Privacy Policy – Heaven in Cardiff

Last updated: 7 November 2026.

Who is responsible for your information?

Heaven in Cardiff’s operator is the controller responsible for the personal information used to run this cake business. The trader’s identity and business address are in our Business information. Email: hello@heavenincardiff.co.uk. Telephone/WhatsApp: 07727 173777.

Information we use and why

When you order or ask about an order, we use your name, email address, telephone number, billing details, delivery address where applicable, cake choices, quantity, extras, card message, delivery or collection date/time, instructions and order correspondence. Please only include information needed for the order and avoid putting sensitive personal information into a card message or delivery note.

Enquiries and orders: we use the information needed to answer a request, make and supply the cake, arrange delivery or collection, take payment and send service messages. The basis is taking steps at your request before a contract and performing that contract.
Business records: we retain necessary sales and payment records to meet tax and accounting obligations. The basis is legal obligation.
Complaints, security and reliability: we use relevant correspondence, order records and technical logs to resolve problems, prevent misuse and keep the shop working. The basis is our legitimate interests in protecting the business and providing a reliable service, balanced against your rights.

Required checkout fields are needed to process or fulfil the order; without them we may be unable to accept it. Optional card messages and optional delivery instructions are your choice. Guest checkout does not require a customer account. Cash is available on collection or delivery. Where card payment is offered, it is processed through Revolut. Please do not send card details by email, message or in an order note.

Technical information can include your IP address, browser information, request time and pages requested. Basket/session information connects your selections with checkout. We do not make decisions with a legal or similarly significant effect on you solely by automated profiling. Availability and price calculations use the choices you enter.

Who receives information?

The business and people authorised to help fulfil your order use only the information needed for their role. Our website is hosted through Porkbun’s Cloud for WordPress service, using WP Cloud infrastructure. The existing SMTP2GO service carries transactional email, including order messages. These services therefore process relevant website or message data to provide their service. Email also reaches the recipient’s email provider. Zoho Mail receives and stores business mail addressed to hello@heavenincardiff.co.uk and supports our replies. Earlier business correspondence may remain in an authorised Gmail inbox for the periods described below.

Where delivery is arranged, the person making it needs the recipient’s name, delivery address, relevant instructions and contact details. We may also disclose records when required by law, or to professional advisers where necessary for tax, a claim or a complaint. We do not sell customer information or use an order email address as permission for unrelated marketing.

Where card payment is offered, Revolut receives relevant payment and transaction information to process and authenticate payments, maintain security and prevent fraud. For more information, see Revolut’s privacy information.

International processing

Our hosting and email services involve international processing, including in the United States. Our Zoho Mail account uses Zoho’s Europe data centre; technical support access can also take place from India. Porkbun’s processing terms include the UK International Data Transfer Agreement. SMTP2GO’s account is hosted in the USA; its processing agreement provides standard contractual clauses and the UK transfer addendum. Zoho describes contractual safeguards for international support access, including standard contractual clauses. Google describes safeguards for its international processing of retained earlier correspondence, including the UK Extension to the EU–US Data Privacy Framework and standard contractual clauses where applicable. You can contact us for information about the safeguards relevant to your data.

How long information is kept

Necessary sales/accounting records are kept for the period required for a sole trader’s tax records: normally at least five years after the 31 January filing deadline for the relevant tax year, and longer where a specific legal requirement or unresolved matter requires it. This does not mean every delivery instruction or card message needs to be kept for that whole period.

We review records monthly. We normally remove non-essential card messages, delivery instructions and routine order correspondence within 90 days after fulfilment, and failed or abandoned order records after 30 days. We first retain the minimum sales information required for our accounting records. Information needed for an open complaint, food-safety matter or legal claim is kept while that matter requires it and reviewed when it is resolved.

This review includes business email and operational copies held on authorised devices. Our own exported security logs are normally reviewed for removal after 30 days unless needed for an incident. Hosting and mail providers have their own operational retention cycles. SMTP2GO normally retains mail metadata for 35 days. We do not use its optional long-term message archive. Hosting recovery backups follow the provider’s backup cycle. Deleted information can remain in protected recovery copies until those copies expire; if a backup is restored, we reapply relevant deletions before returning it to normal use. We do not promise instant deletion from every recovery copy.

Cookies and similar storage

We use storage needed for shopping, checkout and website security. We do not use customer information for marketing, advertising, remarketing, session recordings or optional analytics. There is no newsletter signup. Necessary order confirmations and customer-service messages continue.

Basket cookies — Heaven / WooCommerce: wp_woocommerce_session_… connects your browser to its basket, normally for two days. woocommerce_items_in_cart and woocommerce_cart_hash keep basket contents and totals in step and are session cookies.
Basket cache — Heaven / WooCommerce: local-storage entries storeApiCartData, storeApiCartHash and storeApiNonce support basket display and secure requests. They may include the address you enter for delivery. We clear this browser cache on the next shop visit after two days, and on the order confirmation page. Closing the browser alone may not remove local storage.
Calendar — Heaven / Order Delivery Date: orddd_deliverydate_lite_session, h_deliverydate_lite_session, orddd_lite_time_slot and orddd_lite_storage_next_time remember your requested fulfilment date/time. The calendar checks its two-hour reset period when loaded; our additional shop cleanup removes these entries on the next visit after two days or on order confirmation.
Storage housekeeping: heaven_shop_storage_started records the two-day cleanup period. Browser session storage, if used for checkout state, ends with that browser session.
Security and existing accounts: Porkbun / WP Cloud can challenge suspicious requests to protect the website. Existing WordPress sign-ins use authentication cookies; administrator preference cookies such as wp-settings-* are separate from anonymous shopping.
Card payment — Revolut: Where card payment is offered, Revolut and its security providers use browser technologies to support payment functionality, authentication, security and fraud prevention.

Cake-gallery assets and the shop’s own shopping scripts are served from this website. Where card payment is offered, Revolut’s payment service also supplies payment and security technologies. Instagram, telephone and email links open separate services rather than embedded social feeds. Necessary storage does not require an optional-tracking consent popup. You can remove stored information in your browser’s website-data settings; blocking it may prevent the basket, calendar or checkout from working.

Your choices and rights

Depending on the circumstances, you can ask for access to your personal information, correction, deletion, restriction of use or a portable copy. You can object to processing based on legitimate interests. Some rights have exceptions: for example, we may need to keep tax records even if you ask us to delete them. If we ever rely on consent for an additional purpose, you can withdraw that consent without affecting earlier lawful use.

Use the contact details above to make a request. We may need reasonable information to confirm your identity and locate the relevant record. You can also complain to the Information Commissioner’s Office, the UK data protection regulator, through ico.org.uk/make-a-complaint/ or on 0303 123 1113. You do not have to complain to us first.

Security and other websites

We use HTTPS and restrict administrative access to the shop. No system is completely secure; please do not send payment-card details or passwords in an order note or email. Links to Instagram or other websites take you to services with their own privacy notices.

The checkout and basket collect the information described above. This cake page does not collect or publish customer reviews, and the cake gallery is served by this website rather than embedded from a social network. Links to email, telephone, WhatsApp or Instagram open the relevant separate service; they do not load an embedded feed on the cake page.

This notice will be updated when the business’s use of personal information changes. The date above shows when this notice was last updated.