Privacy Policy

Last updated: 14 July 2026

Who we are

The Cookie Dough Kid is a small handmade dessert business based in Leeds, LS10. For data protection purposes the data controller is [CONFIRM: FULL LEGAL NAME OF THE BUSINESS OWNER] trading as The Cookie Dough Kid. You can contact us about anything in this policy on WhatsApp or by email at [CONFIRM: CONTACT EMAIL ADDRESS].

This website sets no cookies

We mean this literally. This site stores nothing on your device, sets no cookies of any kind, and loads no fonts, images, scripts, maps, videos or embeds from anyone else's servers. Everything the page needs is served from our own site. That is why you will not see a cookie banner: there is nothing to ask you to consent to.

We do not use Google Analytics, Meta Pixel, Microsoft Clarity, Hotjar, or any other analytics, advertising or session recording tool.

What our hosting provider sees

Like every website, when your browser requests a page, our hosting provider [CONFIRM: HOSTING PROVIDER, e.g. Cloudflare Pages] automatically processes technical information including your IP address, the page requested, and your browser type. This is used only to serve the site and to keep it secure and available. It is the minimum necessary to run a website at all.

Lawful basis: our legitimate interests in operating a secure and functional website.

If you order from us on WhatsApp

Our order buttons open a conversation with us in WhatsApp. WhatsApp is provided by Meta, and when you message us, Meta processes that conversation under its own terms and privacy policy. We do not control that, and we would encourage you to read WhatsApp's privacy policy before you use it.

What we ourselves keep when you place an order:

• Your name and the phone number you message us from
• Your order and any delivery or collection details you give us
• Any allergy or dietary information you tell us, so we can keep you safe
• A record of the order and payment, for our accounts

Lawful basis: performance of a contract (making and delivering the order you asked for), and legal obligation for the accounting records we are required to keep.

Allergy information you give us

If you tell us about an allergy or intolerance, that is health information, which is a special category of personal data. We use it for one purpose only: to protect your health when preparing your order. Lawful basis: Article 9(2)(a) UK GDPR, your explicit consent, given when you choose to tell us.

Who we share your information with

We do not sell your data and we do not share it for marketing. The only parties involved are the ones needed to actually fulfil your order: WhatsApp (Meta) for the conversation itself, and our payment method [CONFIRM: HOW PAYMENT IS TAKEN, e.g. bank transfer, cash on delivery, or a payment provider].

How long we keep it

We keep order and payment records for six years, because HMRC requires it. WhatsApp conversations are kept only as long as we reasonably need them, and we delete old chats periodically. We do not keep a marketing list unless you deliberately ask to join one.

Your rights

Under UK GDPR you have the right to:

• Ask what personal data we hold about you, and get a copy of it
• Have inaccurate information corrected
• Ask us to delete your data, where we are not legally required to keep it
• Object to, or ask us to restrict, how we use it
• Withdraw consent at any time, where we relied on your consent

Just message us and ask. If you are unhappy with how we have handled your information, you can complain to the Information Commissioner's Office at ico.org.uk.

Children

This site is not aimed at children. We do not knowingly collect information from anyone under 13. If a child has messaged us, please get in touch and we will delete it.

Changes to this policy

If we ever add something that changes what we collect, for example an online checkout, an analytics tool or a mailing list, we will update this policy before that goes live, not afterwards.