Privacy Policy & Cookies

Version 2.0 — August 2026

Grasmere Gingerbread® has kept Sarah Nelson's original 1854 recipe secret for over 170 years, so protecting your personal data matters to us too. This policy explains what information we collect, how we use it, and your rights. We review and update it from time to time — please check back periodically.

Data controller: Grasmere Gingerbread Limited, Church Cottage, Grasmere, Cumbria LA22 9SW, UK. Tel: (015394) 35428. Email: technical@grasmeregingerbread.co.uk

Information We Collect

• Details of your visit to our site, such as pages viewed, traffic and general location data.
• Information you give us voluntarily — for example when you register, place an order, or contact us.
• Information we collect from you anywhere within our business, including The Grasmere Gingerbread Shop or at events and talks.
• Cookie data (see below).

How We Use Your Data, and Our Legal Basis

Cookies

We use cookies to run our site and to understand how it's used by your computer.

• Essential cookies — always on. They keep the shopping basket working, remember your session, and show the right version of the site for your device. They don't identify you personally, they just provide anonymous statistical data. Blocking them may stop the site working correctly.
• Analytics/statistics cookies (e.g. _ga, _gid, _gat, _utma, _utmb, _utmc, _utmz) — help us see how the site is used and fix problems. Since the Data (Use and Access) Act 2025 amended UK cookie law (in force from 5 February 2026), first-party analytics cookies used only for aggregated statistics no longer require your prior consent, provided we're transparent about them and give you an easy opt-out — which we do here and via your browser settings.
• We do not use cookies for advertising or marketing, and we don't share cookie data with third parties for those purposes.

You can block or delete cookies at any time in your browser settings — see aboutcookies.org for guidance. If you use our social sharing buttons, the relevant platform may set its own cookies under its own policy.

 Keeping Your Data Secure

• Payment details are transmitted using SSL/TLS encryption and processed via our PCI DSS-compliant payment provider (Adyen); we never see or store your full card details.
• We only share data with data processors acting on our behalf under contract — for example our bank, accountant, IT support and delivery couriers.
• Where data is transferred or stored outside the UK, we use appropriate legal safeguards, such as the UK International Data Transfer Agreement or the ICO's Addendum to the EU Standard Contractual Clauses.
• Email isn't a fully secure channel — please don't send card details or other sensitive information by email or web form.

Sharing & Storing Your Information

We never sell your personal data. We only disclose it: to data processors acting on our behalf; if we're legally required to; if we sell all or part of our business; or to prevent or investigate fraud.

We may need to transfer data we collect from you to locations outside of the UK for processing and storing. By providing your personal data to us, you agree to this transfer, storage and processing.

All sensitive information (such as credit card details) is only transmitted via Secure Socket Layer (SSL) technology, which means that you cannot inadvertently place an order through an unsecured connection. All sensitive information is stored in an encrypted format behind secure firewalls.

Email is not a secure or confidential means of communication. Therefore please do not share confidential information such as credit card details via the Contact Us form or by email, as we cannot guarantee the security of your information shared over the internet, and cannot be held responsible for any loss, misuse of alteration.

How Long We Keep Your Data

We keep personal data only as long as necessary for the purpose it was collected for — for example, financial records must be kept for 6 years for tax purposes. If you're on our mailing list, we'll keep your details until you unsubscribe or ask us to stop; you can do this at any time.

Your Rights

Grasmere Gingerbread® is loved for its friendly, down-to-earth approach, and we are not fans of modern-day acronyms and jargon! But sometimes we have too, so here goes.
Under GDPR rules and any Data Protection Act regulations, you – our valued customers and visitors – have a number of legal rights concerning our use of your personal information.

Under UK GDPR and the Data Protection Act 2018 (as amended by the Data (Use and Access) Act 2025), you have the right to:

• Access the personal data we hold about you (a Subject Access Request).
• Have inaccurate or incomplete data corrected.
• Ask us to erase your data in certain circumstances ('right to be forgotten').
• Restrict or object to how we use your data — including an absolute right to opt out of direct marketing at any time.
• Receive your data in a portable format, where applicable.

We don't carry out any automated decision-making or profiling that has a legal or similarly significant effect on you.

To exercise any of these rights, email technical@grasmeregingerbread.co.uk or call (015394) 35428.

How to Complain

If you need to correct or amend any of your details, please contact us first so we can put things right. We promise we will! However, if you're not satisfied with our response, you can complain to the UK's data protection regulator:

Information Commissioner's Office (ICO) Wycliffe House, Water Lane, Wilmslow, Cheshire SK9 5AF Web: ico.org.uk | Tel: 0303 123 1113

Job Applicants

If you're applying for a role with us, a separate Candidate Privacy Notice applies — available on request from our Employment page.

If you got to the end of this Privacy Policy, well done! We have tried to blend the seriousness of Security and Privacy in our own style and humour to make it more palatable! However, if reading this has exhausted you, grab a cuppa, tuck into a slice of Grasmere Gingerbread® and trust us to protect your secrets.

Andrew & Joanne Hunter