Privacy Policy

1. Introduction

Olgish Cakes is the trading name of OLGISH CAKES LTD, registered in England and Wales (company number 17507868). OLGISH CAKES LTD is the controller of personal information collected from 8 October 2026 onwards.

Olga Ieromenko, previously trading as Olgish Cakes, remains the controller of personal information collected before 8 October 2026. You can use the contact details in this policy for either controller.

We collect and use personal information to respond to enquiries, prepare quotes, fulfil orders across the UK, communicate with customers, meet legal obligations, protect our website and understand website use where you choose optional technologies.

2. Information we collect

The information we collect depends on your enquiry, order or use of our website. Examples include:

• Contact details: Name, email address, phone number, and delivery address.
• Order details: Cake choices, sizes, ordinary dietary preferences, and gift messages.
• Payment records: After we agree the order details and price with you, we send a separate payment link through Revolut. We receive transaction information such as the amount, payment status, date and reference. Card details are entered with Revolut; Olgish Cakes does not receive or store card details.
• Messages and enquiries: Notes you send through forms, email, or social media.
• Website usage data: IP address, device and browser details, pages viewed, and approximate location.
• Cookie preferences: Your separate choices about analytics and session insights.
• Images, reviews and other content you share: Reference images, personal photographs, logos and messages supplied for an enquiry or order, photographs uploaded through our Events service for printing on a cake slice, and reviews, testimonials or photographs you approve for publication.
• Events requests and historic link records: Your name, email address, selected event and uploaded photographs. Historic follow-up link records may also show which link was selected and when, linked to a photo request. We no longer collect new records of these clicks.

We normally receive this information directly from you. If someone orders a gift for you, we may receive your name, delivery address, telephone number and gift message from that customer. Website usage information comes from your browser, device and our service providers.

If you provide information, photographs or other content relating to another person, please provide only what is needed for your enquiry or order.

Contact, order and delivery information is needed to respond to your enquiry, prepare a quote and fulfil an agreed order. After we agree the order details and price, we send a separate payment link through Revolut. Our terms explain when a contract starts. If you do not provide the required information, we may be unable to quote, accept or deliver the order. Inspiration images, reviews and ordinary dietary preferences are optional. We do not use personal data to make solely automated decisions that have legal or similarly significant effects.

3. How we use your information

We use your information to:

• Respond to order enquiries and prepare requested quotes.
• Confirm and fulfil agreed orders, including arranging delivery or collection.
• Prepare photographs submitted through our Events service for printing on a cake slice.
• Review historic Events follow-up link records to understand past interest in our services.
• Send payment requests through Revolut after we agree the order details and record payment status.
• Respond to customer service messages and privacy questions or complaints.
• Keep records for tax, accounting, and business administration.
• Protect our website and systems against misuse.
• Understand website use where you choose the relevant optional technologies.
• Publish reviews, testimonials or photographs where you give permission.

4. Lawful bases for processing

Under UK GDPR, we must have a lawful basis for processing your data. The ones we rely on are:

5. Analytics and session insights

We offer separate choices for Google Analytics for page and journey analytics and Microsoft Clarity for heatmaps and session recordings. We load only the services you select through Google Tag Manager. Accepting Google Analytics does not enable Microsoft Clarity. We do not currently use Google Ads or Microsoft Advertising, and we keep advertising storage and personalisation disabled. You can withdraw either choice at any time using the “Manage cookies” control in the site footer. When you turn an active service off, we remove related optional browser storage under our control and refresh the page to stop tracking. Unfinished form entries may be lost.

We no longer record clicks on the follow-up links shown after an Events photo request. Records collected previously may still be linked to the original request and email address until they are deleted under the retention schedule in section 7. You can contact us about these records or exercise your rights using the details in section 8.

6. Sharing your data

We do not sell your personal data. We only share it when necessary to run the business and fulfil your orders, provide services you choose or meet legal responsibilities, for example with:

• Vercel, for website hosting, performance and security services.
• Supabase, for storing enquiries, orders, messages, uploaded reference files and Events requests, temporary photographs and historic follow-up link records.
• Resend, for sending enquiry and order emails.
• Namecheap Private Email, for receiving and storing messages sent to our business email address.
• Telegram, for notifications to the business owner. Main website enquiry and order notifications contain a reference, basic order information and an admin link; they exclude customer names, contact details, message text, health information and photographs. Events photo requests are different: they include your name, email address, event name and the original photograph so we can prepare your print.
• Sanity, for website content and product images, including approved reviews or photographs where used for publication.
• Google Drive, for backups of our Sanity website content and assets, which may include reviews or photographs approved for publication.
• Google Analytics and Microsoft Clarity, only for the optional purposes you accept.
• Revolut, for separate payment links after we agree the order details and price. We receive transaction information but do not receive or store card details.
• Delivery providers, where needed to deliver your order.
• Accounting or invoicing providers, where needed for business and legal records.
• Professional advisers, regulators, courts or law-enforcement bodies where disclosure is legally required or necessary to establish or defend legal rights.

Some service providers process personal information on our behalf under our instructions. Others have separate responsibilities under data-protection law for particular processing. Their privacy information explains those activities. We review access and share only the information reasonably needed for the purpose.

Microsoft also acts as a controller for information processed through Clarity, as explained in the Microsoft Privacy Statement. Revolut provides its own privacy information when you use a payment link.

7. Data retention

Our retention schedule uses the periods below. For enquiry, order and Events request records, a quarterly check identifies information due for deletion; an authorised administrator reviews and carries out deletion. Reaching a scheduled date does not automatically erase those records.

• Enquiries that do not become orders: due for deletion 24 months after closure or our last recorded contact, whichever is later.
• Orders, contracts, invoices, payment records and associated correspondence: normally six years after the end of the relevant financial year, to meet tax, accounting and legal-claim requirements.
• Reference images and other order uploads: due for deletion 24 months after the enquiry closes or the order is completed, unless they form necessary evidence for an ongoing complaint or legal claim.
• Events photographs: we remove the temporary website upload after successfully sending it to the business owner through Telegram. Failed or abandoned uploads become eligible for cleanup after 24 hours and are checked by a daily cleanup job. This does not remove the separate Telegram copy.
• Events request details and any historic follow-up click records linked to them: due for deletion 24 months after the temporary photograph is removed and the request closes. Stopping new click collection does not extend this period.
• Google Analytics: user- and event-level data has a configured retention period of no more than 14 months. If the user-data reset setting is enabled, new activity restarts that period for user identifiers. Expired data is deleted in Google’s monthly deletion cycle. These settings do not control standard aggregated reports.
• Microsoft Clarity: session playback is retained for 30 days. Labelled or favourited sessions, click data and heatmap data are retained for nine months.
• Cookie choices stored on your device: six months (180 days) from your last decision, unless you clear or replace the choice sooner.
• Security and abuse-prevention records: normally up to 90 days, or longer only while a specific incident or legal claim is investigated.
• Reviews or photographs approved for publication: until permission is withdrawn or the material is no longer used; we review retained permissions at least annually.

Our Cookie Policy lists the technologies we use and their device-storage durations. A cookie expiring does not itself delete information already held by a provider. See the provider explanations of Google Analytics data retention and Microsoft Clarity data retention.

Copies in email, Telegram, content backups and downloaded files need separate review and deletion. Deleting a website record does not erase these copies. Our retention procedure requires separate checks of these systems and removal of copies no longer needed for their purpose or a legal requirement. Protected backups may retain deleted information until they are replaced or expire; if a backup is restored, the relevant deletions must be applied again.

We may keep relevant records longer where the law requires it, a complaint or legal claim is active, or a court or regulator requires preservation. Any retention of health information requires an additional condition under UK GDPR, such as necessity for a legal claim; our ordinary business interests alone are not enough. When the reason ends, we delete or anonymise the data.

8. Your rights

You have rights under UK data protection law. These include the right to:

• Access the personal data we hold about you.
• Request correction of inaccurate or incomplete data.
• Ask us to delete data where there is no legal reason for us to keep it.
• Restrict or object to certain types of processing.
• Request a portable copy of eligible data you provided to us.
• Withdraw consent for analytics, session insights or publication of your review, testimonial or photograph at any time.
• Raise a complaint with the UK Information Commissioner’s Office (ICO).

To exercise any of these rights, email hello@olgishcakes.co.uk. We may ask for verification to protect your privacy. Rights can depend on the circumstances and lawful basis. We respond without undue delay and normally within one month. If a permitted extension is needed, we will explain why.

Withdrawing consent does not affect the lawfulness of our processing based on that consent before you withdrew it.

9. International transfers

Depending on the provider, your information may be processed outside the UK, including in the United States, the European Economic Area and Singapore. Restricted transfers require a recognised UK transfer arrangement, such as UK adequacy regulations, the UK International Data Transfer Agreement or the UK Addendum to the EU Standard Contractual Clauses. Transfers relying on contractual safeguards may also require a data protection test and additional measures.

Vercel, Supabase, Resend and Sanity publish data-processing terms that include UK transfer clauses. Google and Microsoft explain international processing in their privacy information. Telegram describes Netherlands storage for UK and EEA accounts and possible sharing with group companies in the British Virgin Islands and Dubai.

Contact us for information about the arrangements relevant to your data and how to obtain a copy of the applicable safeguards; commercially confidential wording may be redacted.

10. Cookies and preference controls

For detailed cookie information, please read our Cookie Policy. You can update your preferences at any time via the “Manage cookies” link in the footer.

11. Changes to this policy

We review this policy when our services, providers or use of personal information changes. We update the date at the top of this page. Where a significant change affects how we use personal information, we will bring it to your attention where appropriate before the new processing begins.

12. Contact us

If you have any questions about this Privacy Policy or how we handle personal data, please reach out: