Privacy policy

Who is responsible?

Butter Up is a home bakery operated by Jess in Voorburg, Zuid-Holland, Netherlands, and is responsible for the customer information used to handle bakery enquiries and orders. For privacy questions or requests, email jess@butterup.nl. Collection addresses are shared privately after an order is confirmed.

What we collect and why

If you enquire, we ask for your name, email address, type of bake, date and quantity or servings. You may also provide a phone number, flavour preferences, budget and design details. We use this information to answer your request, check availability, prepare a quote and, if you choose to order, arrange your bake. Required fields are needed to respond to your request; optional fields can be left blank.

We rely on taking steps at your request before entering a contract, and performing a contract for confirmed orders (GDPR Article 6(1)(b)). We do not use enquiry information for mailing lists or advertising.

Dietary and allergy information is optional and can reveal health or religious information. We ask for separate, explicit consent before accepting it. We use it only to assess and handle your request, relying on consent under Articles 6(1)(a) and 9(2)(a) where applicable. You may leave it blank and discuss requirements directly with Jess. Do not include medical history or another person’s identifiable health information. You can withdraw this consent by email at any time; this does not affect processing already lawfully carried out. Withdrawal may mean we can no longer assess the relevant requirement.

Hosting and security services may process an IP address, browser information and technical request details to deliver and protect the site. Security processing relies on legitimate interests in preventing abuse and keeping the site available.

Who receives the information?

Jess handles your enquiry. Resend sends the enquiry to the Butter Up inbox, and the inbox provider holds the correspondence. The website uses Cloudflare infrastructure for hosting and security.

Cloudflare Turnstile checks for automated abuse using technical signals such as IP address and browser information. It does not receive the cake enquiry fields from our form. Cloudflare also acts as a controller for certain improvements to its service. See Cloudflare’s Turnstile privacy addendum and Resend’s privacy policy.

Service providers can process information outside the European Economic Area. You can request information from Jess about the providers used and their data-transfer arrangements. The website does not sell your data or embed social feeds; Instagram links open only when you choose to follow them.

How long do we keep it?

Enquiries that do not become orders are kept for six months after the last contact. Confirmed order information is kept for the period necessary to fulfil the order and any applicable accounting or legal obligations. Information needed for a specific dispute is retained only as long as needed for that dispute.

Optional sensitive dietary details should be removed once the relevant request or order has been completed and no longer needs them, or after consent is withdrawn unless another lawful exception applies. Correspondence is reviewed and deleted in line with these periods. Provider security logs and backups may follow the provider’s own limited retention periods. This website code does not save enquiry details to a database, browser storage or application logs.

Your choices and rights

You can ask to access or correct your information, request deletion, restriction or portability where applicable, and object to processing based on legitimate interests. You can withdraw consent for optional sensitive dietary information. Email jess@butterup.nl. We will normally respond within one month and may ask for proportionate information to verify your identity. We do not make automated decisions about bookings.

You can also complain to the Dutch supervisory authority, the Autoriteit Persoonsgegevens.

Cookies and security

Our website code sets no advertising or analytics cookies and serves its fonts and images locally. Essential hosting, authentication and security functions may use cookies or similar technology. See the cookie notice for details of this functionality. We minimise the details collected, validate submissions on the server and keep email credentials outside browser code. Access to the inbox and provider accounts is restricted, and credentials are kept outside the browser code.

Changes to this policy

If the way we use information changes, we will update this page and its date. New optional tracking would require a separate consent mechanism before it is loaded.