Good Habit · Privacy policy

1. Who We Are

The Good Habit Bakery Limited
33 St Giles'
Oxford
OX1 3LD

We are committed to protecting your privacy and handling your data transparently, securely, and in accordance with applicable data protection laws, including the UK GDPR and the Data Protection Act 2018.

2. What Information We Collect

We may collect and process the following types of personal data:

Contact details (e.g. name, email address, phone number)
Booking details (e.g. the Formal Hall week you book, the names of any guests, and dietary requirements and allergies for you and your guests)
Usage data (e.g. IP address, browser type, pages visited)

Note: We do not use tracking, analytics or advertising cookies. The only cookie we set is a strictly necessary one called gh_auth, and only if you enter the password for our Blackfriars student pages. It remembers that you have entered the password so you don't have to enter it again on each page, contains no personal information, and expires after one year. Because it is essential for the part of the website you have asked to use, it does not require your consent.

3. How We Use Your Information

We may use your information to:

Provide and maintain our website and services
Take and manage Formal Hall bookings, including contacting you about your booking and making sure our kitchen can cater for any dietary requirements or allergies for you and your guests
Respond to enquiries or customer support requests
Improve our website and user experience
Comply with legal obligations

4. Legal Bases for Processing

We rely on the following legal bases to process your data:

Your consent
Performance of a contract
Compliance with a legal obligation
Our legitimate interests (e.g. improving our services, preventing fraud)

Dietary requirements and allergies can reveal information about health or beliefs, which the law treats as special category data. You choose whether to give us this information, we use it only to cater for you and your guests, and we rely on your explicit consent to do so, which you give by ticking the box on the booking form. You can withdraw your consent at any time by contacting us.

If you book for guests, please make sure they are happy for you to share their details with us.

5. Sharing Your Data

We may share your data with:

Trusted service providers and partners (e.g. hosting providers, the services we keep our booking records in and send booking emails with, payment processors)
Regulatory or legal authorities when required
Other parties if part of a business transfer or acquisition (with notice to you)

We will never sell your personal data.

6. International Data Transfers

Some of the service providers we use are based, or process personal data, outside the UK:

Netlify, Inc. hosts our website and passes the booking details you send on to our booking records. It is based in the United States and processes technical data, such as your IP address, when you visit.
Google keeps our booking records, in Google Sheets in our Google Workspace account, and sends booking confirmations and cancellations by email. Google LLC is based in the United States, and Google may process this data in other countries where it has data centres.

Netlify, Inc. and Google LLC are both certified under the UK Extension to the EU–U.S. Data Privacy Framework (the UK–US "data bridge"), which UK adequacy regulations recognise as protecting personal data transferred to them. Transfers to the European Union are also covered by UK adequacy regulations. If we use a provider that isn't covered in either of these ways, we rely on the European Commission's Standard Contractual Clauses together with the UK International Data Transfer Addendum.

You can ask us for more information about these transfers and the safeguards in place using the contact details below.

7. Data Retention

We keep personal data only as long as necessary:

For the purposes stated in this policy
To comply with legal obligations
To resolve disputes or enforce agreements

After this period, your data will be securely deleted or anonymised.

8. Your Data Rights

Under the UK GDPR, you have rights including:

Right to access your data
Right to rectification
Right to erasure (“right to be forgotten”)
Right to restrict processing
Right to data portability
Right to object
Right to withdraw consent at any time
Right to lodge a complaint with the Information Commissioner’s Office (ICO)

To exercise any of these rights, contact us at: hello@thegoodhabitbakery.com

9. Changes to This Policy

We may update this privacy policy from time to time. Changes will be posted on this page with the updated effective date. We encourage you to review this page regularly.

10. Contact Us

If you have any questions or concerns about this policy or your data, contact:

The Good Habit Bakery Limited
33 St Giles'
Oxford
OX1 3LD

hello@thegoodhabitbakery.com