Privacy notice

[[OWNER: registered business name]] (Piece of Cake Nairobi), [[OWNER: physical business address]], is the data controller under the Kenya Data Protection Act, 2019. ODPC registration: [[OWNER: ODPC registration number, or confirmation of exemption]]. Privacy questions and requests: [[OWNER: privacy contact email (e.g. privacy@…)]].

• Contact details: your name, mobile number and email. If you have an account, your password is stored only as a one-way hash.
• Order details: cakes, sizes and add-ons, cake messages and topper wording, dates, delivery address and map pin or pickup, and a recipient's name and phone for gifts.
• Bespoke orders: your design description, a birthday name and age if you give them, and inspiration or edible-image photos. Photos are private to our team.
• Payment records: amounts, references and M-Pesa receipts. We never see your bank details or M-Pesa PIN.
• Messages you send us through the contact form.
• Your privacy choices: when you accepted this notice and whether you agreed to marketing.
• Technical data: a pseudonymous (keyed hash) form of your IP address, used for security and rate limits. We do not keep raw IP addresses.

• To make, deliver or hand over your order and contact you about it (performing our contract with you).
• To keep tax and financial records required by Kenyan law (legal obligation).
• To answer your enquiries (legitimate interest, or steps you ask for before an order).
• To protect the site and our customers from fraud and abuse (legitimate interest).
• To send offers and news only if you opt in (consent). You can opt out at any time from your account page or the link in any marketing email.

Accounts are for adults. Birthday cakes often carry a child's name and age; give them only if you are the parent or have the parent's permission. We use them only to make the cake, and delete them 30 days after the order is completed.

We never sell your data. Riders receive only what they need to deliver: recipient name, phone, address and time. We use these service providers, each bound to use your data only for our instructions:

• DigitalOcean — Hosting of the website, database and private order photos ([[OWNER: confirm — data-centre region]])
• Cloudflare R2 — Storage of our product photos (no customer data) (Global network)
• Komoot Photon (OpenStreetMap) — Address suggestions while you type a delivery address; our server sends the text you type, never your name or phone (Germany)
• OSRM (OpenStreetMap) — Road distance from our studio to your delivery pin, to price delivery; only map coordinates are sent (Germany)
• Google — Sign in with Google, if you choose it; map on the contact page, only after you click to load it (USA / global)

Some providers above are outside Kenya. We use them only where the transfer is needed for your order or account and the provider gives appropriate safeguards for your data, as section 48 of the Act requires.

• Order and payment records (what was sold, prices, dates): 5 years, for tax law.
• Free text and phone numbers on an order — notes, cake messages, topper wording, birthday name and age, the design description — are deleted automatically 30 days after the order is delivered or cancelled. Order photos are deleted at the same time.
• Photos uploaded for an order that was never placed: 24 hours.
• Contact form messages: 365 days after we resolve them.
• Saved carts: 90 days without changes. Order emails and texts: 90 days.
• Security logs: 90 days.
• Your account: until you delete it. Deleting it removes your name, contact details and addresses; past orders stay, anonymised, for the tax period.

• The site runs only over HTTPS and passwords are stored only as one-way hashes.
• Only staff who need it can see order details, and the most sensitive actions are limited to the owner's super-admin account and recorded in an audit log.
• Order photos are kept private and shown to staff through short-lived links.
• If a breach puts your data at risk, we will tell the Data Protection Commissioner within 72 hours and tell you without delay if you are affected.

You can ask to see, correct, export or delete your data, object to how we use it, or withdraw consent. Signed-in customers can download their data or delete their account from Account → Privacy. Anyone can write to [[OWNER: privacy contact email (e.g. privacy@…)]]; we may ask you to confirm your identity first.

We answer requests to see your data within 7 days and requests to correct or delete it within 14 days. It is free unless a request is clearly excessive. If you are unhappy with our answer you can complain to the Office of the Data Protection Commissioner (ODPC) at odpc.go.ke.

We use only what the site needs to work. There are no advertising or analytics trackers.

• Sign-in cookies, if you sign in: they keep you signed in for up to 14 days and protect forms from forgery.
• Your cart, in your browser's local storage, so it is still there when you come back.
• Your guest order link and, after a bespoke order, your contact details for express checkout — in this tab only; they disappear when you close it.

When we change this notice we update the version number above. If a change affects how we use data you have already given us, we will tell you by email or on your next sign-in, and ask again where consent is needed.