Privacy policy
[TBC legal review]
This notice explains how your personal data is used when you visit hemicastillo.com, send an enquiry or book a service. It follows the UK GDPR and the Data Protection Act 2018.
Who we are
The data controller is From Scratch by Hemi [TBC legal name and address], a sole trader offering private chef, cooking masterclass and event catering services in London. You can contact us at hi@hemicastillo.com [TBC].
What data we collect
Enquiry form
When you use the form, we collect:
- your name, email address and phone number
- your company name, if you give one
- event details: date, location, number of guests, budget and type of service
- dietary requirements and allergies
Dietary and allergy information can reveal health or religious beliefs. This is special category data. We ask for it only so we can cook safely for you, and we handle it on the basis of your explicit consent.
WhatsApp and email
If you contact us by WhatsApp or email, we receive your number or address and the content of the messages.
Website analytics
We use Cloudflare Web Analytics, which does not use cookies and does not track you across sites. We may also use Google Analytics 4 [TBC], only if you accept analytics cookies.
How and why we use your data
| Purpose | Lawful basis |
|---|---|
| Reply to your enquiry and prepare a quote | Steps before a contract, at your request |
| Deliver a booked service, take payment | Contract |
| Keep financial records | Legal obligation |
| Improve the website and understand what works | Legitimate interest (cookieless analytics) or consent (Google Analytics) |
| Cater for allergies and dietary needs | Explicit consent |
| Contact you about a past booking or rebooking | Legitimate interest |
We do not send marketing newsletters without your consent, and you can withdraw consent at any time.
Who we share data with
We use trusted providers to run the service.
- Resend sends emails from the enquiry form. Data may be processed in the US or EU. Where data leaves the UK, we rely on standard contractual clauses or an equivalent safeguard.
- Cloudflare hosts the website and provides analytics and security.
- Payment and accounting providers process payments and records when you book [TBC].
- Professional advisers such as accountants, where needed.
We do not sell your data. We do not share it for advertising.
International transfers
Some providers are based outside the UK. When we transfer data abroad, we make sure there is an adequate safeguard, such as the UK International Data Transfer Addendum or standard contractual clauses.
How long we keep it
- Enquiries that don’t become bookings: 24 months, then deleted.
- Booking records, invoices and payment details: 7 years, as required for HMRC.
- Dietary and allergy information: deleted within 12 months of the event unless you ask us to keep it for future bookings.
- Analytics data: according to the provider’s settings, usually up to 14 months.
Your rights
You can ask us to:
- give you a copy of your data (access)
- correct anything wrong (rectification)
- delete your data (erasure), where the law allows
- restrict how we use it
- send it to you or another provider (portability)
- stop using it for legitimate interest purposes (objection)
- stop relying on your consent, at any time
To use these rights, email hi@hemicastillo.com [TBC]. We reply within one month.
If you are unhappy with how we handle your data, you can complain to the Information Commissioner’s Office at ico.org.uk or on 0303 123 1113. We would appreciate the chance to fix it first.
Cookies
We use only two kinds.
- Essential: needed for the site to work, such as security and form protection. These don’t need consent.
- Analytics: Cloudflare Web Analytics uses no cookies. If we turn on Google Analytics 4 [TBC], it will set cookies only after you accept, and you can change your mind through the cookie banner or your browser settings.
We don’t use advertising cookies.
Children
This website is for adults and is not aimed at children. We don’t knowingly collect data from anyone under 16. If you think a child has sent us data, contact us and we will delete it.
Security
We take reasonable steps to protect your data, including encrypted connections (HTTPS) and limited access to enquiries. No online service is perfectly secure, so please don’t send payment card details by email or WhatsApp.
Changes to this notice
We may update this notice. The date at the top shows the latest version. Material changes will be flagged on this page.
Contact
Questions about privacy: hi@hemicastillo.com [TBC].