What happens to your details.
The short version: we use what you send us to answer your enquiry and arrange your order, and to see what people ask about. We do not sell or share your details for marketing, and we do not send marketing ourselves. The longer version follows.
Who we are
This site is run by Marshmallow.uk, an artisan confectionery business based in Edinburgh. For anything in this policy, write to info@marshmallowbakery.co.uk or call +44 7442 098598.
What we collect, and why
When you send an enquiry through the form, by email, by phone or on WhatsApp, we receive what you give us: your name, email address, the date you need it and what you would like, plus whatever else you choose to add, such as your phone number, collection or delivery, a delivery postcode, a headcount, how you heard about us or a note in your message.
The form also sends three things you do not type: whether you chose an order, an event or corporate gifts, which page of this site you came from, and which product you started from, if you started from one. We use these to see what people ask about. They arrive with your enquiry and nowhere else, and nothing follows you around the site.
We use all of it to reply, to quote, and to fulfil your order if you place one. That is the whole list.
Allergies and dietary needs
If you tell us about an allergy or a dietary need, that can count as health information, which the law treats with extra care. We ask only so that we can tell you plainly what we can stand behind for your order, and we use it for nothing else. By including it you are asking us to, and we treat that as your explicit consent (UK GDPR article 9(2)(a)). You can withdraw it at any time by emailing us, and we will delete it.
The lawful basis is that you have asked us to take steps towards an order (UK GDPR article 6(1)(b)), and our legitimate interest in keeping a record of the correspondence afterwards and in seeing what people ask about.
The site itself sets no cookies and runs no analytics. There are no accounts and no marketing lists.
Who handles it on the way
We do not pass your details to anyone for their own use. A small number of services process them on our behalf, as any email-based business has:
- FormSubmit relays the enquiry form to our inbox and does not keep your submission beyond delivering it (their privacy policy).
- Microsoft hosts our mailbox (Outlook), so your enquiry is stored there like any email you send us.
- WhatsApp (Meta) carries your messages if you contact us there. It sees your number and what you send, under its own privacy policy, and we see the same.
- Cloudflare hosts this website and keeps short-lived server logs, including IP addresses, for security and operations.
Everything else, typefaces included, is served from this site itself, so loading a page tells no one but our host that you visited.
Some of these providers process data outside the UK; where they do, they rely on the standard safeguards UK law provides for such transfers.
How long we keep it
Enquiry correspondence is kept for up to two years after our last exchange, then deleted. If an enquiry becomes an order, we keep the records of the transaction for six years, as HMRC requires. Allergy and dietary details are kept with the enquiry, on the same terms.
Your rights
You can ask us at any time for a copy of what we hold about you, to correct it, to delete it, or to stop using it. One email is enough. If you are unhappy with how we have handled your details, you can complain to the Information Commissioner's Office at ico.org.uk.
Last updated October 2026.