Last updated: January 2026
 

1. Introduction

Welcome to Crust & Cloud.

Crust & Cloud is a home bakery business operated by VANDERWALT LTD, trading as Crust & Cloud (“we”, “us”, “our”). We specialise in home-baked cakes, cupcakes, tarts and sweet treats, available for collection or shipped nationwide* across the United Kingdom.

We are committed to protecting and respecting your privacy. This Privacy Policy explains how we collect, use and protect your personal data when you visit our website, place an order, or otherwise interact with us.

We process personal data in accordance with the UK General Data Protection Regulation (UK GDPR) and the Data Protection Act 2018.
 

2. Who We Are

Data Controller:
VANDERWALT LTD
Trading as: Crust & Cloud
Registered in England and Wales

If you have any questions about this policy or your personal data, please contact:
📧 Email: info@crustandcloud.co.uk
 

3. Information We Collect
 

3.1 Information You Provide to Us

When you place an order, create an account, or contact us, we may collect:

• Full name

• Billing address

• Delivery address

• Email address

• Telephone number

• Order details (including products purchased)

• Personal messages included with gift orders

• Any information you provide via contact forms or email
   

3.2 Payment Information

Payments are processed securely via third-party payment providers. We do not store full card details. Payment processors may collect and process payment data in accordance with their own privacy policies.
 

3.3 Website Usage Data

We may automatically collect:

• IP address

• Browser type and version

• Device information

• Pages visited

• Time spent on pages

• Referring website

This information is collected via cookies and analytics tools.
 

4. How We Use Your Information

We use your personal data to:

• Process and fulfil your orders

• Arrange delivery across the UK

• Communicate with you regarding your order

• Respond to enquiries

• Provide customer support

• Send order confirmations and updates

• Improve our website and customer experience

• Comply with legal and accounting obligations

If you opt in to marketing communications, we may send you updates, promotions, or product news. You can unsubscribe at any time.
 

5. Lawful Basis for Processing

We process your personal data under the following lawful bases:

• Contractual necessity – to fulfil your order

• Legal obligation – for tax and accounting requirements

• Legitimate interests – to improve our services and prevent fraud

• Consent – for marketing communications (where applicable)
   

6. Sharing Your Information

We only share your personal data where necessary, including with:

• Payment processors

• Delivery and courier services

• Website hosting providers

• IT and technical service providers

• Accountants or legal advisers (where required)

All third parties are required to respect the security of your personal data and to treat it in accordance with the law.

We do not sell your personal data.
 

7. Cookies

Our website uses cookies to:

• Ensure proper website functionality

• Remember preferences

• Analyse website traffic

• Improve performance

You can control cookie preferences through your browser settings. Disabling certain cookies may affect website functionality.
 

8. Data Retention

We retain personal data only for as long as necessary to:

• Fulfil orders

• Meet legal, tax and accounting obligations

• Resolve disputes

Typically, order information is retained for up to 6 years to comply with UK tax law.
 

9. Data Security

We take appropriate technical and organisational measures to protect your personal data, including:

• Secure website encryption (SSL)

• Restricted access to personal data

• Use of secure third-party payment processors

However, no online transmission is completely secure, and we cannot guarantee absolute security.
 

10. Your Rights

Under UK data protection law, you have the right to:

• Access the personal data we hold about you

• Request correction of inaccurate information

• Request deletion of your personal data

• Object to or restrict certain processing

• Withdraw consent (where processing is based on consent)

• Request transfer of your data

To exercise any of these rights, please contact us at:
📧 info@crustandcloud.co.uk

You also have the right to lodge a complaint with the Information Commissioner’s Office (ICO) at www.ico.org.uk.
 

11. Third-Party Links

Our website may contain links to third-party websites. We are not responsible for the privacy practices of those websites.
 

12. Children’s Privacy

Our website and products are not intended for children under 16. We do not knowingly collect personal data from children.
 

13. Changes to This Policy

We may update this Privacy Policy from time to time. Updates will be posted on this page with a revised “Last updated” date.