Privacy policy
Last updated: October 2026
Draft: this text must be reviewed and approved by a lawyer before launch. The details in square brackets need completing.
This policy explains what personal data we handle when you pre-order our cinnamon buns, and the rights you have over it.
Who is responsible
The data controller is Andra Bullar — [legal entity], [address], [VAT number]. For any question about this policy, write to [contact email].
What we collect
Your email address, the name you choose, your preferred language, your marketing-email consent, your pre-orders and collections (slot, quantities, the prices at the time of the order), stamps and referral credit, and the internal notes the stall may add to your profile. We also keep minimal technical sign-in and security data, such as the IP address used to rate-limit sign-in attempts.
Why we use it
To sign you in without a password, to run pre-orders and collection, to run stamps and referrals, to prevent abuse of the booking limits, and — only with your consent — to email you about drops and news. Operational emails about your own orders are part of the service and do not depend on marketing consent.
Legal bases
Performance of the pre-order agreement (GDPR art. 6.1.b) for orders and collection, consent (art. 6.1.a) for marketing emails, and legitimate interest (art. 6.1.f) for sign-in security and abuse prevention.
How long we keep it
Your account and order history stay while you keep the account: if you delete it, we erase your personal data and keep only aggregate figures and anything tax law obliges us to retain. Sign-in codes expire within minutes; technical security data is kept briefly.
Who else sees it
Only the providers we need to run the service: our email-sending provider and our hosting and CDN providers. We do not sell your data and we do not use it for advertising profiling.
Your rights
You can access your data, correct it, export it, withdraw marketing consent at any time, and ask us to delete your account. You may also complain to the Italian data protection authority (Garante per la protezione dei dati personali).
Cookies
We use one cookie, a technical one, to keep you signed in. We use no advertising cookies and no third-party tracking cookies. Visit statistics are collected in aggregate, without cookies.
Contact
To exercise your rights, or for any question, write to [contact email]. We answer within the deadlines the GDPR sets.