Privacy policy.

The data controller is the organisation named at the top of this page. We decide why and how your personal information is processed when you use our website and pre-order service.

If you have questions about this policy or your personal data, contact us using the details above.

We may collect the following, depending on how you use the site:

• Identity and contact details — name, email address and optional phone number when you pre-order or ask us to keep you posted about future seasons.
• Order information — products ordered, collection day, bag number, order total and order status.
• Payment information — card payments are processed by Stripe. We do not store your full card number on our systems; Stripe handles payment details securely.
• Marketing preferences — whether you opted in to hear about future pre-order seasons and bakery news. Marketing emails are sent by Loafi only.
• Technical data — basic server and security logs from our hosting provider, privacy-friendly website analytics (see below), and cookies or local storage needed to run the site (see Cookies below).

Under UK GDPR we need a lawful basis for each use of personal data. The main bases we rely on are:

• Contract — to take and fulfil your pre-order, send order confirmations, and manage collection.
• Legitimate interests — to operate and secure the website, prevent fraud, and keep business records. We balance these interests against your rights.
• Consent — where you tick the box to receive marketing from Loafi about future seasons. You can withdraw consent at any time by contacting us.
• Legal obligation — where we must keep records for tax, accounting or regulatory purposes.

We use trusted service providers (data processors) who process personal data on our instructions and only as needed to provide their service:

• Stripe — payment processing (stripe.com/privacy).
• Neon — database hosting in the EU for orders and reservations (neon.tech/privacy-policy).
• Amazon Web Services (SES) — transactional email such as order confirmations, sent from the EU (Ireland) region where configured (aws.amazon.com/privacy).
• Microsoft Azure — website hosting and secure file storage for operational exports (privacy.microsoft.com).
• Umami — privacy-friendly website analytics (page views and referrers). Umami is configured not to use tracking cookies; see umami.is/privacy.
• Drystone IT — website development and technical support, where access is required to maintain the site.

Our primary order database is hosted in the EU (Neon). Some providers may also process data in the United States or other countries. Where data is transferred outside the UK, we rely on appropriate safeguards such as UK adequacy regulations or standard contractual clauses.

We do not sell your personal data. We may disclose information if required by law or to protect our legal rights.

We keep personal data only as long as necessary:

• Order and customer records — for as long as needed to fulfil orders, handle queries, and meet tax and accounting requirements (typically up to six years for financial records unless a longer period is required by law).
• Marketing contacts — until you ask us to remove you or withdraw consent. We do not share our marketing list with third parties.
• Unpaid basket reservations — until the reservation expires (about 15 minutes) or the order completes.
• Payment records — as held in Stripe according to their retention policies and our business needs.

Under UK data protection law you may have the right to access, rectify, erase, restrict or object to certain processing, and to data portability where applicable. Where we rely on consent, you may withdraw it at any time.

You also have the right to lodge a complaint with the Information Commissioner's Office (ICO) at ico.org.uk if you are unhappy with how we handle your data.

To exercise your rights, email us at the address above. We may need to verify your identity before responding.

Our site uses cookies and browser storage to work properly:

• Shopping basket — local storage to remember items in your basket until you checkout or clear it.
• Checkout — session storage to remember your contact details during a visit.
• Stripe — cookies and storage when you pay, as required by Stripe's payment service.

We also use Umami for privacy-friendly analytics (for example which pages are visited and roughly where visitors come from). Umami does not set tracking cookies for this purpose. We use this under legitimate interests to understand how the site is used and improve it.

You can control cookies through your browser settings. Blocking essential cookies may prevent checkout from working.

We use HTTPS and reputable cloud providers. No online service is completely secure, but we take reasonable steps to protect your information.

Our pre-order service is not directed at children under 13. We do not knowingly collect personal data from children. If you believe a child has provided us with personal data, please contact us and we will delete it.

We may update this policy from time to time. The date at the top shows when it was last revised. Material changes will be reflected on this page.