Privacy policy
Last updated: 4 September 2026
This policy explains what GTM Cakes does with personal data. It covers two different groups of people, and the distinction matters: our customers, who buy cakes from us, and recipients, whose office addresses our customers give us so we can deliver.
Who we are
GTM Cakes is a cake delivery service operating in London. For the purposes of UK GDPR and the Data Protection Act 2018, the data controller is [your registered company name and number, or your own name if you are a sole trader], of [registered address].
For anything about your data, email contact@gtmcakes.com or call +44 7721 441643. We answer within two working hours during office hours.
What we collect and why
If you buy from us
- Your name, email address and phone number. So we can confirm the order, send delivery photos and reach you if something goes wrong. Lawful basis: performance of a contract.
- Your billing address and card details. Handled entirely by Stripe. We never see or store your full card number. Lawful basis: performance of a contract, and legal obligation for the tax record.
- Order records and invoices. Kept for six years, because HMRC requires business records to be retained for that long. Lawful basis: legal obligation.
If someone sends you a cake
If a cake arrives at your desk, we hold your name, business address, and sometimes your work email, because the person who ordered it gave them to us. We use these details only to bake and deliver that one cake, and to email you the day before so reception expects it. We delete them within 30 days of delivery.
We did not choose you. Our customer did. If you would rather we didn't hold your details at all, email us and we'll delete them immediately. No argument, no form to fill in.
If you just visit the website
Nothing, unless you say yes to the cookie banner. We use Google Analytics to count visits, and it only loads after you consent. Decline and no analytics cookies are set. You can change your mind by clearing this site's data in your browser, which brings the banner back.
Who your data is shared with
- Partner bakeries. They get the recipient's name, address and the cake design so they can bake and hand it over. Nothing else.
- Couriers. The delivery address, the recipient name, and any note you left for the driver.
- Stripe. Payment processing. See stripe.com/gb/privacy.
- Google Analytics. Anonymised traffic data, only with your consent.
- [Your email provider: Google Workspace, Resend, whoever sends your order emails]
We do not sell data to anybody, and we don't share recipient lists between customers.
If you are the one supplying the addresses
When you upload or type in a recipient's details, you are the controller of that data and we are your processor. That means you are responsible for having a lawful basis to use their details, usually legitimate interests for B2B contact, but that is your call to make and your risk to carry, not ours. We use what you give us only to fulfil your order.
How long we keep things
- Recipient details: 30 days after delivery, then deleted.
- Order and payment records: six years, for HMRC.
- Enquiry emails: 12 months from your last message.
- Analytics: 14 months. This is the GA4 default; set it to match in your GA property settings.
Where your data lives
Our records are held in the UK and the EEA. Stripe and Google may process data outside the UK, in which case transfers rely on the UK International Data Transfer Agreement or the UK Addendum to the EU Standard Contractual Clauses.
Your rights
Under UK GDPR you can ask us to show you what we hold, correct it, delete it, restrict what we do with it, hand it over in a portable format, or object to us processing it at all. Email contact@gtmcakes.com and we'll respond within one month, usually the same week. It's free.
If we get it wrong, you can complain to the Information Commissioner's Office at ico.org.uk or on 0303 123 1113. We'd rather you told us first so we can fix it, but it's your right either way.
Cookies
We set one small item in your browser's local storage to remember your answer to the cookie banner. That's it unless you consent to analytics, in which case Google Analytics sets its own cookies. No advertising or tracking cookies, ever.
Changes
If we change this policy we'll update the date at the top. If the change is significant and affects existing customers, we'll email you rather than quietly editing the page.