How we look after your data

Who we are

The Treat Stop is a small artisan bakery in Deux-Sèvres, France, trading online at www.thetreatstop79.com. The data controller for the information described in this policy is:

You can contact us about anything to do with your data at orders@thetreatstop79.com.

What we collect and why

When you place an order we ask for:

• Your name, phone number and email address — so we can identify your order at collection, send your receipt and collection details, and contact you if there is a problem with your order.
• Your chosen collection village — so we know where to bring your order.
• Allergies or notes (optional) — anything you tell us here is used only to prepare your order safely. Please only include what is necessary.
• Your order details — the items, sizes and options you chose, the total paid and your order number.

We rely on the performance of a contract as our legal basis: we need this information to take, prepare and hand over your order. We keep your order records afterwards to meet our legal obligations (accounting and tax) and to deal with any questions about your order.

We do not use your details for marketing, we do not build profiles, and we never sell or share your data with anyone for their own purposes.

Payments

Card payments are taken by Stripe, a PCI-DSS certified payment provider. Your card number is entered on Stripe's secure payment page and is never seen or stored by us. Stripe receives your email address and the items you are paying for so it can process the payment and send its own receipt. Stripe's privacy policy is available at stripe.com/privacy.

Who else sees your data

To run this website we use a small number of trusted service providers who process data on our behalf and under our instructions:

• Vercel hosts the website.
• Neon stores our order database, in the European Union.
• Resend delivers our order and collection emails.
• Stripe processes card payments, as described above.

Some of these providers are based in the United States. Where data leaves the EU, it is protected by the European Commission's Standard Contractual Clauses or the EU-US Data Privacy Framework.

Cookies and your browser

This website does not use tracking or advertising cookies and does not use analytics tools. Your basket is saved in your own browser's local storage so that it survives between pages; it never leaves your device until you place an order, and you can clear it at any time using the Clear basket button or by clearing your browser data. Stripe may set strictly necessary cookies on its own payment page to prevent fraud.

How long we keep your data

We keep your order details for as long as we are required to by French accounting law, which is 10 years from the end of the financial year in which the order was placed. Allergy notes are deleted once the Christmas 2026 season is over. Unpaid, abandoned checkouts are removed automatically.

Your rights

Under the GDPR you have the right to:

• ask for a copy of the personal data we hold about you;
• have inaccurate data corrected;
• have your data deleted, where we are not legally required to keep it;
• restrict or object to how we use it;
• receive your data in a portable format.

To exercise any of these rights, email orders@thetreatstop79.com and we will respond within one month. If you are unhappy with how we have handled your data you can complain to the French data protection authority, the CNIL (www.cnil.fr), or to the authority in your own EU country.

Keeping your data safe

Your data is transmitted over encrypted connections (HTTPS) and stored in an access-controlled database. Only the people who prepare and hand over your order can see it, and access is protected by a PIN.

Changes to this policy

If we change this policy we will update the date at the top of this page. Any changes apply to orders placed after that date.