PRIVACY POLICY

The Big Bakes is committed to protecting your privacy and handling your personal information fairly, lawfully and transparently.

This Privacy Policy explains how we collect, use, share and protect personal information when you visit our websites, make a booking, attend one of our venues, contact us, enter a competition, sign up to receive marketing, make a corporate or private booking, or otherwise interact with The Big Bakes.

1. Who we are

The Big Bakes is a trading brand used by companies within The Big Bakes group.

The group includes The Big Bakes Limited, company number 10507715, registered in England and Wales, with registered office at:

Kemp House
128 City Road
London
EC1V 2NX

Individual venues and experiences may be operated by other companies within The Big Bakes group. For example, The Big Manchester Bake is operated by The Big Manchester Bake Limited.

Depending on the service you use, the relevant Big Bakes group company may act as the controller of your personal information. In some cases, The Big Bakes Limited provides central management, marketing, customer-service and administrative functions on behalf of other group companies.

Where relevant, your booking confirmation, contract, invoice or other documentation will identify the company providing the particular service.

In this Privacy Policy, references to “The Big Bakes”, “we”, “us” or “our” include The Big Bakes Limited and, where applicable, the relevant company within The Big Bakes group.

If you have any questions about which company is responsible for your personal information, please contact us using the details below.

2. How to contact us

For privacy and data-protection enquiries, please contact:

Email: contactus@thebiglondonbake.com

Post:
The Big Bakes Limited
Kemp House
128 City Road
London
EC1V 2NX

3. The personal information we collect

Depending on how you interact with us, we may collect:

  • your name;

  • email address;

  • telephone number;

  • postal address or postcode;

  • booking information, including booking date, venue, group size and booking history;

  • payment and transaction information;

  • information about other members of your booking where you provide this to us;

  • dietary requirements, accessibility requirements or other information you choose to provide in connection with your visit;

  • correspondence with our customer-service, bookings, finance or management teams;

  • information you provide when making a private, corporate or group-booking enquiry;

  • competition, survey and marketing preferences;

  • information relating to complaints, incidents, refunds, disputes or insurance matters;

  • photographs, video or other media captured at our venues where permitted;

  • CCTV images at venues where CCTV is in operation;

  • technical information about your use of our websites, including IP address, browser type, device information, pages visited and cookie information;

  • information provided through third-party booking, payment, marketing or customer-service platforms.

Where you book on behalf of other people, you should only provide us with their personal information where you are entitled to do so.

4. Special category information

On occasion, information you provide to us may reveal information about your health, allergies, disabilities or other matters treated as special category personal data under data-protection law.

We only use this information where necessary and where we have an appropriate legal basis and condition for doing so, including where you have provided the information so that we can accommodate dietary, accessibility or safety requirements.

Please do not provide more sensitive information than is reasonably necessary.

5. How we collect your information

We may collect personal information:

  • directly from you when you make a booking, enquiry or purchase;

  • when you contact us by email, telephone, website form or social media;

  • when you attend one of our venues;

  • when you sign up to a mailing list or enter a competition;

  • from someone organising a group booking on your behalf;

  • from our booking, payment and ticketing providers;

  • from corporate clients or event organisers;

  • from publicly available sources where appropriate;

  • automatically through cookies and similar technology when you use our websites.

6. How we use your information

We may use personal information to:

  • process and administer bookings;

  • provide our baking experiences and other services;

  • take and process payments;

  • communicate booking confirmations, reminders, changes and important service information;

  • respond to enquiries and customer-service requests;

  • administer private and corporate events;

  • accommodate dietary or accessibility requirements;

  • manage cancellations, refunds and booking changes;

  • investigate complaints, incidents and disputes;

  • manage our venues and protect customers, staff and property;

  • maintain accounting, tax and business records;

  • improve our services, websites and customer experience;

  • analyse booking trends and business performance;

  • send marketing communications where permitted;

  • administer competitions and promotions;

  • prevent fraud, misuse or unlawful activity;

  • establish, exercise or defend legal claims;

  • comply with legal, regulatory and contractual obligations.

7. Our lawful bases for using your information

Under UK data-protection law, we must have a lawful basis for processing personal information.

Depending on the circumstances, we may rely on:

Contract — where processing is necessary to provide a service you have booked or requested, or to take steps at your request before entering into a contract.

Legitimate interests — where processing is reasonably necessary for our business interests or those of a third party, provided those interests are not overridden by your rights. These interests may include operating and improving our business, providing customer support, maintaining security, preventing fraud, managing disputes and understanding how our services are used.

Legal obligation — where we need to use information to comply with a legal or regulatory requirement.

Consent — where you have given us clear permission, for example for certain marketing activities or non-essential cookies.

Where we rely on consent, you may withdraw it at any time.

The ICO requires privacy notices to explain both the purposes and lawful bases for processing and, where legitimate interests are relied on, the nature of those interests.  

8. Marketing

Where permitted by law, we may send you information about The Big Bakes, including new sessions, locations, products, events, offers and promotions.

You can opt out at any time by:

  • using the unsubscribe link in a marketing email; or

  • contacting us.

Opting out of marketing will not prevent us sending you operational communications relating to an existing booking or transaction.

We do not sell your personal information to third parties for their own marketing purposes.

9. Cookies and website analytics

Our websites use cookies and similar technologies.

Some cookies are necessary for the website to operate. Others may be used for analytics, advertising, personalisation or measuring website performance.

Where required by law, we will ask for your consent before placing non-essential cookies on your device.

You can manage your choices through our cookie banner or your browser settings.

Declining certain cookies may affect some website functionality.

For non-essential cookies, consent requirements arise under the Privacy and Electronic Communications Regulations as well as UK GDPR.  

10. Booking and payment providers

We may use third-party platforms to provide parts of our services, including:

  • online booking and ticketing;

  • payment processing;

  • customer-service systems;

  • corporate-event management;

  • email and marketing systems;

  • accounting and finance systems;

  • website hosting and analytics.

These providers may process personal information on our behalf or, in some circumstances, act as independent controllers.

Where they act on our behalf, we require them to handle personal information appropriately and in accordance with applicable data-protection law.

11. Sharing information within The Big Bakes group

Personal information may be shared between companies within The Big Bakes group where reasonably necessary for:

  • central administration;

  • customer service;

  • booking management;

  • finance;

  • marketing;

  • IT;

  • venue operations;

  • legal and compliance matters; and

  • management of the group.

We only share information within the group where there is a legitimate business need and an appropriate legal basis.

12. Other circumstances in which we may share information

We may also share personal information with:

  • professional advisers including lawyers, accountants, insurers and auditors;

  • payment processors;

  • IT and hosting providers;

  • marketing and communications providers;

  • booking and ticketing providers;

  • contractors supporting our venues;

  • law-enforcement agencies, courts, regulators or public authorities where required or permitted by law;

  • a purchaser, investor or adviser in connection with a business sale, restructuring or investment.

We do not disclose personal information to third parties simply for them to use for unrelated purposes.

13. International transfers

Some of our service providers may store or process personal information outside the United Kingdom.

Where personal information is transferred internationally, we take appropriate steps to ensure that an appropriate level of protection is in place, such as:

  • transferring information to a country recognised as providing adequate protection; or

  • using approved contractual safeguards or another lawful transfer mechanism.

Where required, information about the relevant safeguards can be provided on request.

The ICO specifically requires privacy notices to explain international transfers and the safeguards relied upon where relevant.  

14. How long we keep your information

We keep personal information only for as long as reasonably necessary for the purpose for which it was collected, including to satisfy legal, accounting, tax, insurance and contractual requirements.

Retention periods vary depending on the type of information.

For example, we may retain:

  • transaction and accounting records for the period required by tax and accounting law;

  • booking and customer-service records for a reasonable period after your booking;

  • complaint and dispute information for as long as necessary to deal with the matter and any potential legal claims;

  • marketing information until you unsubscribe or we determine it is no longer appropriate to retain;

  • CCTV footage for a limited period unless it is required for an incident, investigation or legal claim.

We periodically review information we hold and delete or anonymise it when it is no longer required.

15. Security

We take appropriate technical and organisational measures to protect personal information against accidental or unlawful destruction, loss, alteration, unauthorised disclosure or access.

These measures may include access controls, security measures applied to our systems, staff procedures and controls applied to suppliers who process information on our behalf.

No internet-based system can be guaranteed to be completely secure, but we take reasonable steps appropriate to the nature of the information we hold.

16. CCTV

Some Big Bakes venues operate CCTV for the purposes of:

  • customer and staff safety;

  • crime prevention and detection;

  • protecting property; and

  • investigating incidents.

CCTV footage is accessed only where reasonably necessary and is retained for a limited period unless required in connection with an incident, investigation or legal claim.

17. Photography and video at our events

Photography and filming may take place at our venues.

Where images are intended for promotional or marketing purposes, we will handle them in accordance with applicable data-protection requirements and any relevant booking terms, notices or permissions.

If you have concerns about photography or filming at a venue, please speak to a member of our team.

18. Children

Our experiences may be attended by children and young people.

Where we collect personal information relating to a child, we take particular care to ensure that its collection and use is appropriate.

Where information is provided by a parent, guardian or responsible adult in connection with a booking, we use it only for the relevant booking, operational, safety or legal purposes unless another lawful basis applies.

19. Your data-protection rights

Depending on the circumstances, you may have the right to:

  • ask us for a copy of your personal information;

  • ask us to correct inaccurate or incomplete information;

  • ask us to delete information;

  • ask us to restrict how information is used;

  • object to certain uses of information;

  • ask us to transfer certain information to you or another organisation;

  • withdraw consent where we rely on consent;

  • object to direct marketing.

Some rights are subject to legal conditions and exemptions.

In most cases, there is no charge for exercising your rights. A reasonable fee may be charged in limited circumstances, such as where a request is manifestly unfounded or excessive, or where additional copies are requested.  

We will normally respond to a valid subject access request within one month. In some circumstances, including complex requests, the response period may be extended as permitted by law.  

We may ask for reasonable information to verify your identity before releasing personal information.

20. Your right to object

You have the right to object to our processing of your personal information where we rely on legitimate interests, and you have an absolute right to object to the use of your personal information for direct marketing.

The ICO recommends that the right to object is brought specifically and clearly to individuals’ attention.  

21. Complaints

If you are unhappy with how we have handled your personal information, please contact us first so that we have an opportunity to investigate.

You also have the right to complain to the Information Commissioner’s Office (ICO), the UK’s data-protection regulator.

Information Commissioner's Office⁠

22. Links to other websites

Our websites may contain links to websites operated by other organisations.

Once you leave our website, we are not responsible for how another organisation collects or uses your personal information. You should review that organisation’s privacy policy before providing personal information.

23. Changes to this Privacy Policy

We may update this Privacy Policy from time to time to reflect changes to our business, services, systems or legal obligations.