Privacy policy

Last updated: 15 August 2026

This Privacy Policy explains how Black Box Bakery Ltd (trading as Black Box Donuts, and referred to here as “we”, “us” or “our”) collects, uses, shares and protects your personal information when you visit www.blackboxdonuts.co.uk (the “Site”), use our mobile app for iOS and Android (the “App”), place an order with us, or otherwise interact with us.

We are the “data controller” of your personal information for the purposes of the UK General Data Protection Regulation (UK GDPR) and the Data Protection Act 2018.

1. Who we are and how to contact us

Black Box Bakery Ltd
Registered in Northern Ireland, company number NI736775
Registered office: Unit 18, 63a Castlewellan Road, Newcastle, County Down, BT33 0JX, United Kingdom
Email: customercare@blackboxdonuts.co.uk

If you have any questions about this policy, want to exercise your rights, or wish to make a complaint about how we handle your information, please email us at customercare@blackboxdonuts.co.uk or write to us at the address above.

2. The information we collect

Information you give us

  • Order information: your name, billing address, delivery address, email address, phone number, the contents of your order, your chosen delivery date, and any gift message or delivery instructions you provide.
  • Payment information: payment card details are collected and processed directly by our payment providers (including Shopify Payments, and wallet providers such as Apple Pay, Google Pay, Shop Pay and PayPal where you choose them). We do not store your full card number on our systems.
  • Account information: if you create an account, your login details, saved addresses and order history.
  • Subscription information: if you subscribe, your chosen frequency, next delivery and payment dates, flavour preferences, and the history of boxes sent, skipped or paused.
  • Marketing preferences: whether you have opted in to receive marketing emails or SMS from us.
  • Customer service information: the content of emails, contact form submissions, social media messages and any photographs you send us in support of an order issue.
  • Wholesale, corporate and event enquiries: your business name, contact details, delivery requirements and any information you give us when requesting a quote or trade account.
  • Reviews and competition entries: your name, review content, photographs and social media handle where you choose to submit these.
  • Gift recipient information: if you send donuts to someone else, the recipient's name, delivery address and contact details, and any personalised gift message you write. If you give us someone else's details, please make sure you have their permission first — we'll use those details only to deliver the gift and your message.

Information we collect automatically

  • Device and usage information: your IP address, browser type and version, operating system, device type, time zone setting, referring website, the pages and products you view, search terms you use, and how you move through and interact with the Site.
  • Session activity: we use session replay and heatmap technology (see section 6) which records page views, mouse movements, clicks, scrolling and taps on the Site so we can understand where our pages are confusing or broken.
  • Cookies and similar technologies: see section 6 below.

Information we collect through the App

  • App and device information: device model, operating system version, app version, language and region settings, and a mobile advertising or device identifier.
  • Push notification tokens: if you allow notifications, a token that lets us send them to your device. You can revoke this at any time in your device settings.
  • App activity: which screens and products you view, what you add to your basket, and crash and performance diagnostics.

We do not collect location data, contacts, photos or health data from your device.

3. How we use your information, and our lawful bases

What we use it for Lawful basis
Taking and processing your order, taking payment, and delivering your donuts Performance of our contract with you
Sending order confirmations, dispatch notifications and tracking information Performance of our contract with you
Running your subscription — scheduling boxes, taking renewal payments and sending renewal reminders Performance of our contract with you
Answering your questions and resolving problems with an order Performance of our contract with you; our legitimate interest in running a responsive business
Screening orders for fraud and preventing misuse of the Site Our legitimate interest in protecting our business; compliance with legal obligations
Keeping records of sales, refunds and complaints Compliance with our legal obligations (including tax, accounting and food safety law)
Sending you marketing emails and SMS about new products, offers and restocks Your consent, or our legitimate interest where you are an existing customer buying similar products (you can opt out at any time)
Measuring how the Site performs and improving it Your consent (where cookies or similar technologies are used); our legitimate interest in improving our service
Showing you our advertising on social media and other websites Your consent
Publishing reviews and customer photographs where you have submitted them Your consent
Delivering a gift and its personalised message to a recipient you have named Performance of our contract with you; our legitimate interest, and the recipient's, in the gift arriving
Sending push notifications about your order through the App Performance of our contract with you
Sending marketing push notifications through the App Your consent (given when you allow notifications; withdraw it in your device settings)

Where we rely on your consent, you can withdraw it at any time. Withdrawing consent does not affect the lawfulness of anything we did before you withdrew it.

4. Who we share your information with

We do not sell your personal information. We share it only with the service providers who help us run the business, and only so far as they need it:

  • Shopify Inc. — our e-commerce platform, which hosts the Site, processes orders and stores customer records. Shopify's privacy policy is at shopify.com/legal/privacy.
  • Payment providers — including Shopify Payments and, where you choose them, PayPal, Apple Pay, Google Pay and Shop Pay, to take payment and process refunds.
  • Royal Mail and any other carrier we use to deliver your order — we share your name, delivery address, email address, phone number and delivery instructions so your parcel can be delivered and tracked.
  • Recharge — our subscription platform, which manages recurring orders, stores your subscription schedule and delivery preferences, and takes renewal payments. Recharge's privacy policy is at getrecharge.com/privacy-policy.
  • Klaviyo — our email and SMS marketing platform, which stores your contact details, marketing preferences and purchase history so we can send you relevant messages. Klaviyo's privacy policy is at privacy.klaviyo.com.
  • Meta Platforms (Facebook and Instagram) and TikTok — where you have consented to advertising cookies, we share information about your activity on the Site so we can measure our advertising and show you relevant ads.
  • Giftnote — where you send donuts as a gift, we share the recipient's name and contact details and your personalised message so it can be delivered to them. Giftnote's privacy policy is at giftnote.com/privacy-policy.
  • Google — we use Google Analytics 4 to understand how visitors use the Site and the App, and Google Play distributes our Android app.
  • Apple — the App Store distributes our iOS app. Apple and Google each apply their own privacy policies to your use of their stores.
  • Microsoft — we use Microsoft Clarity for session replay and heatmaps (see section 6).
  • Our professional advisers — accountants, insurers and legal advisers, where necessary.
  • Authorities and regulators — where we are legally required to disclose information, for example to comply with a court order, a lawful request from law enforcement, or a food safety investigation.

If our business is sold or transferred, your information may be transferred to the buyer as part of that transaction.

5. International transfers

Some of our service providers are based outside the UK, including in the United States, Canada and the European Economic Area. Where your personal information is transferred outside the UK, we make sure it is protected by an appropriate safeguard recognised under UK data protection law — usually UK adequacy regulations or the International Data Transfer Addendum to the EU Standard Contractual Clauses.

You can ask us for more detail about the safeguards that apply to a particular transfer by emailing customercare@blackboxdonuts.co.uk.

6. Cookies, analytics and session recording

A cookie is a small file placed on your device when you visit a website. We use several types:

  • Strictly necessary cookies — these make the Site work. They remember what is in your basket, keep you logged in, secure the checkout and manage your privacy preferences. The Site will not work properly without them, so they do not require consent.
  • Analytics and performance cookies — these tell us which pages are visited, how people arrive at the Site, and where they run into problems. We use Shopify's built-in analytics and Google Analytics 4.
  • Advertising and social media cookies — these let us measure our advertising on Meta (Facebook and Instagram) and TikTok, and show you ads for products you have looked at.

Session recording. We use Microsoft Clarity to record how visitors use the Site. Clarity captures page views, clicks, taps, scrolling and mouse movement, and builds anonymised heatmaps and playbacks of browsing sessions. We use this only to find and fix usability problems. Clarity is configured to mask text input fields, so it does not capture what you type into forms such as your address or payment details. You can read Microsoft's privacy statement at microsoft.com/privacy/privacystatement.

In the App. Apps don't use cookies in the same way, but we collect equivalent analytics and diagnostics through the App as described in section 2. You can limit ad tracking through your device's privacy settings — “Allow Apps to Track” on iOS, or “Ads” in Google settings on Android — and turn push notifications off at any time.

You can change your cookie preferences at any time using the cookie banner or preferences link on the Site. You can also block or delete cookies through your browser settings, though parts of the Site may then stop working correctly.

To opt out of advertising specifically, you can also use:

Because there is no consistent industry standard for responding to browser “Do Not Track” signals, we do not currently change our practices when we receive one. We do respect the choices you make through our cookie banner.

7. Marketing

If you have opted in, or if you have bought from us before, we may email or text you about new flavours, restocks, offers and events. Every marketing email contains an unsubscribe link, and you can reply STOP to any marketing SMS. You can also email customercare@blackboxdonuts.co.uk and ask us to remove you.

If you use the App and have allowed notifications, we may also send marketing push notifications. Turn these off at any time in your device settings.

Opting out of marketing will not stop transactional messages about an order you have placed — order confirmations, dispatch notices and delivery updates.

8. How long we keep your information

  • Order and transaction records: six years from the end of the financial year in which the order was placed, to meet HMRC and accounting requirements.
  • Account information: for as long as your account is open, and for up to two years after your last order if you do not close it.
  • Subscription records: for as long as your subscription is active, and then with your order history under the retention period above.
  • Marketing contact details: until you unsubscribe, and then on a suppression list so we do not contact you again by mistake.
  • Customer service correspondence: up to three years after the issue is resolved.
  • Gift recipient details and messages: kept with the order record, and not used to market to the recipient unless they sign up themselves.
  • Analytics and advertising data: typically between 30 days and 26 months, depending on the provider.

9. Your rights

Under UK data protection law you have the right to:

  • Be informed about how we use your personal information — which is what this policy is for.
  • Access a copy of the personal information we hold about you.
  • Rectification — have inaccurate information corrected or incomplete information completed.
  • Erasure — ask us to delete your personal information, where we have no ongoing lawful reason to keep it.
  • Restrict processing in certain circumstances.
  • Data portability — receive the information you gave us in a portable format, or have it sent to another provider.
  • Object to processing based on our legitimate interests, and to object at any time to direct marketing.
  • Withdraw consent at any time where we rely on it.

To exercise any of these rights, email customercare@blackboxdonuts.co.uk. We will respond within one month. There is no charge, and we may ask you to confirm your identity before we act.

10. Automated decision-making

We do not make decisions about you by fully automated means that produce legal effects or similarly significantly affect you. Shopify applies limited automated fraud screening to orders — for example temporarily blocking IP addresses or payment cards linked to repeated failed transactions — and a human at Black Box reviews any order flagged as high risk before it is cancelled.

11. Security

We take appropriate technical and organisational measures to protect your personal information, including encryption of data in transit, access controls limiting who on our team can see customer data, and using reputable providers who maintain recognised security standards. No system is completely secure, but we will notify you and the Information Commissioner's Office promptly if a breach occurs that is likely to put your rights at risk.

12. Children

The Site and the App are not intended for children under 16, and we do not knowingly collect personal information from them. Orders must be placed by someone aged 18 or over. If you believe a child has given us personal information, please contact us and we will delete it.

13. Changes to this policy

We may update this policy from time to time to reflect changes to our practices or for legal, operational or regulatory reasons. The date at the top shows when it was last revised. Where changes are significant, we will let you know by email or by a notice on the Site and in the App.

14. Complaints

If you are unhappy with how we have handled your personal information, please contact us first at customercare@blackboxdonuts.co.uk so we can try to put it right.

You also have the right to complain to the Information Commissioner's Office, the UK supervisory authority for data protection:

Information Commissioner's Office
Wycliffe House, Water Lane, Wilmslow, Cheshire, SK9 5AF
Helpline: 0303 123 1113
ico.org.uk/make-a-complaint