Privacy Policy

This policy explains what we do with your personal information: what we collect, why, how long we keep it, and what rights you have.

Atelier Minori is the data controller for the information described here. We are a small home bakery at 22A Shaftesbury Avenue, New Barnet, Barnet EN5 5JA, United Kingdom. You can reach us at info@atelierminori.co.uk or on 07778 861258.

We are covered by the UK General Data Protection Regulation and the Data Protection Act 2018.

You can browse our menu, create an account, and place an order through this website. You cannot pay through it: payment happens in person when you collect, so we never see, handle or store card or bank details, and no payment processor is involved.

You do not have to create an account. You can order as a guest with just a name and phone number.

We use one analytics tool, Vercel Web Analytics, which does not use cookies and cannot identify you or follow you between websites. The only things stored on your device are the cookie that keeps you signed in and the cart held in your own browser. Because of that, this site does not need a cookie banner.

We hold personal information about you if you order from us, create an account, or contact us — and then only what we need to bake your order, hand it to you, and keep proper records.

We do not sell your information, we do not share it for advertising, and we only send you marketing if you ask us to.

We use Vercel Web Analytics to understand how many people visit the site and which pages they read. It does not set cookies and does not store anything on your device. It works by taking your IP address and browser type and turning them into a hash, which is discarded and regenerated each day. This means visitors cannot be tracked from one day to the next, or across other websites.

The reports we see are aggregated counts, such as page views and general country-level location. We cannot identify you from them.

Our website is hosted by Vercel, and our database and accounts by Supabase. Both keep short-term technical logs which include IP addresses. These are used to deliver the site securely and to diagnose faults, and are not used to build any profile of you.

Our lawful basis for the above is legitimate interests: understanding whether our website is useful, and keeping it running and secure. You can object to this at any time using the contact details above.

We do not use advertising, marketing or tracking cookies, and we do not run any advertising pixels or third-party trackers.

If you sign in, we set a cookie that keeps you signed in and nothing else. It is set by Supabase, who provide our accounts system, and it is deleted when you sign out.

Your cart is stored in your own browser, on your device. It stays there while you shop and is only sent to us at the moment you submit an order. If you never submit, we never see it.

Both of those are strictly necessary to provide something you asked for. Under the Privacy and Electronic Communications Regulations, that kind of storage does not require your consent, which is why you will not see a cookie pop-up here.

If this ever changes, we will ask for your consent first and update this policy.

An account is optional. It lets you save your details, see your order history, record your allergies, earn Minori Points and hold gift cards.

If you register with an email address and password, we collect your name and email address. Your password is stored by Supabase in hashed form and is never visible to us.

If you sign in with Google instead, Google tells us your name and email address and confirms the address belongs to you. We never see your Google password. Google processes the fact that you signed in under its own privacy terms, which we do not control.

On your account page you can also add a phone number, choose an avatar from the set we provide (there is no photo upload anywhere on this site), save addresses, record your allergies, and turn marketing on or off. All of it is optional except your name and email address, and you can change or remove any of it yourself at any time.

Our lawful basis is performance of a contract with you — running your account and the orders you place through it — except for allergies and marketing, which rest on your consent and are covered in their own sections below.

Orders are placed on this website. Whether you order with an account or as a guest, we collect your name, phone number, email address if you give one, what you ordered, your collection date, any note you add, and the date and time you confirmed that you had read the allergen information and accepted our terms.

We record that confirmation because it is a food-safety record, not a formality, and we keep it with the order.

Your order also stores what you were told at the time: the item names, prices and allergens as they were on the day you ordered. That does not change if we later edit a recipe or a price.

We take payment in cash when you collect, so we never handle, process or store any card or bank details, and there is no payment processor involved.

If you order as a guest, we identify you by your phone number, so that someone who orders three times is recorded as one person rather than three. If you later create an account using the same email address you gave at checkout, we link the two so your history follows you rather than starting again.

We use all of this to prepare your order, to decide whether we can accept it, to agree a collection time with you, to answer your questions, and to keep proper business records. Our lawful basis is performance of a contract with you, except for the records we are required to keep, where it is legal obligation — HMRC requires us to keep records of what we sell.

We may contact you about your order by email or on WhatsApp. If you message us on WhatsApp, please be aware that WhatsApp is operated by Meta. Your messages are encrypted in transit, but Meta processes the fact that you contacted us under its own privacy terms, which we do not control. If you would rather not use WhatsApp, please email us instead.

Once you have placed an order, we email you automatically: once when we receive it, and again each time its status changes — accepted, being prepared, ready to collect, completed or cancelled.

These are service messages, not marketing. They are how we tell you whether your order was accepted and when to collect it, so they cannot be turned off while an order is live. If you did not give us an email address, we do not send them and we will contact you another way.

They are sent on our behalf by Resend, and contain your order details and the items you ordered. Emails about your account itself — confirming your address, resetting your password — are sent by Supabase.

Our lawful basis is performance of a contract with you.

We only send marketing to people who have asked for it. There is a tick box at checkout and a setting on your account page, and both are off unless you turn them on.

Our lawful basis is your consent. You can withdraw it at any time by unticking the box on your account page or by emailing us, and withdrawing it does not affect the order emails described above, which you will continue to receive while an order is live.

We do not pass your details to anyone else for marketing, and we do not sell them.

If you tell us about a food allergy, intolerance or medical dietary requirement, that is information about your health. Data protection law treats it as a special category of personal data and gives it extra protection.

We ask for it for one reason only: so that we do not make you ill. We use it to check ingredients, to warn you when something in your cart contains an allergen you have declared, to decide whether we can safely make what you have asked for, and to tell you honestly if we cannot.

Our lawful basis is your explicit consent, which you give by recording it on your account or by telling us. You can withdraw it at any time, though if you do we may not be able to accept your order safely.

Allergies you record on your account stay there until you remove them — that is the point of recording them, so you do not have to repeat yourself. You can delete them yourself at any time from My Account. If you tell us about an allergy in an order note or a message instead, it stays with that order record.

We never share allergy information with anyone outside our kitchen.

If you have an account, we keep a record of every Minori Point you earn and spend, so that your balance can always be explained, and of any gift cards on your profile with their balance and the orders they were used on. This is part of your account and part of our business records.

If you leave a review, we hold your rating, your comment, and which order it relates to. Reviews are checked before they appear, and are published with a display name — never your email address, phone number or full contact details.

Our lawful basis is performance of a contract with you for points and gift cards, and legitimate interests for showing reviews on our product pages. You can ask us to remove a review you have left.

We do not sell your personal information, and we do not share it for advertising.

We share it only with the small number of providers who make our business work: Supabase, who host our database, our accounts system and our images; Vercel, who host our website and provide our analytics; Resend, who send our order emails; Google Workspace, whose email carries messages between us, and Google itself if you choose to sign in with Google; and Meta, if you choose to contact us on WhatsApp.

Because we take payment in cash, no payment processor is involved.

We may also share information with our accountant, and with HMRC or another authority, where the law requires us to.

That is the complete list. If it changes, we will update this policy.

Your information is held in the United Kingdom and the European Economic Area wherever possible.

Some of our providers, including Vercel, Supabase, Resend, Google and Meta, are based in the United States and may process information there. Where that happens, the transfer is covered by the safeguards UK law requires, such as the International Data Transfer Agreement or the UK Addendum to the standard contractual clauses.

If you would like more detail about a particular provider, please ask us.

Order records and related correspondence: up to six years after the end of the tax year they relate to, because HMRC requires us to keep business records. This applies whether you ordered with an account or as a guest.

Account details: for as long as your account is open. If you ask us to close it, we delete your profile, saved addresses and recorded allergies, and keep only what we are required to keep — the order records above, with the name and contact details that were on each order at the time.

Allergy and dietary information on your account: until you remove it or close your account. Allergy information given for a single order stays with that order record.

Minori Points and gift card history: while your account is open, and afterwards as part of the order records described above.

General enquiries that do not lead to an order: up to twelve months, then deleted.

Website analytics: held by Vercel in aggregated form only. The daily hash described above is valid for a single day and cannot be linked back to you.

You have the right to ask us for a copy of the personal information we hold about you, to have it corrected if it is wrong, and to have it deleted where we no longer need it. You can also ask us to restrict what we do with it, object to our use of it where we rely on legitimate interests, and ask us to transfer it to someone else in a portable format. Where we rely on your consent — marketing, and allergy information — you can withdraw it at any time.

If you have an account, you can see and correct most of this yourself under My Account, including your details, your addresses, your allergies, your marketing preference and your order history.

To exercise any of these, email info@atelierminori.co.uk. We will respond within one month, and it is free.

We do not make any automated decisions about you, and we do not profile you. Every order is reviewed and accepted or declined by a person.

If you are unhappy with how we have handled your information, please tell us first and we will do our best to put it right.

You also have the right to complain to the Information Commissioner's Office, the UK regulator for data protection. You can reach the ICO at ico.org.uk, on 0303 123 1113, or by post at Wycliffe House, Water Lane, Wilmslow, Cheshire SK9 5AF.

Complaining to us first does not affect your right to go to the ICO.

This website is not aimed at children, and we do not knowingly collect personal information from anyone under 13. Accounts are for adults. If you believe a child has sent us their information, please contact us and we will delete it.

We will update this policy when our practices change.

This version covers online ordering, customer accounts, Minori Points and gift cards, which replaced our earlier arrangement of taking orders only by email and WhatsApp. We still do not take payment online. If that changes, we will rewrite this policy before it does and note the change here.

The date at the top shows when this version was published.

Atelier Minori 22A Shaftesbury Avenue, New Barnet, Barnet EN5 5JA, United Kingdom

Email: info@atelierminori.co.uk WhatsApp: 07778 861258 Web: atelierminori.co.uk