Privacy Policy
Last updated: 1 July 2025
1. Introduction
("we", "us", "our") operates the website celestariqovessa.com and the bakery premises located at . We are committed to protecting the personal data of every person who visits our website, contacts us, or does business with us.
This Privacy Policy explains what personal data we collect, why we collect it, how we use it, with whom we share it, and what rights you have in relation to it. It applies to all personal data processed by us as data controller and has been prepared in accordance with the UK General Data Protection Regulation (UK GDPR) and the Data Protection Act 2018.
Please read this policy carefully. If you have any questions, you can reach us at any time using the contact details set out in Section 13.
2. Data Controller
The data controller responsible for your personal data is:
| Legal entity | |
|---|---|
| Registered address | |
| Company registration number | 16874251 |
| VAT number | GB 492681735 |
| Privacy contact email | privacy@celestariqovessa.com |
3. Personal Data We Collect
We collect personal data in the categories described below. We only collect what is necessary for the purposes set out in this policy.
3.1 Contact and Enquiry Data
When you contact us by email, through our website contact form, or by post, we collect:
- Your name
- Your email address
- Any other personal data you include in your message or enquiry
3.2 Order and Transaction Data
When you place an order with us (whether online or in person), we collect:
- Your name and contact details (email address and, where provided, postal address)
- Details of the products you have ordered
- Billing and payment information processed via our payment provider
- Delivery address, where applicable
3.3 Device and Technical Data
When you visit our website, certain technical data is collected automatically by our web server and any analytics tools we use. This may include:
- Your IP address
- Browser type and version
- Operating system
- Referring URL
- Pages visited and time spent on those pages
- Date and time of your visit
3.4 Cookie and Consent Data
Our website uses cookies and similar tracking technologies. When our cookie banner is displayed, we record your consent preferences. The data stored in connection with cookies may include:
- A record of whether you accepted or declined optional cookies
- The date and time your consent was recorded
- Your IP address at the time consent was given
Please see Section 8 for further information about cookies.
4. Purposes and Legal Bases for Processing
The table below sets out the purposes for which we use your personal data and the legal basis under the UK GDPR that we rely upon in each case.
| Purpose | Categories of data used | Legal basis (UK GDPR) |
|---|---|---|
| Responding to your enquiries and communications | Contact and enquiry data | Article 6(1)(b): necessary to take steps at your request prior to entering a contract; or Article 6(1)(f): our legitimate interest in providing good customer service |
| Processing and fulfilling orders | Order and transaction data | Article 6(1)(b): necessary for the performance of a contract with you |
| Sending you order confirmations and updates | Contact and order data | Article 6(1)(b): necessary for the performance of a contract with you |
| Keeping accounting and tax records | Order and transaction data | Article 6(1)(c): necessary to comply with a legal obligation |
| Analysing how our website is used and improving it | Device and technical data | Article 6(1)(f): our legitimate interest in maintaining and improving our website |
| Managing cookie preferences and recording consent | Cookie and consent data | Article 6(1)(c): necessary to comply with our legal obligations under PECR; or Article 6(1)(f): legitimate interest in demonstrating compliance |
| Sending you marketing communications (where you have subscribed) | Contact data | Article 6(1)(a): your consent |
| Preventing fraud and ensuring the security of our website | Device and technical data; contact data | Article 6(1)(f): our legitimate interest in keeping our systems and customers secure |
| Establishing, exercising or defending legal claims | All categories as relevant | Article 6(1)(f): our legitimate interest in protecting our legal rights |
4.1 Legitimate Interests
Where we rely on our legitimate interests, we have assessed those interests against your rights and freedoms and are satisfied that our interests do not override yours. You have the right to object to processing based on legitimate interests; please see Section 9 for details.
4.2 Consent
Where we rely on your consent (for example, for optional cookies or marketing emails), you may withdraw that consent at any time without affecting the lawfulness of processing carried out before withdrawal. To withdraw consent, please contact us at privacy@celestariqovessa.com or use the unsubscribe link in any marketing email we send you.
5. Recipients and Disclosure of Personal Data
We do not sell your personal data. We may share your personal data with third parties only in the circumstances described below.
5.1 Service Providers
We use carefully selected third-party service providers to help us operate our business and website. These providers act as data processors on our behalf and are permitted to use your data only on our instructions. They include providers in the following categories:
- Website hosting and infrastructure providers
- Payment processing providers (we do not store your full card details ourselves)
- Email delivery providers
- Website analytics providers
- IT support and security providers
All such providers are bound by contractual obligations to keep your data confidential and to process it only as directed by us.
5.2 Legal and Regulatory Disclosure
We may disclose your personal data to courts, regulators, law enforcement agencies, or other public authorities where we are required to do so by law, or where such disclosure is necessary to protect our legal rights or those of third parties.
5.3 Business Transfers
In the event that we sell or transfer all or part of our business, your personal data may be transferred to the purchaser or transferee as part of that transaction. We will take reasonable steps to ensure that any such transfer is carried out in compliance with applicable data protection law.
6. International Transfers of Personal Data
We are based in the United Kingdom and we aim to store and process your personal data within the UK and the European Economic Area (EEA). If any service provider we use transfers personal data to a country outside the UK or EEA that does not benefit from an adequacy decision, we ensure that appropriate safeguards are in place, such as the International Data Transfer Agreement approved by the Information Commissioner's Office, or Standard Contractual Clauses approved by the European Commission, before any such transfer takes place.
If you would like further information about the safeguards we rely upon for any such transfers, please contact us at privacy@celestariqovessa.com.
7. Retention of Personal Data
We retain your personal data only for as long as is necessary for the purposes for which it was collected, or as required by law. The following table provides guidance on our general retention periods.
| Category of data | Retention period | Reason |
|---|---|---|
| Contact and enquiry data | 2 years from the date of last contact | To manage ongoing correspondence and customer relationships |
| Order and transaction data | 7 years from the date of the transaction | To comply with HMRC accounting and tax record-keeping obligations |
| Device and technical data (website logs) | Up to 12 months | Security monitoring and website improvement |
| Cookie and consent records | Up to 2 years from the date consent was recorded | Demonstrating compliance with PECR |
| Marketing preferences | Until you withdraw consent or unsubscribe | Sending communications only to those who wish to receive them |
Once the applicable retention period has expired, personal data is securely deleted or anonymised. In some cases, we may retain data for longer if required by law or if needed to resolve a dispute or enforce our agreements.
9. Security of Personal Data
We take the security of your personal data seriously. We have put in place appropriate technical and organisational measures to protect your data against accidental loss, unauthorised access, alteration, or disclosure. These measures include:
- Encrypted transmission of data over our website using HTTPS
- Access controls that limit who within our organisation can access personal data
- Secure storage practices for data held on our systems
- Contractual obligations on third-party service providers to maintain appropriate security measures
Where we have given you (or where you have chosen) a password or access credential to any part of our website or online ordering system, you are responsible for keeping that credential confidential.
No method of transmission over the internet or electronic storage is completely secure. While we strive to use commercially acceptable means to protect your personal data, we cannot guarantee absolute security. In the event of a personal data breach that is likely to result in a risk to your rights and freedoms, we will notify the Information Commissioner's Office (ICO) and, where required, you personally, in accordance with our obligations under the UK GDPR.
10. Your Data Protection Rights
Under the UK GDPR and the Data Protection Act 2018, you have the following rights in relation to your personal data. You may exercise any of these rights by contacting us at privacy@celestariqovessa.com. We will respond to your request within one month of receipt. If your request is complex or numerous, we may extend this period by a further two months, in which case we will inform you of the extension.
| Right | What it means |
|---|---|
| Right of access | You have the right to request a copy of the personal data we hold about you, together with information about how we use it. |
| Right to rectification | You have the right to ask us to correct personal data that is inaccurate or to complete data that is incomplete. |
| Right to erasure | In certain circumstances, you have the right to ask us to delete your personal data. This right does not apply where we are required to keep the data by law or for the exercise of legal claims. |
| Right to restriction of processing | In certain circumstances, you have the right to ask us to restrict the processing of your personal data so that it is retained but not used. |
| Right to data portability | Where processing is based on your consent or on a contract and is carried out by automated means, you have the right to receive your personal data in a structured, commonly used and machine-readable format, and to have it transmitted to another controller where technically feasible. |
| Right to object | You have the right to object to processing that is based on our legitimate interests. We will cease processing unless we can demonstrate compelling legitimate grounds that override your interests, rights and freedoms, or unless the processing is necessary for the establishment, exercise or defence of legal claims. You have an absolute right to object to processing for direct marketing purposes. |
| Right to withdraw consent | Where processing is based on your consent, you have the right to withdraw that consent at any time. Withdrawal does not affect the lawfulness of processing carried out before withdrawal. |
| Right not to be subject to automated decision-making | You have the right not to be subject to a decision based solely on automated processing (including profiling) that produces legal or similarly significant effects on you. We do not carry out such automated decision-making. |
We will not charge a fee for responding to your request, unless it is manifestly unfounded or excessive, in which case we may charge a reasonable fee or refuse to act on the request.
To protect your privacy and security, we may ask you to verify your identity before we action any request.
11. Complaints
If you believe that we have not handled your personal data in accordance with applicable law, we encourage you to contact us in the first instance so that we can try to resolve the matter. You can do so at privacy@celestariqovessa.com.
You also have the right to lodge a complaint at any time with the Information Commissioner's Office (ICO), the supervisory authority for data protection in the United Kingdom:
- Website: ico.org.uk
- Telephone: 0303 123 1113
- Post: Information Commissioner's Office, Wycliffe House, Water Lane, Wilmslow, Cheshire, SK9 5AF
We would, however, appreciate the opportunity to address your concerns before you approach the ICO and ask that you contact us first.
12. Third-Party Links
Our website may contain links to third-party websites. This Privacy Policy applies solely to celestariqovessa.com and to personal data collected by us. We are not responsible for the privacy practices of any third-party websites and we encourage you to read their privacy policies before submitting any personal data to them.
13. Changes to This Privacy Policy
We may update this Privacy Policy from time to time to reflect changes in our practices, technologies or legal requirements. When we make material changes, we will update the "Last updated" date at the top of this page and, where appropriate, notify you by email or by a prominent notice on our website. We encourage you to review this policy periodically.
14. Contact Us
If you have any questions, concerns or requests relating to this Privacy Policy or to the personal data we hold about you, please contact our privacy team:
| privacy@celestariqovessa.com | |
| Post |
|
We aim to respond to all privacy enquiries promptly and within the timeframes required by applicable law.