1.1 Krumblelane Ltd (“Krumblelane”, “we”, “us”, “our”) is the data controller responsible for the personal data described in this policy. We are a company registered in England and Wales.

Registered address

Krumblelane Ltd, 5 Mostyn Street, Wellingborough, England, NN8 6BZ

Company number

16949843

Contact

privacy@krumblelane.co.uk

1.2 As data controller, we determine the purposes and means of the processing of the personal data described in this policy.

1.3 We have assessed the criteria in Article 37 of the UK GDPR for the mandatory appointment of a Data Protection Officer and concluded that our current activities do not involve large-scale systematic monitoring of individuals, nor large-scale processing of special category data. We have therefore not appointed a statutory DPO at this time. We keep this assessment under review and will appoint a DPO if the nature or scale of our processing changes such that the statutory threshold is met.

2.1 Depending on whether you are a customer or a baker, we may collect the following categories of personal data:

• a) Account data: name, email address, telephone number, and (for bakers) business name and trading details.
• b) Profile data: for bakers, the information you provide to build your storefront, including business description, location, and product listings.
• c) Order data: the products you order or sell, order history, collection details, custom order specifications, and messages exchanged between customers and bakers.
• d) Payment data: card details and transaction records. Full card details are handled directly by our payment processor (see clause 5). We do not store full card numbers.
• e) Communications data: messages you send us, support enquiries, and records of our correspondence with you.
• f) Marketing data: your preferences for receiving marketing from us and your consent status.
• g) Usage data: how you interact with the merchant dashboard, features used, device type, and IP address.

2.2 We may also collect data automatically through analytics tools embedded in the platform. See clause 6 for details.

2.3 Special category data (health and allergy information): If you voluntarily share health-related information with us or with a baker through the platform (for example, by disclosing a food allergy or dietary requirement in a message), this may constitute special category health data under UK GDPR Article 9. We will only process such data where you have given your explicit consent to us doing so, as required under Article 9(2)(a). Where the platform identifies that you are sharing allergy or health-related information, we will prompt you to confirm your explicit consent at that point. You may withdraw this consent at any time by contacting us at privacy@krumblelane.co.uk, though withdrawal will not affect any processing already carried out.

3.1 We use personal data only for the purposes described in this policy and only where we have a lawful basis to do so under UK GDPR Article 6.

3.2 The lawful bases we rely on are:

• a) Contract (Article 6(1)(b)): processing necessary to provide the platform service, process and fulfil orders, manage accounts, and communicate order confirmations and service notifications.
• b) Legal obligation (Article 6(1)(c)): processing required to comply with applicable law, including HMRC record-keeping requirements, financial reporting obligations, and responses to lawful requests from public authorities.
• c) Legitimate interests (Article 6(1)(f)): processing necessary for our legitimate business interests, provided those interests are not overridden by your rights and freedoms. We rely on this basis for:
  • Fraud detection and prevention: monitoring transactions and account activity for signs of fraudulent or abusive behaviour, which protects both Krumblelane and its users.
  • Platform security: identifying and responding to security vulnerabilities, unauthorised access, or technical incidents.
  • Service improvement: analysing anonymised usage patterns to improve platform features, fix bugs, and develop new functionality. We use anonymised or aggregated data wherever possible for this purpose.
  • Baker communications: contacting bakers about platform updates, policy changes, and account-related matters on the basis that this is necessary for the operation of the business relationship.
• d) Consent (Article 6(1)(a)): where we rely on your consent (for example, for marketing communications or for processing special category data under Article 9(2)(a)), you may withdraw that consent at any time.

3.3 Where we rely on legitimate interests, you have the right to object to that processing. See clause 8 for how to exercise your rights.

4.1 We send marketing communications to customers only where you have given your consent to receive them. We do not send customer marketing on the basis of legitimate interests.

4.2 You can withdraw your consent and opt out of marketing at any time: using the unsubscribe link in any marketing email, through your account settings, or by contacting us at privacy@krumblelane.co.uk.

4.3 Service communications are different from marketing. Messages that are necessary to operate your account or fulfil an order, such as order confirmations, collection notifications, and policy updates, are not marketing, and you will continue to receive them while you hold an account, regardless of your marketing preferences.

5.1 We do not sell your personal data. We share it only as described below.

5.2 We share personal data with:

• a) Bakers: when you place an order, the baker fulfilling it receives the data necessary to prepare and hand over your order, including your name, order details, and any messages you send them.
• b) Stripe (payment processing): card and transaction data is processed by Stripe to take payment and pay out to bakers. Stripe acts as our processor for this purpose. Stripe also processes certain data for its own purposes (including fraud prevention, security, and service improvement) and in that capacity acts as an independent data controller. Please refer to Stripe’s own privacy policy for details of those uses.

5.3 We may disclose personal data where required to do so by law, or in response to a valid request from a public authority, regulator, or court.

5.4 If Krumblelane is involved in a merger, acquisition, or sale of assets, personal data may be transferred as part of that transaction. We will notify you and ensure your rights continue to be protected.

6.1 We use analytics tools to understand how the platform is used and to improve it. Our use of cookies and similar tracking technologies is governed by the Privacy and Electronic Communications Regulations (PECR) as well as the UK GDPR.

6.2 Non-essential analytics and tracking technologies are used only where you have given your consent, unless an exemption applies. Strictly necessary technologies do not require consent.

6.3 Full details of the specific technologies we use, and the controls available to manage your preferences, are set out in our Cookie and Tracking Technology Policy. That policy and this one are intended to be read together.

6.4 All analytics data is processed within the United Kingdom.

7.1 We keep personal data only for as long as necessary for the purposes for which it was collected, including to meet legal, accounting, or reporting requirements.

7.2 Indicative retention periods:

• a) Account data: retained while your account is active, and for a reasonable period after closure to handle any post-account matters.
• b) Order and transaction data: retained in line with HMRC record-keeping requirements (a minimum of seven years for financial records).
• c) Communications and support data: retained for as long as needed to resolve your enquiry and for a reasonable period thereafter.
• d) Marketing data: retained until you withdraw consent or opt out.
• e) Special category (health/allergy) data: retained only as long as needed for the order to which it relates, then deleted or anonymised.

7.3 When personal data is no longer required, we delete it securely or anonymise it.

8.1 Under UK GDPR you have the following rights in relation to your personal data:

• a) The right to be informed about how we use your data.
• b) The right of access to the data we hold about you.
• c) The right to rectification of inaccurate or incomplete data.
• d) The right to erasure (“the right to be forgotten”) in certain circumstances.
• e) The right to restrict processing in certain circumstances.
• f) The right to data portability.
• g) The right to object to processing carried out on the basis of legitimate interests, and to object to direct marketing.

8.2 Where our processing is based on consent, you have the right to withdraw that consent at any time.

8.3 To exercise any of these rights, contact us at privacy@krumblelane.co.uk. We will respond within one month, as required by UK GDPR. We may extend this period for complex requests and will tell you if we do.

8.4 If you are unhappy with how we have handled your data, you have the right to lodge a complaint with the Information Commissioner’s Office (ICO) at ico.org.uk. We would, however, appreciate the chance to address your concerns first.

9.1 We implement appropriate technical and organisational measures to protect personal data against unauthorised or unlawful processing, accidental loss, destruction, or damage.

9.2 Access to personal data is restricted to those who need it to perform their role, and is controlled through role-based access controls.

9.3 Payment data is handled exclusively by Stripe, which is PCI DSS compliant. Krumblelane does not store full card details.

9.4 In the event of a personal data breach that is likely to result in a risk to your rights and freedoms, we will notify the ICO within 72 hours of becoming aware of the breach, and will notify you directly where required.

10.1 The platform is intended for users aged 13 and over. Under UK GDPR, a child aged 13 or over can provide their own consent for information society services. We do not knowingly collect personal data from children under the age of 13, and if we become aware that we have done so without appropriate consent, we will delete it promptly.

10.2 Separately from the UK GDPR consent position, our Customer Terms of Service set a product-level requirement for parental or guardian permission for younger users. The data protection consent position and the contractual permission requirement are distinct, and both apply.

10.3 We recognise that the ICO’s Age Appropriate Design Code (the Children’s Code) is relevant to a service likely to be accessed by under-18s. We will complete a Data Protection Impact Assessment (DPIA) before public launch to assess and mitigate risks to younger users, and will design the service with their best interests in mind.

10.4 Parents or guardians may contact us at privacy@krumblelane.co.uk to request access to, correction of, or deletion of data relating to a minor in their care.

11.1 All personal data collected and processed by Krumblelane is stored and processed within the United Kingdom. We do not transfer personal data outside the UK.

11.2 We will update this policy if our data processing arrangements change in a way that involves transfers outside the UK, and will ensure that appropriate safeguards are in place before any such transfer takes place.

12.1 We may update this Privacy Policy from time to time to reflect changes in our data practices, legal obligations, or platform features.

12.2 Where changes are material, we will notify you via the app or by email at least 14 days before the changes take effect.

12.3 The current version of this policy, along with the date it was last updated, will always be available on the platform.

12.4 Continued use of the platform after an updated policy takes effect constitutes acknowledgement of the changes. However, where we intend to process your data in a new way that requires your consent, we will seek that consent directly and separately. Continued use will never be treated as consent to new or changed processing where consent is the required lawful basis.

13.1 If you have any questions, concerns, or requests relating to this Privacy Policy or how we handle your personal data, please contact us at:

Email

privacy@krumblelane.co.uk

Post

Krumblelane Ltd, 5 Mostyn Street, Wellingborough, England, NN8 6BZ

13.2 We aim to respond to all privacy-related enquiries within 5 business days.