Who we are
Cambridge Bagels (“we”, “us”) is a pre-launch bagel shop based in Cambridge, United Kingdom. For UK GDPR purposes we are the data controller of personal data collected through cambridgebagels.com.
Contact the controller at ryan@cambridgebagels.com. We will update this notice with a registered company name, company number, and postal address once those details are final.
What we collect
Depending on how you use the site, we may process:
- Email address — when you join the founding-member list, leave an optional survey email, or apply for a role.
- Survey answers — bagel preferences, visit habits, dietary notes, postcode area, and free-text comments you choose to share.
- Careers applications — name, email, phone, work history, references, and any CV or documents you upload.
- Attribution tag — a short first-party cookie value (for example which share link you used) when you arrive via a tagged URL.
- Basic visit data — page path, referrer, and attribution tag, stored so we can understand which channels bring people to the site.
- Technical data our hosting provider may log (IP address, user agent, timestamps) as part of operating the website.
Why we use it (purposes & lawful bases)
- Founding-member list & launch updates — consent (you opted in). Lawful basis: UK GDPR Art. 6(1)(a).
- Survey & product research — legitimate interests in designing the shop, menu, and location; or consent where you give an email for follow-up. Art. 6(1)(f) / 6(1)(a).
- Recruitment — steps prior to a contract / legitimate interests in hiring. Art. 6(1)(b) / 6(1)(f).
- Site analytics & attribution — legitimate interests in measuring reach and improving the site. Art. 6(1)(f). Non-essential cookies are described in our Cookie Policy.
- Transactional messages (welcome, survey thank-you, application confirmation) — necessary to respond to your request. Art. 6(1)(b) / 6(1)(f).
We do not sell your personal data. We do not use your email for third-party advertising.
Email marketing
If you join the list, we may email you about opening news, founding-member perks, menu previews, and related Cambridge Bagels updates. That is direct marketing under the Privacy and Electronic Communications Regulations (PECR).
Every marketing email will include a clear way to unsubscribe. You can also email us at any time to opt out. We will stop marketing promptly; we may keep a suppression record so we do not contact you again by mistake.
Transactional emails (for example confirming a signup or application) are not marketing, but we keep them to a minimum.
How long we keep it
- Founding-member emails — until you unsubscribe, or we close the list after launch and decide a shorter retention period; we will then delete or anonymise unused contacts.
- Survey responses — while useful for opening decisions, then anonymised or deleted (target: within 24 months of opening unless you ask sooner).
- Unsuccessful careers applications — normally deleted within 12 months unless you ask us to keep them for future roles.
- Visit / attribution logs — aggregated or deleted on a rolling basis (typically within 24 months).
- Suppression / unsubscribe records — kept as long as needed to honour your opt-out.
Your rights
Under UK GDPR you can ask us to: access your data, correct it, erase it, restrict processing, object to processing (including direct marketing), and receive a portable copy where applicable. Where we rely on consent, you can withdraw it at any time.
Email ryan@cambridgebagels.com with the subject “Data request”. We aim to respond within one month. You can also complain to the UK Information Commissioner’s Office (ICO) at ico.org.uk.
Security
We use access controls, HTTPS, and provider security features appropriate to a small pre-launch business. No method of transmission or storage is perfectly secure — if we become aware of a breach affecting your rights, we will notify you and the ICO where required.
Children
The site is aimed at adults interested in our shop and jobs. We do not knowingly collect children’s data for marketing. If you believe we have, contact us and we will delete it.
Changes
We may update this policy as the business opens or our tools change. The “Last updated” date at the top will change when we do. Material changes affecting how we use list emails will be called out by email or a notice on the site where practical.