Your information, our promise

Who we are

Hugo's Breakfast ("we", "us") is a small Cornish maker of breakfast products - muesli, granola, porridge, teas, hot chocolate, honey, jams and more - sold through this website and independent stockists across the UK. We are the controller of the personal information described in this policy.

You can reach us any time at hello@hugosbreakfast.com or through our contact page.

What we collect

Depending on how you use the site, we collect:

• Newsletter signups. Your email address, when you sign up for 10% off and small-batch news.
• Orders. Your name, email address, delivery address and the contents and value of your order. For guest orders, this is stored against your email so you can track it.
• Customer accounts. Your name, email address and, if you choose to give them, your phone number and company, plus the password you set.
• Contact messages. Your name, email address, optional order number and your message.
• Wishlists and baskets. The products you save or place in your basket while browsing.
• Simple website analytics. Anonymous, first-party events such as which page you viewed, which traffic source brought you here and when a basket was abandoned - stored on our own systems with no third-party advertising cookies.

Card details are never sent to us. Payments are taken securely by Stripe, and we only receive a payment confirmation for your order.

How we use your information

• To create and manage your account and wishlist.
• To take payment, confirm your order, deliver your parcel and let you track it.
• To email you an order confirmation and, if you choose, text updates at the parcel stages.
• To answer questions you send through the contact form.
• To send you a 10% discount code and newsletter - but only if you signed up, and only while you're happy to receive it. Every email includes an unsubscribe link.
• To understand which pages, categories and products are popular, so we can improve the shop.

Our legal basis

We rely on the UK GDPR. For orders and deliveries, and to keep your account, we process your data because we have a contract with you (or are taking steps towards one). For newsletters, we rely on your consent. For website analytics and security, we rely on our legitimate interest in running and improving our shop.

Who we share it with

We only share what is needed, with:

• Stripe - to take payments securely. Stripe holds your card details; we never see them.
• Resend - which delivers our order confirmations and newsletters from notify.hugosbreakfast.co.uk.
• APC Overnight - which collects and delivers your parcels, using your name, address and contact details.
• Our website and email hosting - the platforms that keep this site running.

We never sell your information, and we don't share it with advertising networks. Where a company outside the UK stores data, we rely on the standard UK adequacy arrangements that apply to these providers.

How long we keep it

• Orders and invoices - for six years, as tax and accounting law requires.
• Customer accounts - while your account is open, and a short while afterwards so your history is recoverable.
• Newsletter lists - until you unsubscribe, or if we hear nothing from you for a few years.
• Website analytics - aggregated and kept no longer than we need to spot trends.

Cookies

We use a small number of essential cookies and browser storage to keep you signed in, remember your basket and understand our own website traffic. We don't use third-party advertising cookies. You can clear these at any time through your browser settings.

Your rights

You can ask for a copy of your information, have it corrected or deleted, object to how we use it, ask us to restrict it, or ask us to send it to you or another shop in a portable format. You can also withdraw your newsletter consent at any time by unsubscribing or emailing us.

To exercise any of these rights, email hello@hugosbreakfast.com. If you're unhappy with how we've handled your data, you can complain to the Information Commissioner's Office at ico.org.uk.

Changes to this policy

We'll update this page when our practices change, with a new "last updated" date at the top.