PRIVACY POLICY
Last updated: 4 August 2026
1. WHO WE ARE
Scandal NY Cookies ("we", "us" and "our") operates https://www.scandalnycookies.com and sells handmade baked goods through the website and other authorised sales channels.
For the purposes of UK data protection law, Scandal NY Cookies is the controller of the personal information described in this Privacy Policy.
You can contact us at:
Scandal NY Cookies
37 Maritime Road
Stockton-on-Tees
TS18 2FZ
United Kingdom
Email: info@scandalnycookies.com
Telephone: 07728 677375
2. SCOPE OF THIS POLICY
This Privacy Policy explains how we collect, use, share and retain personal information when you visit our website, create an account, place an order, sign up for marketing, contact us, enter a promotion, leave a review or otherwise interact with us.
Our website and online checkout are hosted by Shopify. Shopify processes personal information to provide the ecommerce platform and may also process some information for its own purposes, as explained in Shopify's privacy notices. You can read the Shopify Consumer Privacy Policy at https://privacy.shopify.com/en.
3. PERSONAL INFORMATION WE COLLECT
Depending on how you interact with us, we may collect:
- Identity and contact information, such as your name, billing address, delivery address, email address and telephone number.
- Order and transaction information, such as the products you order, selected fulfilment date and method, order value, discounts, order history, collection or delivery details, and any gift message or order note you provide.
- Account information, such as your login details, saved addresses, preferences and account settings.
- Payment information. Payments are handled by Shopify Payments or another payment provider. We do not normally receive or store your full payment-card number or security code. We receive limited payment and transaction information, such as payment status, payment method and transaction reference.
- Communications, such as emails, contact-form messages, telephone enquiries, complaints, reviews and social-media messages sent to us.
- Marketing information, such as whether you have subscribed to marketing and how you interact with our marketing communications.
- Technical and usage information, such as your IP address, browser and device type, cookie identifiers, approximate location, pages viewed, links selected, referring website, and the date and time of your visit.
- Fraud and security information, such as fraud-screening results, login activity and information needed to protect our website, customers and business.
Please do not send us medical information that we do not need. If you voluntarily provide allergy or other health information so that we can respond to an enquiry or assess an order request, we will use it only for that purpose. Where UK data protection law treats that information as special-category data, we will seek and rely on your explicit consent unless another lawful condition applies. You may withdraw that consent, but we may then be unable to deal with the request or fulfil the affected order safely.
4. HOW WE COLLECT PERSONAL INFORMATION
We collect personal information:
- Directly from you, including when you browse the website, create an account, place an order, contact us, subscribe to marketing or leave a review.
- Automatically through our website, cookies and similar technologies.
- From service providers that help us operate our business, including Shopify, payment providers, delivery providers, analytics providers and fraud-prevention services.
- From social-media platforms or other third parties when you interact with our pages, use an integration, enter a joint promotion or permit information to be shared with us.
5. HOW AND WHY WE USE PERSONAL INFORMATION
We use personal information only when we have a lawful basis to do so. The principal purposes and lawful bases are:
To process and fulfil orders
We use identity, contact, order, payment-status and fulfilment information to take payment, confirm orders, prepare products, arrange delivery or collection, provide order updates, and deal with cancellations, refunds or complaints.
Lawful basis: performance of a contract with you, or steps taken at your request before entering into a contract.
To provide customer service
We use contact, order and communication information to answer enquiries, resolve problems and maintain our relationship with customers.
Lawful basis: performance of a contract and our legitimate interests in providing effective customer service and managing our business.
To keep records and comply with the law
We use order, transaction, payment and communication information for accounting, tax, food-safety, product-traceability, legal-claim and regulatory purposes.
Lawful basis: compliance with legal obligations and our legitimate interests in establishing, exercising or defending legal claims.
To protect customers, our website and our business
We use account, technical, transaction and fraud information to authenticate users, secure accounts, detect suspicious transactions, prevent misuse and investigate fraud or other unlawful activity.
Lawful basis: our legitimate interests in protecting customers and our business, and compliance with legal obligations where applicable.
To operate and improve our website and services
We use technical, usage, order and feedback information to understand website performance, fix problems, improve products and services, and plan our business.
Lawful basis: our legitimate interests in operating and improving our business. Where non-essential cookies or similar technologies are used, we rely on consent where required.
To send marketing
We use contact details and marketing preferences to send offers, product news and other promotional communications.
Lawful basis: consent, or our legitimate interests in promoting similar products to existing customers where the electronic-marketing "soft opt-in" is permitted by law. You can unsubscribe at any time using the link in an email or by contacting us.
To personalise content and advertising
Where you consent to the relevant cookies or technologies, we and our advertising partners may use technical, usage and transaction information to measure campaigns and show more relevant content or advertising.
Lawful basis: consent where required by law. You can change your cookie choices at any time through the cookie settings available on our website.
We do not use solely automated decision-making that produces legal or similarly significant effects on you. Shopify, payment providers and fraud-prevention providers may use automated tools to assess transactions; their own privacy notices explain how they use personal information.
6. COOKIES AND SIMILAR TECHNOLOGIES
Our website uses cookies and similar technologies. Some are strictly necessary for functions such as keeping products in your basket, processing checkout, maintaining security and remembering privacy choices. We may also use optional analytics, personalisation and advertising cookies.
Where consent is required, optional cookies will not be set until you make a choice through our cookie banner or cookie settings. You can withdraw or change your consent at any time through the cookie settings on our website. Blocking some cookies may affect how parts of the website work.
7. WHEN WE SHARE PERSONAL INFORMATION
We may share personal information with:
- Shopify and ecommerce service providers that host and operate our online store.
- Payment providers, banks and fraud-prevention providers that process and protect payments.
- Royal Mail, couriers, local delivery providers and collection partners where needed to fulfil an order.
- Website, IT, cloud-storage, analytics, marketing, review and customer-support providers that work for us.
- Accountants, insurers, professional advisers, regulators, law-enforcement bodies, courts and public authorities where reasonably necessary or legally required.
- A buyer, seller or adviser in connection with a genuine sale, transfer or restructuring of all or part of our business, subject to appropriate confidentiality safeguards.
- Other parties where you ask us to share information or give valid consent.
We require service providers acting on our behalf to use personal information only for authorised purposes and to protect it appropriately. Some providers, including Shopify and certain payment, analytics or advertising providers, may also act as independent controllers for particular processing. Their own privacy notices apply to that processing.
We do not sell your personal information for money.
8. INTERNATIONAL TRANSFERS
Some service providers may process personal information outside the United Kingdom. Where personal information is transferred to a country that is not covered by UK adequacy regulations, we use an approved safeguard where required, such as the UK International Data Transfer Agreement, the UK Addendum to approved standard contractual clauses, or another lawful transfer mechanism. You may contact us for more information about the safeguard used for a particular transfer.
9. HOW LONG WE KEEP PERSONAL INFORMATION
We keep personal information only for as long as reasonably necessary for the purpose for which it was collected, including legal, accounting, tax, food-safety, dispute and fraud-prevention requirements. In general:
- Order, invoice and payment records are normally retained for up to six years after the end of the relevant accounting period, or longer where a dispute or legal requirement makes this necessary.
- Customer-service enquiries and complaint records are normally retained for up to two years after the matter is closed, unless they need to be linked to a longer-retained order or legal record.
- Account information is kept while the account remains active and for a reasonable period afterwards, unless you ask us to delete it and no legal reason requires continued retention.
- Marketing contact details are kept until you unsubscribe or we determine that they are no longer accurate or needed. We may keep a minimal suppression record so that we can respect an opt-out request.
- Cookie and analytics data is retained for the periods stated in the relevant cookie settings or provider information.
We may securely delete or anonymise information sooner where it is no longer needed.
10. SECURITY
We use reasonable technical and organisational measures designed to protect personal information against unauthorised access, loss, misuse, alteration or disclosure. No method of transmission or storage is completely secure, so we cannot guarantee absolute security. Please use a strong, unique password and do not share account credentials with anyone.
11. YOUR DATA PROTECTION RIGHTS
Depending on the circumstances and subject to legal exemptions, you may have the right to:
- Ask for access to your personal information.
- Ask us to correct inaccurate or incomplete information.
- Ask us to delete personal information.
- Ask us to restrict how we use personal information.
- Object to certain processing.
- Receive certain information in a portable format or ask us to transfer it.
- Withdraw consent at any time where processing is based on consent.
YOUR RIGHT TO OBJECT
You have an absolute right to object to the use of your personal information for direct marketing. You may also object to processing based on legitimate interests. If you object to legitimate-interest processing, we will stop unless we can demonstrate compelling legitimate grounds to continue or the processing is needed for legal claims.
To exercise a right, email info@scandalnycookies.com. We may need to verify your identity before responding. We normally respond within one month, although the law permits an extension for complex or numerous requests. Rights are not absolute and we will explain if an exemption applies.
12. MARKETING PREFERENCES
You can unsubscribe from marketing emails at any time by using the unsubscribe link in the message or by contacting us. Opting out of marketing will not stop service messages that are necessary for an order, account or customer-service request.
13. CHILDREN
Our website and products are not directed at children, and children should not place orders or provide personal information without the involvement of a parent or guardian. We do not knowingly collect personal information directly from children where this would be unlawful. If you believe a child has provided personal information to us improperly, please contact us so that we can investigate and, where appropriate, delete it.
14. THIRD-PARTY WEBSITES
Our website may link to websites, apps or social-media services operated by other organisations. We do not control their privacy practices. Please read their privacy notices before providing personal information to them.
15. COMPLAINTS
Please contact us first at info@scandalnycookies.com if you have a concern about how we use personal information, so that we have an opportunity to resolve it.
You also have the right to complain to the Information Commissioner's Office (ICO), the UK data protection regulator:
Information Commissioner's Office
Wycliffe House
Water Lane
Wilmslow
Cheshire
SK9 5AF
Telephone: 0303 123 1113
Website: https://ico.org.uk/make-a-complaint/data-protection-complaints/
16. CHANGES TO THIS POLICY
We may update this Privacy Policy when our services, providers or legal obligations change. We will publish the revised version on our website and change the "Last updated" date. Where required, we will provide additional notice or ask for consent.
17. CONTACT US
For questions, requests or complaints about this Privacy Policy or our use of personal information, contact:
Email: info@scandalnycookies.com
Telephone: 07728 677375
Post: Scandal NY Cookies, 37 Maritime Road, Stockton-on-Tees, TS18 2FZ, United Kingdom
