase) and shares it with Meta Platforms Ireland Ltd. Meta may use this data to show you relevant adverts on Facebook and Instagram. You can manage your ad preferences via Facebook Ad Preferences or opt out of interest-based advertising at Your Online Choices. Meta's privacy policy is available at facebook.com/privacy/policy.
Meta Conversions API - when you send an enquiry, pay for a postal box, or later book a cake from an enquiry, our server tells Meta that it happened. We send your email address and telephone number in hashed (scrambled) form, the order value, your IP address, browser type and Meta's own cookie identifiers, so Meta can match it to an advert you saw. Meta receives no enquiry message or order details beyond the value.
Ad click identifiers - if you arrive from an advert or a tagged link, we keep the click identifier Google or Meta adds to the link, the campaign tags and the page you landed on in a cookie for 90 days, and store them with any enquiry or order you send. This is how we tell which adverts lead to bookings. You can manage your Google ad settings at adssettings.google.com.

Cookies

Our own analytics (Plausible and Lookout) do not use cookies. We set one strictly necessary cookie, pb_consent, to remember your choices for six months. Only if you allow marketing cookies: the Meta Pixel sets _fbp and _fbc, and we set pb_ad (the ad click described above, 90 days). If you reject them, or turn them off later, these are deleted. You can also control or delete cookies through your browser settings at any time.

How We Use Your Information

We use the information we collect to:

Process and fulfil your orders and respond to your enquiries.
Send order confirmations and updates via Resend, our transactional email provider.
Send abandoned cart reminder emails if you begin a checkout and do not complete it.
Send marketing emails and newsletters - only if you have opted in. You can unsubscribe at any time via the link in any email we send. Newsletter emails are delivered via Brevo.
Measure and improve the performance of our website and advertising campaigns.

Our legal basis for processing your personal data is contract performance (to fulfil orders and respond to enquiries), legitimate interests (cookieless website analytics, enquiry attribution, and abandoned cart reminders), and consent (advertising cookies, the Meta Conversions API and marketing emails).

How Long We Keep Your Data

We keep order details for up to three years in case of follow-up queries or disputes. Enquiry data is kept for up to one year. Abandoned orders that are not completed are cancelled after 7 days. Newsletter subscriber data is kept until you unsubscribe. You can ask us to delete your data at any time.

Third-Party Services

We use the following third-party services to operate our website and fulfil orders:

Stripe - payment processing
Resend - transactional emails (order confirmations, reminders)
Brevo - newsletter and marketing emails
Cloudflare Turnstile - bot detection and form spam protection
Plausible Analytics - cookieless website analytics (self-hosted)
BasicRUM - cookieless page speed measurement (load timings, browser and device type)
Meta Pixel and Conversions API - advertising measurement, only with your consent

Beyond these services, we do not sell, rent, or share your personal data with other third parties, except where required by law.

Data Security

We take reasonable steps to keep your personal information secure and protected from unauthorised access, disclosure, or loss.

Your Rights

Under UK GDPR, you have the right to:

Access the personal data we hold about you.
Ask us to correct inaccurate data.
Ask us to delete your data (the "right to be forgotten").
Object to or restrict how we process your data.
Receive a copy of your data in a portable format.
Withdraw consent for marketing or advertising cookies at any time.

To exercise any of these rights, contact us at privacy@polarbakes.uk. You also have the right to lodge a complaint with the UK's data protection authority, the Information Commissioner's Office (ICO).

Changes to This Policy

We may update this policy from time to time. The date at the top of this page will reflect when it was last changed. We'd encourage you to check back occasionally.

Contact

Polar Bakes, Ebbw Vale, South Wales. Email: privacy@polarbakes.uk.