PRIVACY POLICY
Your information.
Hestia Patisserie respects your privacy and takes care with the personal information you share.
This Privacy Policy explains what information I collect, why I need it, how it is used and stored, and the choices you have about your personal data.
Hestia Patisserie is an independent business operated by Rebecca Foster in Wymondham, Norfolk. For the purposes of UK data protection law, Hestia Patisserie is the data controller for the personal information described in this policy.
Last updated: September 2026
Information you give to Hestia
Depending on how you contact or order from Hestia, I may collect information including:
your name
email address and telephone number
billing, collection, delivery or venue details
information about your enquiry or order
wedding or event details
correspondence between you and Hestia
payment and transaction information
dietary requirements and allergen information you choose to provide
photographs or information relating to an event where relevant and agreed
You may provide this information through the Hestia website, by email, through social media, over the telephone or as part of arranging and paying for an order.
Please avoid providing personal information about another person unless it is necessary for your order and you are authorised to share it.
How your information is used.
I use personal information only where there is a reason to do so. This may include:
To respond to enquiries
To answer questions, discuss availability and prepare quotations before an order is placed.
To provide your order or service
To manage bookings, prepare and fulfil orders, arrange collections and deliveries, and provide wedding or event services.
To manage payments and accounts
To issue invoices, record payments, maintain financial records and meet accounting and tax obligations.
To run and protect Hestia Patisserie
To maintain appropriate business records, resolve problems or complaints and establish or defend legal claims where necessary.
To accommodate dietary requirements
Where you choose to provide information about an allergy, intolerance, coeliac disease or another health-related dietary requirement, I use that information only as necessary to understand your requirements and determine whether Hestia can safely accommodate them.
I do not add customers to a mailing list or use enquiry or order details to send unsolicited email marketing.
The legal bit.
UK data protection law requires Hestia to have a lawful reason for using your personal information.
Depending on the circumstances, I may use your information because:
it is necessary to enter into or perform a contract with you — for example, arranging and fulfilling an order;
I have a legal obligation — for example, retaining appropriate financial and accounting records;
Hestia has a legitimate interest in using the information — for example, responding to an enquiry, maintaining appropriate business records or dealing with a complaint, where those interests do not override your rights; or
you have given your consent — where consent is the appropriate basis for a particular use of your information.
Where information you provide reveals health information, such as an identified person's allergy, intolerance or coeliac disease, additional protections apply. Where required, Hestia will process this information with your explicit consent and only for the purpose for which it was provided.
Who handles your information?
Hestia does not sell your personal information.
To run the business and fulfil orders, personal information may be processed using trusted service providers, including those used for:
website hosting and enquiry forms
email
invoicing and accounting
payment processing and business banking
business records and spreadsheets
social media, where you choose to contact Hestia through those platforms
professional accounting or legal services where necessary
These currently include Squarespace, Microsoft Outlook, Google, QuickBooks, Monzo, Meta, Zettle and PayPal, depending on how you interact with Hestia and how you choose to pay.
These providers may process personal information according to their own privacy terms and applicable data protection requirements.
Where Hestia is legally required to disclose information to a regulator, public authority or other organisation, information may also be shared where necessary to comply with that obligation.
How long I keep your information.
Hestia keeps personal information only for as long as it is reasonably needed for the purpose for which it was collected, including fulfilling orders, maintaining appropriate business and financial records, resolving queries or disputes and meeting legal obligations.
Different information may therefore be kept for different periods.
Financial and transaction records may need to be retained for the periods required by tax and accounting law.
Enquiries and order correspondence that are no longer required will be periodically reviewed and deleted or securely disposed of when there is no longer a reasonable business or legal need to retain them.
Information about allergies or other health-related dietary requirements will not be retained for longer than reasonably necessary for the relevant order or any associated legal or food-safety record-keeping requirement.
Photographs and Hestia.
I sometimes photograph Hestia products, weddings, celebrations and events for the Hestia website and social media.
Where photographs or accompanying information identify a customer or relate personally to their event, I will ask permission before publishing them.
If you have previously agreed to the use of a photograph and later change your mind, please contact me. Where reasonably possible, I will remove the relevant content from Hestia's own website or social media accounts.
Please be aware that content already shared or copied by other people may be outside Hestia's control.
Looking after your information.
I take reasonable steps to keep the personal information held by Hestia secure and to limit access to those who need it for legitimate business purposes.
Hestia uses established third-party services to operate parts of the business, including email, accounting, banking, payment processing and digital record keeping. These services maintain their own security and data-protection measures.
No method of electronic storage or communication can be guaranteed to be completely secure, but I take reasonable care in selecting and using the systems through which customer information is handled.
Your data, your rights.
Depending on the circumstances, UK data protection law gives you rights over your personal information. These may include the right to:
ask what personal information Hestia holds about you and receive a copy
ask for inaccurate or incomplete information to be corrected
ask for your information to be deleted in certain circumstances
ask for the use of your information to be restricted in certain circumstances
object to certain uses of your information
receive or transfer certain information in a portable format
withdraw consent where Hestia relies on your consent
These rights are not absolute and may depend on why the information is being held. For example, Hestia may need to retain some information to meet a legal obligation even after you ask for it to be deleted.
To make a request about your personal information, contact:
info@hestia-patisserie.co.uk
Questions about your privacy.
If you have a question or concern about how Hestia uses your personal information, please contact me first and I will do my best to resolve it.
Hestia Patisserie
Wymondham, Norfolk
info@hestia-patisserie.co.uk
You also have the right to raise a concern with the Information Commissioner's Office (ICO), the UK's data protection regulator.
Information Commissioner's Office
Keeping this policy up to date.
This Privacy Policy may be updated from time to time to reflect changes to Hestia's services, systems or legal obligations.
The latest version will always be published on this website with the date it was last updated.