Privacy Policy

Who We Are

TY Creations Ltd is a private limited company registered in England and Wales. We are the data controller responsible for personal information collected through this website.

For the purposes of UK data protection law — including the UK General Data Protection Regulation (UK GDPR), the Data Protection Act 2018, and the Privacy and Electronic Communications Regulations 2003 (PECR) — TY Creations Ltd is the controller of your personal data.

We are registered with the Information Commissioner's Office (ICO) as a data controller, as required under the Data Protection (Charges and Information) Regulations 2018. If you have any questions about how we handle your personal data, please contact us before submitting a formal request.

What Data We Collect

We collect only the information you voluntarily provide through our enquiry form. This may include:

• Your first and last name
• Your email address
• Your event date
• The type of cake or bake you are enquiring about
• The number of guests or servings required
• Your delivery postcode (transmitted solely to postcodes.io to calculate a delivery estimate; not retained by us beyond the session)
• Any additional details shared in the free-text message field, which may include dietary requirements, food allergies, or design preferences

Where you voluntarily disclose information about food allergies or intolerances, this constitutes special category data under Article 9 UK GDPR. We process this solely to fulfil your order safely and do not use it for any other purpose.

We do not collect payment card details through this website. All payments are handled directly between us by bank transfer or cash.

We do not knowingly collect data from children under the age of 13. If you believe a child has submitted data to us, please contact us immediately and we will securely delete it.

How We Use Your Data

We use the information you provide solely to respond to your enquiry and, where an order is placed, to fulfil that order. Specifically, we use your data to:

• Respond to your cake enquiry by email
• Discuss and confirm order requirements including size, flavour, design, and delivery
• Calculate a delivery cost estimate based on your postcode
• Communicate with you regarding your order, including confirmation, updates, and collection or delivery arrangements
• Accommodate dietary or allergen requirements relevant to your order
• Comply with applicable legal and financial record-keeping obligations

We will not use your data for direct marketing or send promotional communications unless you have explicitly opted in to receive them. You may withdraw that consent at any time by contacting us.

We will never sell, rent, or otherwise commercialise your personal data to any third party.

Automated decision-making and profiling: We do not carry out any automated decision-making or profiling as defined under Article 22 UK GDPR. All decisions relating to your enquiry and order are made by a human being. You are not subject to any decision based solely on automated processing that produces legal or similarly significant effects.

Legal Basis for Processing

Under Article 6 UK GDPR, we rely on the following lawful bases for processing your personal data:

• Legitimate interests (Article 6(1)(f)) — when you submit an enquiry, we have a legitimate interest in processing your data to respond to you. We have conducted a Legitimate Interests Assessment (LIA) and are satisfied this processing is necessary, proportionate, and does not override your fundamental rights and freedoms. A copy of our LIA is available on request.
• Contractual necessity (Article 6(1)(b)) — where an order is placed, processing your name, email, and delivery details is necessary to perform the contract between us.
• Legal obligation (Article 6(1)(c)) — we are required to retain certain financial records for HMRC self-assessment purposes under UK tax law applicable to sole traders.

Where we process special category data (food allergy information), we rely on Article 9(2)(a) — your explicit consent given when you voluntarily disclose this — and Article 9(2)(b) — processing necessary for obligations in the field of food safety law, specifically the Food Information to Consumers Regulations 2014.

International Data Transfers

Some third-party services we use are based in the United States. Transferring personal data outside the UK requires an appropriate safeguard under Chapter V UK GDPR. The following processors may transfer or store your data outside the UK:

• Formspree, Inc. — transfers are made under Standard Contractual Clauses (SCCs) adopted in accordance with the UK International Data Transfer Agreement (IDTA). We have selected Formspree's EU data region to minimise data leaving the UK/EEA where possible.
• Intuition Machines, Inc. (hCaptcha) — transfers are made under Standard Contractual Clauses adopted in accordance with the UK IDTA.
• Google LLC (Google Fonts) — transfers are made under Standard Contractual Clauses. Data transferred is limited to your IP address at the point of font loading and is not retained by us.
• GitHub, Inc. (GitHub Pages / Microsoft) — transfers are made under Microsoft's Standard Contractual Clauses as adopted under the UK IDTA.

Third Parties & Data Processors

The following third-party services act as data processors on our behalf. We have reviewed each for UK GDPR compliance and, where required, entered into appropriate data processing agreements:

• Formspree, Inc. — processes form submissions and delivers them to our email. EU data region selected. Privacy policy
• Intuition Machines, Inc. (hCaptcha) — provides bot detection. Does not use data for advertising or profiling. Privacy policy
• Google LLC (Google Fonts) — serves web fonts. Only your IP address is transmitted at font load time. Privacy policy
• Ideal Postcodes Ltd (postcodes.io) — postcode-to-coordinates lookup for delivery estimation. Only your postcode is transmitted; no personal data is retained by this service. Privacy policy
• GitHub, Inc. (GitHub Pages) — website hosting. May log standard server access data including IP addresses. Privacy statement

We do not share your personal data with any other third parties unless required to do so by law, court order, or a competent regulatory authority.

Cookies & PECR

This website is subject to the Privacy and Electronic Communications Regulations 2003 (PECR) as well as UK GDPR. PECR specifically governs the use of cookies and similar technologies on websites accessed by users in the UK.

We do not use any first-party cookies, analytics cookies, advertising cookies, or tracking technologies of our own. We do not deploy tools such as Google Analytics, Meta Pixel, or any similar user-tracking services.

The following third-party services may engage in limited device-level operations as part of their function:

• hCaptcha — may set a session cookie and access limited browser signals (mouse movement patterns, device type) to distinguish human users from automated bots. This is strictly necessary for form security and does not involve advertising or cross-site profiling.
• Google Fonts — loads font files from Google's CDN, resulting in your IP address being transmitted to Google. This does not typically set persistent cookies in modern browser implementations.

Under Regulation 6(4) PECR, strictly necessary cookies and technologies do not require prior consent. We do not rely on consent for any technologies currently used on this site, as all third-party operations are either strictly necessary for security or involve only transient IP address transmission with no persistent tracking.

We do not currently operate a cookie consent banner because we have no non-essential cookies to manage. Should we introduce analytics or other non-essential technologies in future, we will update this policy and implement appropriate prior consent mechanisms before doing so.

How Long We Keep Your Data

We retain personal data only for as long as necessary, in accordance with the storage limitation principle under Article 5(1)(e) UK GDPR:

• Enquiries that do not result in an order — retained for up to 12 months in case you re-enquire, then securely deleted from all our records and Formspree.
• Completed orders — retained for up to 6 years in line with our obligations as a UK limited company under the Companies Act 2006 and HMRC requirements.
• Special category data (allergen and dietary information) — retained for the duration of the order and for a reasonable period thereafter to accommodate potential complaints or allergen-related claims, then securely deleted.
• Formspree submission records — we request deletion of submissions from the Formspree dashboard once they have been recorded in our own files, in line with the data minimisation principle under Article 5(1)(c) UK GDPR.

Where a legal retention obligation requires us to hold data beyond these periods, we will retain it only to the minimum extent necessary and will inform you if this applies to a deletion request you have made.

Your Rights

Under Articles 15–22 UK GDPR, you have the following rights. These rights are not absolute and may be subject to exemptions, but we will always respond to your request and explain our position clearly:

• Right of access (Article 15) — request a copy of the personal data we hold about you, together with supplementary information about how it is used.
• Right to rectification (Article 16) — ask us to correct inaccurate or incomplete data without undue delay.
• Right to erasure (Article 17) — request deletion of your data where there is no compelling reason to continue processing, subject to legal retention obligations.
• Right to restriction of processing (Article 18) — ask us to suspend processing in certain circumstances, for example while accuracy is contested.
• Right to data portability (Article 20) — where processing is based on consent or contractual necessity, request your data in a structured, commonly used, machine-readable format.
• Right to object (Article 21) — object at any time to processing based on legitimate interests. We will cease unless we can demonstrate compelling legitimate grounds that override your interests, rights, and freedoms.
• Rights related to automated decision-making (Article 22) — we confirm that we do not use automated decision-making or profiling. This right is therefore not engaged, but we include this for the purposes of transparency and completeness.

To exercise any right, contact us at tycreations.eastbourne@gmail.com. We will respond within one calendar month of receipt as required by Article 12 UK GDPR. This period may be extended by two months for complex or numerous requests; we will notify you within the first month if this applies.

We will not charge a fee unless a request is manifestly unfounded or excessive, in which case we may charge a reasonable administrative fee or refuse to act, and will inform you accordingly with reasons.

How to Contact Us

For any questions, concerns, or requests relating to this privacy policy or our handling of your personal data, please contact us:

We aim to resolve all concerns promptly and transparently. If you remain dissatisfied following our response, you have the right to escalate your complaint to the ICO as set out in section 11.

This policy was last reviewed in May 2026. We reserve the right to update it at any time. Material changes will be reflected by updating the "last updated" date at the top of this page.

The ICO

If you are not satisfied with how we have handled your personal data or responded to your rights request, you have the right under Article 77 UK GDPR to lodge a complaint with the UK supervisory authority:

We would always appreciate the opportunity to address your concern before you contact the ICO. Please reach out to us in the first instance.

You also have the right to an effective judicial remedy under Article 79 UK GDPR if you consider that your rights have been infringed as a result of our processing of your personal data in non-compliance with UK GDPR.