GDPR & Data Handling

Last updated: September 7, 2026

This notice describes how Baked by Rach processes personal data for visitors and customers of Baked by Rach in accordance with the EU General Data Protection Regulation (GDPR) and applicable UK/data-protection laws.

1. Data Controller

The data controller responsible for your personal data is:

Baked by Rach
[Your Company Address]
Eugene, Oregon
United States
[email protected]

2. Lawful Bases for Processing

We process personal data only where we have a lawful basis, including:

• Contract: To provide services you request or purchase.
• Legitimate interests: To operate, secure, and improve our website and business, balanced against your rights.
• Consent: For optional marketing, non-essential cookies, or other processing where consent is required.
• Legal obligation: Where we must retain or disclose data to comply with law.

3. Data We Process

Depending on how you use our site, we may process identity and contact details, account credentials, booking or order information, communications, technical logs, and payment-related metadata.

4. International Transfers

If personal data is transferred outside the European Economic Area, we use appropriate safeguards such as Standard Contractual Clauses or equivalent mechanisms.

5. Retention

We retain personal data only as long as necessary for the purposes described in our Privacy Policy, to meet legal obligations, or to resolve disputes.

6. Your Rights

If GDPR applies to you, you may have the right to access, rectify, erase, restrict, or object to processing, and to data portability. Where processing is based on consent, you may withdraw consent at any time.

To exercise your rights, contact us at [email protected]. You may also lodge a complaint with your local supervisory authority.

7. Data Protection Contact

For privacy or GDPR requests regarding Baked by Rach, contact:

Baked by Rach
[Your Company Address]
Eugene, Oregon
United States
[email protected]