GDPR & Your Data

Our promise

We collect the minimum personal data needed to sell you cookie dough and get it to your door. We never sell it, we don't run tracking pixels, and you can get a copy or a deletion at any time — just ask.

The personal data we process, and why (GDPR Art. 6)

• Name, email, phone, delivery address, postcode — to deliver your order and contact you about it. Legal basis: performance of a contract.
• Payment reference — to reconcile payments made through Stripe and keep accounting records. Legal basis: legal obligation (tax) and contract.
• Order history — to keep legally required accounting records for six years. Legal basis: legal obligation. After that, automatic deletion.
• Connection country — a one-off IP lookup to tell whether we deliver to your region; kept in your browser only, the address is not stored. Legal basis: legitimate interests.
• Marketing (if you opt in) — only with your consent, withdrawn any time with one click or a reply.

Your rights under UK GDPR

• Be told what data we hold (access)
• Have inaccurate data corrected (rectification)
• Have your data deleted where we have no overriding legal duty to keep it (erasure)
• Restrict or object to processing, including for direct marketing
• Receive your data in a portable format (data portability)
• Withdraw consent at any time where consent is the legal basis
• Complain to the ICO (ico.org.uk)

To exercise any right, email hello@prodough.co.uk. We respond within one month and will not put you through hoops.

Data subjects under 18

We do not knowingly collect data from children. If a child has placed an order without a parent's involvement, contact us and we will refund and delete the personal data.

Security & breaches

Data is stored in a Supabase database with row-level security, and payment card data never touches our servers — Stripe handles it. We keep access limited to the people who pack and deliver orders. If a breach is likely to risk your rights, we will notify you and the ICO within 72 hours.

Processors we rely on

• Stripe (payments) — processes your card and gives us the order details needed for delivery and accounting.
• Supabase (database hosting) — stores order records under our instruction.
• Hosting / CDN — serves the website itself.

Cookies

This site does not use analytics, advertising, or social media trackers. Only strictly necessary cookies and local storage are used (cart, cookie-notice acknowledgement, staff sign-in). See the Privacy Policy for the full cookie list.