The Cake Solution Customer Privacy Notice

Last updated: August 2026

1. About this Privacy Notice

The Cake Solution respects your privacy and is committed to protecting your personal information.

This Privacy Notice explains how we collect, use, store and share personal information when you:

• visit or purchase from one of our stores;
• use our website, online ordering services or digital services;
• join or use The Cake Solution Loyalty Programme;
• use a voucher, reward, promotion or other customer offer;
• contact our Customer Services team;
• communicate with us by telephone, email, social media or otherwise;
• participate in competitions, surveys or promotions;
• visit premises where CCTV is in operation; or
• otherwise interact with The Cake Solution.

It also explains your rights under UK data protection law.

2. Who we are

The data controller responsible for your personal information is:

The Sweet Patch Limited trading as The Cake Solution
Company number: 03454557
Unit A2 Daleside Road
Colwick
Nottingham
NG2 4DH
United Kingdom

Email: [email protected]
Telephone: 0115 985 1161

References in this Privacy Notice to “The Cake Solution”, “TCS”, “we”, “our” or “us” mean The Sweet Patch Limited trading as The Cake Solution.

Some Cake Solution branded stores may be operated by franchise partners. Where a franchise partner separately determines how and why your personal information is processed, that franchise partner may also be a data controller in respect of that processing.

3. The personal information we may collect

Identity and contact information

• your name;
• postal or billing address;
• email address;
• telephone or mobile number;
• date of birth;
• age or age range;
• other information used to identify you or your customer account.

Loyalty Programme information

• your Loyalty Programme membership details;
• membership number, digital wallet identifier or QR code;
• points earned or redeemed;
• rewards and vouchers issued or used;
• account registration information;
• membership history;
• stores at which your membership has been used;
• purchase history associated with your membership;
• account changes;
• suspected duplicate accounts;
• information concerning compliance with our Loyalty Programme Terms and Conditions; and
• suspected misuse of an account, rewards, points, vouchers or promotions.

Transaction information

• products purchased;
• date, time and location of purchases;
• amounts paid;
• payment method;
• discounts, vouchers or rewards used;
• till and transaction records;
• order numbers;
• refunds;
• cancelled transactions;
• attempted transactions;
• discrepancies relating to transactions.

We do not normally retain complete payment card details ourselves where payment processing is carried out by an authorised payment service provider.

Online order information

• products ordered;
• collection location;
• payment status;
• order history;
• order correspondence;
• information required to fulfil, amend, investigate or refund an order.

CCTV and security information

When you visit our stores or other premises, CCTV may record:

• your image;
• your actions while on the premises;
• the date and time of your visit;
• interactions involving products, staff or other customers;
• incidents involving suspected theft, fraud, anti-social behaviour, threats, accidents or other security matters.

Customer service and correspondence information

This may include information you provide when:

• making a complaint;
• making an enquiry;
• contacting us by telephone;
• sending us an email;
• contacting us using social media;
• corresponding with one of our stores;
• submitting feedback.

We may keep a record of the communication and information necessary to investigate or resolve the matter.

We do not routinely record telephone conversations unless you are informed that a call is being recorded.

Technical and online information

• IP address;
• browser and device information;
• operating system;
• website activity;
• pages viewed;
• links selected;
• approximate location derived from technical information;
• cookie and similar technology identifiers.

Further information about cookies and similar technologies should be read together with our Cookie Notice and cookie preference controls.

Marketing information

• whether you have agreed to receive marketing;
• marketing preferences;
• interactions with marketing communications;
• promotions or offers provided to you;
• responses to competitions, surveys or promotional activity.

4. Where we obtain personal information

Directly from you

For example when you:

• join the Loyalty Programme;
• create an online account;
• place an order;
• make a purchase;
• redeem a reward;
• contact us;
• enter a competition;
• respond to a survey;
• subscribe to marketing.

From your use of our services

• till transactions;
• loyalty activity;
• online orders;
• website activity;
• voucher or promotional activity;
• CCTV.

From other Cake Solution records

Where reasonably necessary, we may search, compare or cross-reference information held in our customer, transaction, Loyalty Programme, online ordering or security systems.

This may be necessary to:

• identify or correct duplicate customer records;
• maintain accurate customer information;
• investigate a transaction;
• resolve a complaint;
• investigate suspected misuse of a loyalty membership, reward or promotion;
• identify someone reasonably believed to have been involved in an incident;
• investigate suspected fraud, theft or other unlawful activity;
• protect our customers, colleagues, property and business.

Any such search or comparison must have a legitimate business purpose and must be proportionate to that purpose.

From service providers

We may receive information from companies providing services such as:

• payment processing;
• loyalty programme technology;
• website hosting;
• online ordering;
• email or messaging;
• security;
• fraud prevention;
• analytics;
• professional services.

From publicly available sources or authorities

• the police;
• law enforcement;
• courts;
• regulatory authorities;
• legal representatives;
• insurers;
• publicly available sources.

5. Why we use your personal information

UK data protection law requires us to have a lawful basis for processing personal information.

Depending on the circumstances, we may rely upon:

• Contract — where processing is necessary to provide a product, service or membership that you have requested.
• Legal obligation — where processing is necessary for us to comply with the law.
• Consent — where you have given us a specific and freely given permission, such as certain forms of electronic marketing.
• Legitimate interests — where processing is reasonably necessary for our legitimate business interests or those of another person, provided those interests are not overridden by your rights and interests.
• Recognised legitimate interests — where processing is necessary for one of the purposes specifically recognised by UK data protection law, including the prevention, detection or investigation of crime.

Where applicable, other lawful bases provided by UK data protection law may also apply.

6. Providing products and services

We may use your information to:

• process purchases;
• fulfil orders;
• process payments;
• arrange collections;
• process refunds;
• answer questions relating to an order;
• administer vouchers and promotions;
• provide customer support.

Our lawful bases will normally be contract, legal obligation and, where appropriate, legitimate interests.

7. Loyalty Programme

We use personal information to operate and protect The Cake Solution Loyalty Programme.

This includes:

• creating and administering memberships;
• awarding and redeeming points;
• providing rewards and vouchers;
• communicating important membership information;
• verifying membership information;
• maintaining accurate membership records;
• investigating duplicate memberships;
• identifying and correcting account errors;
• investigating suspected misuse of membership accounts;
• investigating misuse of points, rewards, vouchers or promotions;
• detecting and addressing non-compliance with the Loyalty Programme Terms and Conditions;
• preventing customers obtaining benefits contrary to the applicable terms.

The Loyalty Programme permits only the number of memberships specified in the applicable Loyalty Programme Terms and Conditions.

Where we reasonably believe that more than one account may relate to the same individual, we may compare relevant account information to establish whether the Loyalty Programme Terms and Conditions have been complied with.

We may also suspend, restrict, merge, correct or terminate memberships where permitted by the Loyalty Programme Terms and Conditions.

Our lawful bases may include contract and legitimate interests, including our legitimate interests in protecting the integrity of the Loyalty Programme, preventing misuse and ensuring rewards are issued fairly.

Where activity gives rise to a genuine suspicion of criminal conduct, the crime condition under recognised legitimate interests may also apply.

8. Transaction discrepancies and investigations

Occasionally there may be a discrepancy between:

• an item selected or taken;
• an item scanned;
• an item recorded by the till;
• the amount paid;
• a voucher or reward used; or
• information recorded on a customer account.

Where we reasonably identify a transaction discrepancy, we may use relevant information available to us to establish what happened and resolve the matter.

This may include reviewing and comparing:

• till records;
• receipts;
• transaction information;
• Loyalty Programme records;
• customer account details;
• order information;
• voucher or reward records;
• CCTV;
• customer correspondence;
• relevant security or incident information.

Where reasonably necessary, authorised colleagues may use customer account or contact information to identify or contact a customer in connection with the investigation or resolution of such a discrepancy.

The fact that contact information was initially collected in connection with an order or membership does not prevent us from using it for another compatible and lawful purpose where UK data protection law permits us to do so.

Our lawful basis will depend upon the circumstances.

For ordinary transaction errors or enforcement of contractual terms, we may rely on contract or legitimate interests.

Where processing is necessary to prevent, detect or investigate suspected crime, including suspected theft or fraud, we may rely on the recognised legitimate interest relating to the prevention, detection or investigation of crime.

We will only access or use information that we reasonably consider necessary and proportionate for the investigation.

9. Prevention, detection and investigation of crime

We have a legitimate need to protect:

• our customers;
• our colleagues;
• our stores;
• our stock;
• our property;
• our systems;
• our Loyalty Programme;
• our business.

We may therefore process personal information where necessary to prevent, detect or investigate suspected criminal activity.

This may include suspected:

• theft;
• fraud;
• attempted fraud;
• dishonest misuse of loyalty accounts;
• payment fraud;
• voucher or reward fraud;
• criminal damage;
• threats or violence;
• other unlawful activity affecting our customers, staff or business.

For these purposes we may use and compare relevant:

• CCTV footage;
• transaction records;
• receipts;
• loyalty account information;
• names;
• contact information;
• online order information;
• incident information;
• customer correspondence.

Where reasonably necessary for a genuine crime-prevention, detection or investigation purpose, authorised staff may search our records to identify a person involved in an incident and may use contact information held by us to contact that person about the incident.

Our lawful basis for processing that is necessary for the prevention, detection or investigation of crime may be the UK GDPR recognised legitimate interest crime condition.

Reliance on this lawful basis does not remove our other obligations under data protection law. Any processing must still be necessary, proportionate, fair and appropriately secure.

10. CCTV

CCTV is used at Cake Solution premises for purposes which may include:

• protecting customers and colleagues;
• protecting our premises and stock;
• maintaining security;
• preventing and detecting crime;
• investigating suspected theft, fraud or other incidents;
• investigating transaction discrepancies;
• investigating accidents;
• establishing, exercising or defending legal claims.

CCTV is not used for indiscriminate monitoring of customers.

Access to CCTV is restricted to people who reasonably require access for their role or for an authorised investigation.

CCTV footage will normally be retained for no longer than 31 days.

However, where footage is required in connection with an investigation, suspected crime, accident, complaint, insurance matter, disciplinary matter, regulatory matter or legal claim, the relevant footage may be securely retained for longer until the matter has been concluded and for any further period reasonably necessary to meet legal, insurance or evidential requirements.

CCTV may be disclosed where necessary to police, law enforcement, insurers, legal advisers, courts, regulatory authorities or other parties where required or permitted by law.

11. Customer complaints and enquiries

We use personal information to:

• respond to enquiries;
• investigate complaints;
• establish what happened;
• communicate with customers;
• provide refunds or goodwill remedies where appropriate;
• protect our legal rights;
• establish, exercise or defend legal claims.

Where a complaint relates to a particular purchase or incident we may compare the complaint with relevant transaction records, CCTV, loyalty information, orders, correspondence, staff records and security information.

Our lawful bases may include contract, legitimate interests, legal obligation and the establishment, exercise or defence of legal claims where applicable.

12. Marketing

Where permitted by law, we may use your contact information to send information about:

• products;
• new products;
• stores;
• offers;
• rewards;
• events;
• promotions;
• competitions;
• other Cake Solution news.

Where consent is required, we will obtain it.

You can withdraw your consent or opt out of direct marketing at any time by using the unsubscribe facility contained in our marketing communications or by contacting [email protected].

Stopping marketing does not prevent us from contacting you about non-marketing matters such as orders, account security, Loyalty Programme administration, complaints or investigations where we have another lawful basis to do so.

13. Personalisation, analytics and advertising

We may analyse customer and transaction information to understand:

• which products are popular;
• customer purchasing patterns;
• store performance;
• promotion performance;
• Loyalty Programme usage;
• website usage;
• customer preferences.

Where possible, information used for general statistical reporting will be aggregated or anonymised.

Where we use identifiable information for advertising, personalisation or analytics, we will have an appropriate lawful basis and will comply with applicable rules concerning cookies and electronic marketing.

Where advertising technologies require consent, they will not be activated until the relevant consent has been obtained.

14. Who we share personal information with

We do not sell customer personal information.

We may share information where reasonably necessary with carefully selected organisations that provide services to us, including:

• payment service providers;
• website and hosting providers;
• Loyalty Programme technology providers;
• online ordering providers;
• IT and software suppliers;
• email and communication providers;
• data storage providers;
• security providers;
• accountants;
• auditors;
• insurers;
• solicitors and other professional advisers;
• marketing and analytics providers, where permitted;
• franchise partners where relevant to your transaction or complaint.

Service providers processing information on our behalf must process it in accordance with our instructions and applicable data protection requirements.

15. Police, law enforcement and legal disclosures

We may disclose personal information to the police, law enforcement authorities, courts, regulatory bodies, government authorities, insurers or legal advisers where the disclosure is:

• required by law;
• necessary to comply with a valid legal request;
• necessary to establish, exercise or defend legal rights;
• necessary and proportionate for the prevention, detection or investigation of crime; or
• otherwise permitted by data protection law.

We will consider the necessity and proportionality of a disclosure before providing information unless the law requires us to disclose it.

16. International transfers

Some organisations that provide technology or other services to us may process personal information outside the United Kingdom.

Where personal information is transferred internationally, we will ensure that an appropriate transfer mechanism or safeguard is in place where one is required.

This may include:

• transfer to a country recognised by the UK as providing an adequate level of protection;
• use of an approved UK international data transfer agreement or UK Addendum;
• another legally permitted transfer mechanism.

Where appropriate we may also implement additional technical, contractual or organisational safeguards.

17. How long we keep your information

We do not retain personal information indefinitely.

Retention periods depend upon why information was collected, legal obligations, operational requirements and whether information is required in connection with an investigation or legal claim.

CCTV

Normally up to 31 days, unless footage is required for an incident, investigation or claim.

Transaction and accounting information

Normally up to 7 years, where necessary for accounting, tax, fraud investigation, dispute resolution or legal claims.

Loyalty Programme information

Normally while your membership remains active and for a reasonable period afterwards to administer closure, investigate misuse, deal with disputes and comply with legal obligations.

Where a membership has been inactive for a prolonged period, information may be deleted or anonymised in accordance with our retention procedures.

Customer complaints

Normally retained for an appropriate period following resolution of the complaint, taking account of the nature of the issue and the possibility of a subsequent claim or regulatory enquiry.

Crime, fraud and security investigations

Information may be retained for as long as reasonably necessary in light of the seriousness of the incident, whether an investigation remains active, repeat incidents, police involvement, legal proceedings, insurance requirements and relevant limitation periods.

Marketing information

Information used for active marketing will be retained while we have an appropriate lawful basis.

If you opt out, we may retain limited information on a suppression list so that we can respect your request not to receive further marketing.

When information is no longer required, it will be securely deleted, anonymised or otherwise disposed of.

18. Keeping personal information secure

We use appropriate technical and organisational measures to protect personal information from unauthorised access, accidental loss, unlawful disclosure, alteration, destruction or misuse.

Measures may include:

• access controls;
• password protection;
• system permissions;
• secure payment processing;
• appropriate technical security;
• staff training;
• restricting information to colleagues who reasonably need it to perform their role.

Employees must not access customer information simply because it is technically available to them. Access must have a genuine and authorised business purpose.

Suspected inappropriate access to customer information may be investigated internally.

19. Your data protection rights

Right of access

You may ask for a copy of personal information we hold about you. This is commonly known as a Subject Access Request.

Right to rectification

You may ask us to correct inaccurate personal information or complete information that is incomplete.

Right to erasure

In certain circumstances you may ask us to delete your personal information. The right to erasure is not absolute. We may retain information where we have a lawful reason or legal obligation to do so.

Right to restriction

In certain circumstances you may ask us to restrict how we use your information.

Right to data portability

In certain circumstances you may request personal information that you provided to us in a structured, commonly used and machine-readable format.

Right to object

You may object to certain processing based on legitimate interests or recognised legitimate interests. We will consider the circumstances and applicable law.

You have an absolute right to object to the use of your personal information for direct marketing.

Right to withdraw consent

Where processing is based on consent, you may withdraw that consent at any time. Withdrawal does not affect processing that was lawful before consent was withdrawn.

Automated decision-making

You may have rights relating to decisions made solely by automated processing that produce legal or similarly significant effects.

We do not currently intend to make significant decisions about ordinary Cake Solution customers solely through automated processing without appropriate safeguards.

20. Exercising your rights

Privacy Team / Customer Services
The Cake Solution
Unit A2 Daleside Road
Colwick
Nottingham
NG2 4DH

Email: [email protected]
Telephone: 0115 985 1161

We may need to ask for information necessary to confirm your identity before releasing personal information.

We will normally respond within the period required by applicable data protection law.

There will normally be no charge. However, where permitted by law, we may charge a reasonable fee or refuse to act on a request that is manifestly unfounded or excessive.

If we refuse a request, we will explain the reason and tell you about your right to complain.

21. Complaints about the use of your information

If you have concerns about the way we have handled your personal information, we would encourage you to contact us first so that we have an opportunity to investigate.

The Cake Solution
Unit A2 Daleside Road
Colwick
Nottingham
NG2 4DH

Email: [email protected]
Telephone: 0115 985 1161

You also have the right to complain to the UK supervisory authority, the Information Commissioner’s Office (ICO).

Further information about making a complaint is available at ico.org.uk.

22. Children and young people

The Cake Solution Loyalty Programme is only available to individuals who meet the minimum age specified in the applicable Loyalty Programme Terms and Conditions.

We do not knowingly invite children below that age to register independently for the Loyalty Programme.

Customers of all ages may naturally visit our stores and may therefore appear incidentally on CCTV.

Where we know that personal information relates to a child or young person, we will take their age and interests into account when determining how that information should be processed.

23. Changes to this Privacy Notice

We may update this Privacy Notice from time to time, including where our services, technology, business, data processing activities, data protection law or regulatory guidance change.

The latest version will be made available through The Cake Solution website.

Where we make a significant change to how we use customer information, we will take reasonable steps to bring that change to the attention of affected customers where appropriate.

Privacy Notice last updated: August 2026

The Sweet Patch Limited trading as The Cake Solution