Privacy Policy
THE GIRL CAN BAKE (TGCB) respects the trust you place in us when you browse our collection, enquire about a bespoke cake, place an order or arrange a gift. This Policy explains how we handle personal information in connection with our website, orders, delivery, customer support and communications. It applies to customers, gift recipients, people making enquiries and other individuals whose information we receive through those activities. References to a service apply only when that service is available and you use it.
1. Who is responsible for your information
THE GIRL CAN BAKE (TGCB), operating in Nigeria, is the controller of personal information that we decide how and why to use. Contact us at hello@thegirlcanbake.com for privacy enquiries, rights requests or complaints. Providers such as payment processors and social networks may also act as independent controllers for their own activities; their privacy notices apply to those activities.
Our processing is subject to the Nigeria Data Protection Act 2023 and applicable regulations and guidance. Other privacy laws may apply to particular activities or individuals. This Policy does not remove any legal right or limit any responsibility that the law places on TGCB.
2. Information we collect
The information we collect depends on your interaction. You may give us your name, email, telephone number, billing or delivery address, delivery instructions, order selections, gift-card message, preferences, correspondence, feedback, complaint details or bespoke-design reference images. Where customer accounts are available, we also process account and authentication information.
For orders, we process items, quantities, prices, transaction references, payment status, delivery status and related records. When online payment is enabled, our payment provider processes payment credentials. TGCB ordinarily receives payment confirmation and limited transaction details rather than complete card numbers or card security codes. Do not send full card details or passwords through enquiry forms, email or social messages.
Our hosting or commerce providers may collect technical information such as IP address, browser, device, referral source, access times and security logs. Where enabled, cookies and similar tools may record basket contents, preferences and interactions with our website. We may receive information from customers arranging gifts, corporate buyers, couriers, payment providers or social platforms where relevant to our services.
3. Gift recipients and information about other people
When someone orders a gift, we may receive the recipient's name, contact details, address and the accompanying message. We use those details to arrange and complete the requested delivery, deal with delivery problems and respond to related enquiries. We do not automatically add recipients to marketing lists or treat receipt of a gift as consent to marketing.
If you give us another person's information, provide only what is needed and ensure you have an appropriate basis to share it. Explain our involvement where appropriate and direct the person to this Policy. Do not send another person's medical history, identity documents or other unnecessary sensitive details. We may contact a recipient or request clarification if reasonably needed to deliver safely or handle a privacy concern.
Gift messages are shared only as reasonably needed to prepare the card and fulfil the order. Do not include confidential information that is unnecessary for that purpose.
4. Allergy and dietary information
Allergy information may reveal sensitive health information. We seek only the minimum information needed to understand a relevant request, assess whether we can fulfil it and communicate with you. Where explicit consent or another additional legal condition is required, we will obtain or establish it before using sensitive information.
You can ask about ingredients without giving us a diagnosis or full medical record. If the information concerns someone else, do not assume that you can consent for them unless legally authorised. Necessary information may be shared with the team preparing the order, but not used to infer wider health characteristics or target advertising. Such information is deleted or restricted when no longer needed, unless a legal obligation or specific claim requires retention.
Providing an allergy or dietary preference does not itself confirm that an order can be made safely or that a product is allergen-free. Ingredient, suitability and cross-contact information must be confirmed separately with TGCB before ordering. This paragraph describes data handling; it does not waive any food-safety duty.
5. Why we use information and our legal bases
We use your information to respond to enquiries, prepare quotations, process and fulfil orders, personalise requested cards and designs, arrange delivery, manage payments and refunds, provide support, investigate complaints, prevent misuse and maintain necessary records. We may also use proportionate information to understand demand and improve our service.
For customers, order fulfilment and requested pre-order steps generally rely on contractual necessity. For recipients and delivery contacts who are not parties to the purchase contract, we assess legitimate interests in fulfilling the requested gift and resolving delivery issues, balanced against their rights. Accounting, tax, regulatory and lawful-disclosure duties rely on legal obligations. Security, fraud prevention, service improvement and the establishment or defence of claims may rely on legitimate interests, where those interests are not overridden by individuals' rights.
Optional marketing and non-essential tracking rely on consent where required. Sensitive information needs both an appropriate lawful basis and any additional condition required by law. We do not rely on acceptance of this Policy, silence or website use as blanket consent. Withdrawing consent does not invalidate earlier lawful processing. We do not reuse information for a materially incompatible purpose without an appropriate legal basis and any required notice or consent.
6. Marketing, recommendations and reviews
If you choose to receive marketing, we may send updates about TGCB products, seasonal collections and offers, using your stated preferences where appropriate. You can unsubscribe through the relevant message or contact hello@thegirlcanbake.com. Essential order, delivery, security and service messages may continue after a marketing opt-out.
Optional recommendations may use preferences you provide or, where lawfully enabled, previous interactions. We do not infer a person's medical condition from their flavour choices or dietary enquiries. Publicly posting a review or contacting us does not automatically authorise unrestricted use of your name, photograph, gift message or recipient's identity in advertising. Where required, we obtain permission before publishing identifiable customer material. Recipient data is not used for marketing simply because a customer supplied it.
7. Cookies, analytics and third-party resources
Essential technologies may support security, authentication, basket and checkout functions. Optional analytics or advertising tools, if enabled, may measure site use or campaign performance. We obtain consent or offer other legally required choices before using non-essential technologies. Refusing optional tracking will not prevent ordinary shopping, although blocking essential technologies can affect features.
A feature's inclusion in this Policy does not mean it is currently enabled. Our current site may also load fonts, images or other resources from third-party providers; those providers can receive technical information when resources are requested. External social links and future payment or commerce services operate under their own notices. We remain responsible for our selection, configuration and lawful disclosure of data to providers within our control.
You can use available cookie controls and browser settings, and contact us about tracking. Browser controls alone may not withdraw every form of consent. Where applicable, we honour legally recognised opt-out preference signals. We will update our notices when the deployed tools or their data uses materially change.
8. Who we share information with
We share information only where relevant and proportionate. Recipients may include authorised staff; couriers or delivery coordinators; hosting, commerce, payment, communications, support or security providers; and professional advisers. When Shopify checkout or Paystack payments are enabled, those providers process the information needed for their respective services. We do not disclose an entire customer record to a courier when delivery details alone are sufficient.
Processors acting on our behalf must have appropriate contractual, confidentiality and security obligations. Some providers also process information independently, for example to meet payment-network or legal requirements. We do not sell personal information or permit service providers to use customer or recipient information for their own unrelated marketing merely because we engaged them.
We may disclose necessary information to comply with law or lawful authority requests; investigate fraud or security incidents; protect people or property; or establish, exercise or defend legal claims. A business sale, investment, restructuring or transfer may involve proportionate disclosure or transfer subject to confidentiality, lawful safeguards and any required notice. We do not treat these purposes as permission for indiscriminate disclosure.
9. International processing
Hosting, commerce, payment, communications or support providers may process information outside Nigeria. Before a transfer requiring safeguards, we assess and use an appropriate mechanism permitted by applicable law, such as adequate protection, binding contractual safeguards or a legally available exception. Using an overseas provider does not remove TGCB's responsibilities. Contact us for information about relevant recipients, locations and safeguards, subject to lawful confidentiality limits.
10. Retention
We retain information for the purpose for which it is needed, not indefinitely. Unsuccessful enquiries and design references are ordinarily reviewed for deletion within 12 months of the last substantive contact, unless you request an ongoing service or a justified legal or operational need requires retention. Completed order, payment and delivery records are kept for applicable accounting, tax, regulatory and claims-management periods.
Gift messages and sensitive dietary information are kept only as long as reasonably needed for fulfilment, related support or a specific legal requirement or claim. Marketing information is retained while you remain subscribed; a minimal suppression record may be kept to respect an opt-out. Security logs are retained proportionately to security needs. Backups may expire on their normal cycle and remain protected from ordinary use.
When retention is no longer justified, we delete, genuinely anonymise or appropriately restrict information. A privacy request does not require us to destroy records the law requires us to retain, but we will explain any lawful restriction on fulfilling the request.
11. Security and incidents
We use safeguards appropriate to the information and risks, including proportionate access restrictions, authentication, secure transmission where available, vendor controls and internal handling procedures. Access should be limited to people who need the information for authorised work. We do not claim that any website or transmission method is completely secure.
If an incident affects personal information, we investigate, take appropriate containment and remedial action and make any notifications required by applicable law. Please notify hello@thegirlcanbake.com if you suspect that an account, order communication or personal information has been compromised. Avoid sending unnecessary sensitive information in an initial report.
12. Automated tools and artificial intelligence
TGCB may use automated tools or AI to support customer assistance, recommendations, administration, forecasting and fraud prevention where those uses are lawfully introduced. We minimise the information supplied to such tools, assess providers and protect confidential information. We do not put identifiable customer, recipient or allergy information into publicly accessible AI tools for unrestricted use or training.
Automated suggestions do not independently approve allergy suitability, bespoke specifications or a binding quotation. You can ask for a human to review a recommendation or order concern. We do not make solely automated decisions with legal or similarly significant effects without the safeguards required by law. If a relevant new automated process is introduced, we provide any additional notice and choices required.
13. Children
Purchases and account creation should be undertaken by adults with legal capacity. We do not seek children's personal information unnecessarily. A children's celebration can usually be arranged without a full date of birth, medical history or identifiable photograph. Where information about a child is necessary, we require appropriate authority and apply the safeguards and consent conditions required by law. We do not knowingly use children's information for prohibited targeted advertising. Contact us if a child has provided information inappropriately.
14. Your rights and requests
Subject to applicable conditions and exceptions, you may request information about processing, access, correction, deletion, restriction, objection or portability; withdraw consent; and exercise rights relating to certain automated decisions. Applicable rights depend on the governing law and the circumstances. Gift recipients can exercise rights over their own information even if someone else placed the order.
Email hello@thegirlcanbake.com with the subject 'Privacy request', describe what you need and provide a relevant order or interaction reference if available. Do not initially send identity documents or payment credentials. We may request proportionate verification or evidence of authority before releasing or altering information. We protect other people's information when responding, explain any lawful refusal or limitation and respond within the period required by applicable law. You will not be unlawfully disadvantaged for exercising a right.
You may complain directly to the Nigeria Data Protection Commission at https://ndpc.gov.ng or to another competent authority where applicable. Contacting TGCB first can help us resolve a concern, but is not a condition of approaching a regulator. If another jurisdiction's privacy law applies, we respect its applicable rights and transfer requirements rather than assuming every foreign law applies to every customer.
15. Changes and contact
We update this Policy when services, technology, data practices or legal requirements change. The effective and last-updated date is shown above. Where required, material changes are accompanied by additional notice or fresh consent. A revised Policy does not retrospectively authorise incompatible use of information already collected.
Controller: THE GIRL CAN BAKE (TGCB), Nigeria. Privacy and customer-support contact: hello@thegirlcanbake.com. This Policy governs personal information; order, cancellation, delivery, allergy and bespoke-production terms should be provided separately when you transact with TGCB.