Privacy policy

Version 2.3, in force from 22 October 2026.

1. Who is responsible

ColdCake, company number (KBO) 1027149628, is responsible for your data. Privacy questions: info@coldcake.be. All business details are in the Legal notice.

2. As a sender

2.1 Which data

  • Contact and invoicing: name, email, phone, billing address, company name, VAT number.
  • Order: what you ordered, design, message, delivery date, amount; never your full card number. Part of it is also in the QR link (3.2).
  • Emails with us, and a call booked in our calendar: name, email, time, your notes.
  • Website use (pages, clicks), only after cookie consent; newsletter opens and clicks, only if you signed up.

Without name, email, billing and delivery details we cannot carry out your order; a Peppol e-invoice also needs company name and VAT number.

2.2 Why, and on what basis (article 6(1) GDPR)

  • Your order, campaign emails, a booked call: the contract or steps before it at your request (b).
  • Invoices and withdrawals: legal obligation (c).
  • Newsletter and website statistics: your consent (a).
  • Preventing fraud, securing the web shop: legitimate interest (f).

2.3 How long

  • Orders, invoices, withdrawals: 10 years (tax retention).
  • Account and contact details, also of a booked call: while your account is active, plus 3 years.
  • Emails with us: 3 years after the last contact (recipient data: 3.1).
  • Newsletter consent: until you unsubscribe, plus 1 year as proof.
  • Website statistics: at most 14 months.

2.4 Your responsibility for the recipient's data

Before you order, a required checkbox has you confirm that the recipient's address is a business address and that you have a lawful basis under article 6(1)(f) GDPR to send them a gift at work. You are the controller for passing that data on; ColdCake is a separate controller (chapter 3).

3. As a recipient

3.1 Which data, why and for how long

The sender gives us your data when ordering or in a campaign briefing: name, company, workplace delivery address, delivery date and time block, and if entered your job title, email, phone and a second contact person (also covered here), plus the sender's message; we add our delivery photo. We use this only to deliver the cake and show the sender it arrived (our delivery photo, with a yes, also as in 3.6); email and phone only to arrange delivery. If the sender chose a scheduled delivery, we call the number the sender gave, or otherwise the general number on your company's website, only to agree a moment for the delivery. Basis: legitimate interest (article 6(1)(f) GDPR): a professional introduction at a business address, and the delivery.

  • For a single order, the web shop order holds all of it for 10 years; ColdCake cannot erase your data from it separately. An order the sender does not complete is removed after 3 months.
  • The invoice is made from the order; anything of yours on it stays 10 years (tax retention).
  • Our email and newsletter service gets a copy of every order, completed or not, with no end date there today; ColdCake cannot erase it separately.
  • ColdCake's own copies (planning, campaign briefing, email, our delivery photo): we keep them only as long as needed for the delivery, the invoice and the legal retention period, a delivery photo with a yes also while it is online (3.6), and erase them earlier if you ask.

3.2 The QR code

The QR code opens a link with your first name, the sender's name and company and sometimes their message and email, so the page greets you and shows who sent the cake. Anyone with the link sees this. 30 days after delivery we remove the names, email and message from the link; the QR code keeps working.

That page, without asking, sends our database notices: the order code, which steps were used when and for how long (camera permission, camera, design recognised, video, sound, info tabs, photo, sender's button), how the scan ended, and faults. With them come a rough description of your device (the operating system and the browser, with their version numbers), the size of the camera image, and a random number per visit to that page, so the notices of one scan belong together. No cookies and no IP address. On your device that page only stores what is listed on coldcake.be/pages/cookies (chapter 6). Basis: legitimate interest in showing that the cake arrived and was viewed, and in fixing faults. On request we tell the sender whether their cake was scanned. After 12 months we delete the notices and keep only counts without the order code.

The page behind the same QR code, and the AR demo page, also has a button with the discount code EERSTECAKE20. It is 1 shared code, not linked to a person; if you redeem it, it appears on your new order. If you start an order on the page of a specific cake, not on the AR demo page, the short code of that cake travels with your order as a hidden attribute, so we can see which cake your order came from.

3.3 Allergies: no health data

ColdCake asks for and processes no health data (article 9 GDPR), allergies included. Anyone can ask info@coldcake.be for the full ingredient and allergen specification of a flavour; we send it. Health data emailed to us anyway is deleted at once; we send only the specification. Put nothing about health in an order field: we cannot erase it there.

3.4 If ColdCake approaches you itself

Sometimes ColdCake itself sends a cake to a company, to introduce ColdCake. If you received such a cake from ColdCake, this section applies and not 3.1: we chose you ourselves, and your data did not come from a sender.

  • Which data: your name, your role, the address of your workplace and your company's general email address; your own email address and your phone number only if you gave them to us yourself.
  • Where we found it: on your company's website, in the Crossroads Bank for Enterprises (KBO) and on LinkedIn. We only get your own email address and your phone number from you, at delivery, in a reply to an email or on the phone; we note them with the date.
  • What for: 1 cake at your workplace, and then a short contact about ColdCake: at most 4 emails and a phone call. A first email goes to your company's general address; if your company lists no general address, that first email goes to the business address of a contact person your company itself makes public. Otherwise we only email your own address if you said yes to that. We only call a number you gave us yourself, and only if you said we could call. If you do not answer, we try at most 1 more time; if you ask for a later moment yourself, we call then. If you make an appointment with us, we then only email you about that appointment.
  • On what basis: legitimate interest (article 6(1)(f) GDPR): introducing ColdCake to a company, at a business address.
  • How long: 12 months after the last contact; then we delete it. If you object, we delete it at once and keep only what we need so that we do not approach you again.
  • With whom: with no one for their own marketing. The partner bakery only sees the design that goes on the cake. For the page behind the QR code, 3.2 applies.

You can always object, without giving a reason (article 21 GDPR). Reply STOP to an email from ColdCake, say so on the phone, or email info@coldcake.be. Then we no longer email or call you. You only receive 1 more email confirming that we noted your request.

3.5 Your feedback

We store the answers from our feedback page to improve our service and keep them for at most 12 months, with your name, company or email address only if you fill them in yourself.

3.6 Photos and references

This section applies to senders and recipients. We only show a photo or video of a cake we delivered, our delivery photo included, with a written yes.

  • Where: only in ColdCake's posts on LinkedIn, Instagram and TikTok and on coldcake.be. The image is public there.
  • Who we ask: the sender, per cake, in the email with the delivery photo. The sender chooses: an image with nothing that identifies their company, or an image with their company name and logo, and then we may also name their company as a reference. For a cake from ColdCake itself (3.4) we ask the company that received it. Without a reply, or with a no, we show nothing, and nothing changes about the order or the delivery.
  • What we make unrecognisable: faces and names of people, unless that person says yes in writing themselves; the name and logo of the company that received the cake, unless that company says yes in writing itself; the delivery address and the QR code (3.2), without exception.
  • On what basis: consent (article 6(1)(a) GDPR).
  • How long: the image while it is online; every yes, with its date, until the image is offline, plus 1 year as proof.
  • Withdrawing: at any time, without a reason, via info@coldcake.be or by replying to our email. Within 7 working days we remove the image and the name from coldcake.be and from our posts. What happened before stays valid. We cannot recall what others already saved or shared.

4. Your right to object

You can object at any time to processing based on legitimate interest, on grounds relating to your situation, and always to direct marketing (article 21 GDPR). Email info@coldcake.be. A recipient who wants no more cakes uses the subject "Geen ColdCake meer": within 5 working days you are permanently on a block list and nobody can send you a cake through us. We keep only what is needed to recognise you, and tell the sender, without your reason (legitimate interest: respecting your objection). A delivery photo showing you is deleted on request within 7 working days.

5. Cookies

Strictly necessary cookies (cart, session, language) need no consent; statistics and marketing cookies only follow your consent in the cookie bar, shown on every page, the QR page included, until you choose. Change it via "Manage cookies" in the footer; the QR page has none, so use the one at the bottom of coldcake.be/pages/cookies, which explains the cookies. Your choice covers the whole site.

If you consent to statistics and marketing in the cookie bar, the Klaviyo pixel, our email and newsletter service, also passes on your visit: for example which pages and products you view and what you put in the cart. If we know your email address, Klaviyo can link your visit to that address. Without that consent the pixel does not load.

6. Who we share data with

Only as needed, with: the web shop platform, payment providers, the email, newsletter and calendar services, the statistics service (after consent), the database and hosting of the QR page, the services that deliver fonts and program code to your browser (Google Fonts, Cloudflare's cdnjs and, on the page behind the QR code, jsDelivr; they see your IP address when doing so), the invoicing service and Peppol access point, our email and office software, the partner bakery, our accountant, the sender (3.2, 4), and authorities where the law requires. We sell no personal data and give none to anyone for their own marketing.

7. Outside Europe

Some providers also process data outside the EEA, only under an adequacy decision or the European Commission's standard contractual clauses. Ask info@coldcake.be for a copy.

8. Your other rights

You have the right of access, rectification, erasure, restriction and portability, and can withdraw consent at any time without affecting earlier processing. On request ColdCake erases what it holds itself (3.1, 3.2); from the order, the invoice and the email service copy nothing can be erased separately. Email info@coldcake.be; we answer within one month. No automated decisions are made about you. Complaints: Gegevensbeschermingsautoriteit (Belgian Data Protection Authority).

9. Changes

Important changes are announced 14 days ahead by email to active customers.