Privacy & Cookies

Who we are

The Wheatless Whisk is a small gluten-free bakery run by Kim in Ludlow, Shropshire. We are the "data controller" for the personal information you give us through this website.

Contact: hello@wheatlesswhisk.co.uk
Business: Kimberly Winch, trading as The Wheatless Whisk, Ludlow, Shropshire

What we collect and why

When you…	We collect	Why (lawful basis)
Place a customer pre-order	Name, email, phone, collection place and time, what you ordered, any notes	To make and hand over your order (contract)
Add allergy or dietary notes to an order	The health or dietary information you choose to share	Only with your explicit consent, given with the tick box on the order form, and only to prepare your order safely
Ask for, or use, a trade account	Business name and type, contact name, email, phone, business address, your message; once approved, your password (stored only in scrambled, one-way form), two-step sign-in settings, and a short history of sign-ins to your account	To decide whether we can supply you and to keep your account secure (steps before a contract, then contract and legitimate interests)
Place a wholesale order or set up a regular order	Business name, contact name, email, phone, collection day, what you ordered, your PO number and notes, how you chose to pay, and whether and when you paid	To supply and invoice your business, and to make your regular orders (contract)
Save a card to your trade account	The card type, last 4 digits and expiry date, and a reference (a "token") from SumUp that lets us charge the card for your orders. We never see or store the full card number or security code	To take payment for the orders you ask us to charge to it (contract). You can remove the card at any time in your account
Receive an invoice from us (for example for a celebration cake, an event or catering)	Your name and business name, email, phone and address, what the invoice is for, your reference, and whether and when you paid. If we have invoiced you before, we may keep your contact details in our address book to invoice you again	To bill you for what you asked us to supply (contract) and to keep the business records the law requires (legal obligation)
Send a message through the contact form	Name, email, optional phone, your message	To reply to you (legitimate interests)
Use the website	Your IP address, briefly, to stop spam and abuse	Keeping the site secure (legitimate interests)

We never sell your information, use it for advertising, or add you to a mailing list without asking.

Who else handles it

• IONOS hosts this website and stores order and message records on its servers.
• Microsoft 365 delivers the order and enquiry emails to us and sends your order confirmation and any invoices, receipts and reminders.
• SumUp takes card payments when you choose to pay online. You enter your card details on SumUp's own payment page; they never reach this website. We receive only the payment result and amount. If you save a card to a trade account, SumUp stores the card and gives us a reference to charge it; SumUp may ask your bank to confirm the card.

These companies act only on our instructions under data processing agreements and keep data in the UK or EU, or under approved safeguards.

When you choose a trade account password, we check it hasn't appeared in a known data breach using the Have I Been Pwned service. Only the first 5 characters of a one-way code made from the password are sent, never the password itself, so the service cannot tell what your password is.

How long we keep it

• Website order and message records are deleted automatically after 12 months.
• Invoices, including wholesale orders, are business records, so we keep them for 6 years from the invoice date, as UK tax law (HMRC) requires, and then delete them automatically. Invoices or wholesale orders that haven't been paid are kept until they are paid or cancelled. Because the law requires these records, we can't delete an invoice early if you ask, but we will delete everything else.
• Address book details we keep to invoice you again are deleted after 12 months unless we invoice you again. Invoice drafts we never send are deleted after 12 months.
• Trade accounts are kept while your account is open. Tell us if you'd like it closed and we'll delete it. Requests we decline are deleted after 90 days, and requests or invitations that are never used are deleted after 12 months.
• Abuse-prevention records of IP addresses are kept for minutes, not days.

Your rights

You can ask us to give you a copy of your information, correct it, delete it, or stop using it. You can also withdraw consent for your dietary notes at any time. Email hello@wheatlesswhisk.co.uk and we will reply within one month.

If you're unhappy with how we've handled your information, you can complain to the Information Commissioner's Office at ico.org.uk or on 0303 123 1113.

Cookies

We only use cookies that are strictly necessary for the site to work, so we don't need to ask for your consent and there is no cookie banner. We do not use analytics, advertising or tracking cookies, and no third party sets cookies through this site.

Cookie	What it does	How long
PHPSESSID	Keeps you signed in to the customer portal, your trade account or the baker's control desk while you use the site	Until you close your browser
ww_portal	Remembers that you entered the customer passcode, only if you tick "Keep me unlocked on this device"	90 days, or until the passcode changes
ww_sso	Used only by the baker while signing in with Microsoft	10 minutes

The fonts are stored on this website, so loading a page does not contact Google.

Keeping your information safe

The whole site uses an encrypted (HTTPS) connection. Order records are stored outside the public part of the website, and only the baker can view them, after signing in with two-step verification. Trade accounts also need two-step sign-in, and each trade account can only see its own orders.

Changes

If we change how we use your information, we'll update this page and the date at the top.