Legal
Privacy policy
Last updated: 4 November 2026 · Draft for legal review
This policy explains how JBake collects and uses personal data when you visit jbake.eu, place an order or send us an inquiry, in line with the EU General Data Protection Regulation (GDPR, Regulation (EU) 2016/679) and Cyprus Law 125(I)/2018.
1. Who we are
The data controller is JSH FIVE STAR HOSPITALITY LTD, T.I.C. & VAT No. 10398226W, Georgiou A’ 81, Potamos Germasogeias, 4047 Limassol, Cyprus. E-mail: [email protected], phone +357 97 988896.
2. What we collect, why, and on what legal basis
| Purpose | Data | Legal basis (Art. 6 GDPR) | Kept for |
|---|---|---|---|
| Preparing, delivering and charging for your order | Name, e-mail, phone, delivery address (delivery only), date & time, items, inscription, order notes | Contract (6(1)(b)) | Up to 6 years after the order, for tax and accounting duties |
| Accounting, invoices and tax | Order and payment records (no full card numbers) | Legal obligation (6(1)(c)) | 6 years (Cyprus tax law) [confirm with accountant] |
| Answering bespoke inquiries | Name, e-mail, phone, event date, guests, budget, your message | Steps prior to a contract (6(1)(b)) | 12 months if no order follows |
| Allergy information you choose to give us | Allergies relevant to your cake | Your explicit consent (6(1)(a), 9(2)(a)) — only to make your cake safely | Deleted with the order data |
| News of seasonal collections (optional) | E-mail, language | Consent (6(1)(a)) — tick box, unticked by default | Until you unsubscribe |
| Site security and fraud prevention | Technical logs (IP address, browser) held by our host | Legitimate interest (6(1)(f)) | Up to 30 days [per hosting provider] |
| Anonymous statistics (optional) | Aggregated visit data | Consent via cookie settings | See cookie policy |
We collect only what is needed (data minimisation). Optional fields are marked. We do not make automated decisions or profile you.
3. Payments
Card payments are processed by Stripe Payments Europe, Ltd. (Ireland) on Stripe’s own secure page. We never receive or store your full card number. Stripe acts as an independent controller for fraud prevention and regulatory duties; see stripe.com/privacy.
4. Who receives your data
- Payment processing: Stripe (EU).
- Website hosting & serverless functions: Cloudflare, Inc. (Cloudflare Pages) [temporary — update if the site moves to another host].
- Transactional e-mail: [e-mail provider, e.g. Resend / Zoho (EU region)].
- Delivery: our own driver or [courier company] — name, phone and address only.
- Our accountant and public authorities when the law requires it.
We never sell your data. Some providers may process data outside the EEA; where they do, they rely on an EU adequacy decision (e.g. the EU–US Data Privacy Framework) or Standard Contractual Clauses.
5. Your rights
You may request access, correction, deletion, restriction, portability, or object to processing based on legitimate interest. Where processing relies on consent, you can withdraw it at any time without affecting prior processing. Write to [email protected]; we reply within one month.
You may also complain to the Commissioner for Personal Data Protection, 1 Iasonos St., 1082 Nicosia, Cyprus — dataprotection.gov.cy.
6. Security
The site is served only over HTTPS. Order data is accessible only to staff who need it. Payment data stays with Stripe.
7. Children
Orders must be placed by adults (18+). We do not knowingly collect data from children.
8. Changes
We will publish any update on this page with a new date.