La Patisserie Verte is a home-based artisan patisserie trading in Essex and London, United Kingdom, and is the data controller for the personal data described in this policy. You can reach us at LaPatisserieVerte@gmail.com.

We handle personal data in line with the UK GDPR and the Data Protection Act 2018.

• Personal details — your name, email address, phone number and delivery or collection address.
• Order details — the items you request, quantities, dates, dietary or allergy notes, and any additional notes you add at checkout.
• Account details — if you create an account, your sign-in email (or Google sign-in identity), profile name and loyalty points balance.
• Personalised cupcake quote requests — your brief, event date and any reference images you upload.
• Payment details — processed by our payment provider. We never see or store your full card details.
• Social media interactions — messages, comments and enquiries sent via platforms such as Instagram, Facebook or TikTok.
• Technical data — IP address, browser type and pages visited, used to keep the site secure and working correctly.

• To process and fulfil your orders, quotes and deliveries — contract.
• To communicate with you about an order, quote or enquiry, including order status emails — contract.
• To run your account and loyalty rewards — contract.
• To keep records for tax, accounting and food-safety purposes — legal obligation.
• To improve our products, service and website — legitimate interests.
• To send marketing updates, offers or share examples of our work that identify you — consent, which you may withdraw at any time.

We do not sell or trade your personal information. We share it only with the service providers needed to run the business, where required by law, or with your consent.

• Lovable (lovable.dev) — the platform this website is built and hosted on. Lovable, and the hosting and content-delivery infrastructure it uses, processes the requests you make to this site and stores the site’s data on our behalf.
• Supabase — the database, file storage and authentication service behind the site, provided through Lovable Cloud. Your account, orders, enquiries, quote requests and uploaded reference images are stored here.
• Stripe — our payment processor. Card details are entered directly with Stripe and are never stored by us.
• Google — if you choose to sign in with Google, Google confirms your identity and shares your name and email address with us.
• Email delivery provider — used to send order confirmations, status updates and quote notifications.
• Postcodes.io — a UK postcode lookup used to calculate delivery distance and fees from your postcode.

Some of these providers may process data outside the UK. Where that happens, transfers are protected by appropriate safeguards such as the UK International Data Transfer Addendum or equivalent contractual protections.

This website uses essential cookies and local browser storage to keep you signed in and to remember your basket. Please see our Cookies Policy for the full detail, including how to manage non-essential cookies.

• Order and payment records: six years, as required for UK tax purposes.
• Enquiries and quote requests that do not become orders: up to 24 months.
• Reference images uploaded with a quote: up to 12 months after the quote closes.
• Account and loyalty records: for as long as your account is open, then 12 months.
• Marketing consents: until you withdraw them.

We take appropriate technical and organisational steps to protect your information. Accounts are protected by authentication, database access is restricted by row-level security rules so you can only see your own records, and data is transmitted over encrypted connections.

Under UK data protection law you have the right to:

• Request a copy of the personal information we hold about you.
• Ask us to correct or update your details.
• Ask us to delete your information, unless we must keep it for legal or tax purposes.
• Object to, or ask us to restrict, certain processing.
• Ask us to transfer your data to you or another provider.
• Withdraw your consent to marketing at any time.

To exercise any of these rights, email LaPatisserieVerte@gmail.com. We will respond within one month. If you are unhappy with how we have handled your data you can complain to the Information Commissioner’s Office at ico.org.uk or on 0303 123 1113.

Our website is not directed at children. We do not knowingly collect personal data from anyone under 13, and orders should be placed by an adult.

We use social media to showcase our patisserie. We may post photographs of items we have made, but we will never tag or identify you, or share a personalised design carrying your name or message, without your consent.

We may update this policy from time to time. The current version, with the date it was last updated, will always appear on this page.