Privacy Policy

2.1. When you place an order on the website

We collect:

• Name
• Email address
• Phone number
• Order details (cake type, size, flavor, decoration, etc.)
• Pickup date and time
• Technical payment status (paid / failed, payment ID from Stripe)

We do not see or store your full card numbers or CVV – this goes through Stripe.

2.2. When you contact us (email, phone, Instagram)

We may collect:

• Name or nickname
• Email address or phone number
• Content of your message
• Order ID (if you give it)

2.3. When you sign up for newsletter/marketing

If you tick the box for marketing, we collect:

• Email address
• Info about the fact you agreed to marketing
• Date/time of your consent

2.4. When you visit the website (technical data)

Our systems and/or our hosting/analytics providers may collect basic technical data, such as:

• IP address (often shortened/aggregated)
• Browser type and version
• Device type
• Operating system
• Date and time of visit
• Pages viewed

We use this only for basic statistics and security, not for building detailed profiles or doing creepy tracking.

3.1. To handle your order (contract) – Art. 6(1)(b) GDPR

We use your data to:

• Accept and confirm your order
• Prepare the cake
• Contact you if we need to clarify something
• Let you pick up the cake at the right time

Legal basis: performance of a contract – we can't make and hand over your cake without this data.

3.2. To handle payments – Art. 6(1)(b) and (f) GDPR

We send some data (order value, currency, basic customer info) to Stripe, our payment provider, to:

• Process your payment
• Confirm whether it was successful or not
• Prevent fraud and misuse

Legal basis: contract + our legitimate interest in safe payments and fraud prevention.

3.3. To issue invoices and keep accounting – Art. 6(1)(c) GDPR

We have legal duties under Polish law (e.g. tax and accounting rules). We may need:

• Your name
• In some cases, company details (if you ask for an invoice)

Legal basis: legal obligation – we must store some data for accounting and tax purposes for a certain number of years.

3.4. To plan our work using Google Calendar – Art. 6(1)(b) and (f) GDPR

We save order information in an internal Google Calendar used by our staff. This usually includes:

• Your name
• Pickup date and time
• Short note about the order (e.g. type of cake)

Legal basis: contract + our legitimate interest in organizing work and making sure your cake is ready on time.

3.5. To handle complaints and problems – Art. 6(1)(b) and (f) GDPR

If you complain about an order, we use your data to:

• Check what happened
• Contact you and solve the problem
• Possibly offer a discount for the next order

Legal basis: contract + our legitimate interest in customer support and defending our claims.

3.6. For newsletter/marketing – Art. 6(1)(a) GDPR

If you explicitly agree (e.g. by ticking a checkbox), we use your email to:

• Send news about the place
• Send promotions, discounts and special offers

Legal basis: your consent. You can withdraw consent at any time (see Section 8).

3.7. For statistics and security – Art. 6(1)(f) GDPR

Technical data about website visits may be used for:

• Basic statistics (how many people visit, which pages they view)
• Improving the website
• Protecting against attacks and abuse

Legal basis: our legitimate interest in keeping the website working and improving it.