Privacy policy
Privacy policy
Allez-y Limited t/a Baked by Nicola - Privacy Policy
This privacy policy has been compiled to better serve those who are concerned with how their 'Personally Identifiable Information (PII) is being used online. PII is information that can be used on its own or with other information to identify, contact, or locate a single person, or to identify an individual in context. Please read our privacy policy carefully to get a clear understanding of how we collect, use, protect or otherwise handle your Personally Identifiable Information in accordance with our website.
What personal information do we collect from the people that visit our blog, website or app?
When ordering or registering on our site, as appropriate, you may be asked to enter your name, email address, mailing address, phone number, credit card information or other details to help you with your experience.
When do we collect information?
We collect information from you when you register on our site, place an order, subscribe to a newsletter, fill out a form, open a support ticket or enter information on our site.
How do we use your information?
We may use the information we collect from you when you register, make a purchase, sign up for our newsletter, respond to a survey or marketing communication, surf the website, or use certain other site features in the following ways:
- To personalize your experience and to allow us to deliver the type of content and product- offerings in which you are most interested.
- To improve our website in order to better serve you.
- To allow us to better service you in responding to your customer service requests.
- To quickly process your transactions.
- To send periodic emails regarding your order or other products and services.
- To follow up with them after correspondence (live chat, email or phone inquiries)
How do we protect your information?
Our website is scanned on a regular basis for security holes and known vulnerabilities in order to make your visit to our site as safe as possible.
We use regular Malware Scanning.
Your personal information is contained behind secured networks and is only accessible by a limited number of persons who have special access rights to such systems, and are required to keep the information confidential. In addition, all sensitive/credit information you supply is encrypted via Secure Socket Layer (SSL) technology.
We implement a variety of security measures when a user places an order enters, submits, or accesses their information to maintain the safety of your personal information.
All transactions are processed through a gateway provider and are not stored or processed on our servers.
Do we use 'cookies'?
Yes. Cookies are small files that a site or its service provider transfers to your computer's hard drive through your Web browser (if you allow) that enables the site's or service provider's systems to recognize your browser and capture and remember certain information. For instance, we use cookies to help us remember and process the items in your shopping cart. They are also used to help us understand your preferences based on previous or current site activity, which enables us to provide you with improved services. We also use cookies to help us compile aggregate data about site traffic and site interaction so that we can offer better site experiences and tools in the future.
We use cookies to:
- Help remember and process the items in the shopping cart.
- Understand and save users’ preferences for future visits.
You can choose to have your computer warn you each time a cookie is being sent, or you can choose to turn off all cookies. You do this through your browser settings. Since each browser is a little different, look at your browser's Help Menu to learn the correct way to modify your cookies.
If you turn cookies off, some features will be disabled. It won't affect the user's experience but makes your site experience less efficient and may not function properly.
However, you will still be able to place orders.
Third-party disclosure
We do not sell, trade, or otherwise transfer to outside parties your Personally Identifiable Information.
Third-party links
We do not include or offer third-party products or services on our website.
Google's advertising requirements can be summed up by Google's Advertising Principles. They are put in place to provide a positive experience for users. https://support.google.com/adwordspolicy/answer/1316548?hl=en
We may use Google AdSense Advertising on our website.
Google, as a third-party vendor, uses cookies to serve ads on our site. Google's use of the DART cookie enables it to serve ads to our users based on previous visits to our site and other sites on the Internet. Users may opt-out of the use of the DART cookie by visiting the Google Ad and Content Network privacy policy.
We have implemented the following:
- Demographics and Interests Reporting
We, along with third-party vendors such as Google use first-party cookies (such as the Google Analytics cookies) and third-party cookies (such as the DoubleClick cookie) or other third-party identifiers together to compile data regarding user interactions with ad impressions and other ad service functions as they relate to our website.
Opting out:
Users can set preferences for how Google advertises to them using the Google Ad Settings page. Alternatively, you can opt-out by visiting the Network Advertising Initiative Opt Out page or by using the Google Analytics Opt Out Browser add-on.
Despite being UK based, we are a website with global reach and therefore we are obliged to conform to certain international privacy standards as follows.
California Online Privacy Protection Act
CalOPPA is the first state law in the US to require commercial websites and online services to post a privacy policy. The law's reach stretches well beyond California to require any person or company in the United States (and conceivably the United Kingdom) that operates websites collecting Personally Identifiable Information from California consumers to post a conspicuous privacy policy on its website stating exactly the information being collected and those individuals or companies with whom it is being shared.
According to CalOPPA, we agree to the following:
Users can visit our site anonymously.
Once this privacy policy is created, we will add a link to it on our home page.
Our Privacy Policy link includes the word 'Privacy' and can easily be found at the bottom of each page on our site.
You will be notified of any Privacy Policy changes:
- On our Privacy Policy Page
Can change your personal information:
- By logging in to your account
How does our site handle Do Not Track signals?
We honour Do Not Track signals and Do Not Track, plant cookies, or use advertising when a Do Not Track (DNT) browser mechanism is in place.
Does our site allow third-party behavioural tracking?
It's also important to note that we do not allow third-party behavioural tracking
Fair Information Practices
The Fair Information Practices Principles form the backbone of privacy law in the United States and the concepts they include have played a significant role in the development of data protection laws around the globe. Understanding the Fair Information Practice Principles and how they should be implemented is critical to complying with the various privacy laws that protect personal information.
In order to be in line with Fair Information Practices we will take the following responsive action, should a data breach occur:
We will notify you via email within 1 business day
We also agree to the Individual Redress Principle which requires that individuals have the right to legally pursue enforceable rights against data collectors and processors who fail to adhere to the law. This principle requires not only that individuals have enforceable rights against data users, but also that individuals have recourse to courts or government agencies to investigate and/or prosecute non-compliance by data processors.
CAN SPAM Act
The CAN-SPAM Act is a law that sets the rules for commercial email, establishes requirements for commercial messages, gives recipients the right to have emails stopped from being sent to them, and spells out tough penalties for violations.
We collect your email address in order to:
- Send information, respond to inquiries, and/or other requests or questions
- Process orders and to send information and updates pertaining to orders.
- Market to our mailing list or continue to send emails to our clients after the original transaction has occurred.
To be in accordance with CANSPAM, we agree to the following:
- Not use false or misleading subjects or email addresses.
- Identify the message as an advertisement in some reasonable way.
- Include the physical address of our business or site headquarters.
- Monitor third-party email marketing services for compliance, if one is used.
- Honor opt-out/unsubscribe requests quickly.
- Allow users to unsubscribe by using the link at the bottom of each email.
If at any time you would like to unsubscribe from receiving future emails, you can email us at
- Follow the instructions at the bottom of each email.
and we will promptly remove you from ALL correspondence.
Contacting Us
If there are any questions regarding this privacy policy, you may contact us using the information below.
Allez y Limited trading as Baked by Nicola,
Last Edited on 01-08-2022
Baked by Nicola Safety App — staff records and Google access
This section explains how Allez-y Limited, trading as Baked by Nicola, handles information in the Baked by Nicola Safety App. The app is a staff tool for recording daily food-safety checks, temperatures, cleaning, deliveries, corrective actions and manager sign-off. It is not an online shopping service. This section applies specifically to the safety app; the website’s shopping and marketing provisions do not describe how the app uses Google data.
Information recorded and its purpose
We record staff account details, including names, email addresses and account identifiers, together with information entered into safety forms. This can include staff initials, shift-lead names, dates and times, readings, checklist responses, issues, actions, typed sign-off names and subsequent amendments. We use this information to manage access, maintain food-safety records, review problems and establish who completed or approved a check. Please do not enter unnecessary personal, customer or medical information into free-text fields.
Google Drive and Google Sheets
An authorised company account connects the app to Google Drive and Google Sheets. The connection checks the Google account and the designated records destination, creates a report of a signed-off checklist in the company safety-records folder, and writes an entry to the safety-records spreadsheet register. The app reads relevant folder, file and spreadsheet information to verify the destination and avoid duplicate or conflicting uploads.
The current Google permissions are broad: they permit access to the connected account’s Drive files and spreadsheets, including the ability to edit or delete them. They are not restricted by Google to a single folder. The app’s current upload function targets the designated safety folder and register; it does not browse unrelated file contents, delete unrelated files or make files public. Google permission is granted through Google’s authorisation process; the app does not ask staff to enter their Google password.
We use information obtained through this Google connection only to operate and support the safety-record functions described here. We do not sell Google user data or use it for advertising, marketing, credit decisions or training general-purpose AI models. Google-data use and transfers are subject to the Google API Services User Data Policy, including its Limited Use requirements: Google API Services User Data Policy.
Storage, access and service providers
Drafts, signed records, approved site settings, amendments and upload status are stored in the app’s database. Signed-original reports and register entries are also stored in the connected company Google account. Google receives the information needed for those operations. Manus provides the app hosting, database and sign-in services, which process the information needed to operate the app; technical diagnostics may also process app activity during development and testing.
Access within the app is granted to approved staff and administrators. Approved staff can view company safety records, not only records they created. Access to Google copies follows the company’s Google Drive and Sheets sharing permissions. We may share relevant records with authorised advisers, auditors or authorities where necessary for safety review, security or legal requirements. Human access to Google-derived data is limited to authorised, agreed access and other exceptions permitted by Google’s user-data rules.
Google connection credentials are held in protected server-side configuration. The app obtains access tokens to communicate with Google and does not intentionally expose these connection credentials in staff forms or record exports. This does not mean that the service providers never process authentication information.
Phone drafts and downloaded copies
The app can keep unfinished drafts and account information in the browser on the device being used. Signing out does not remove all locally stored drafts. Use a secured, authorised device and avoid leaving a shared phone or computer accessible to others. A successful sign-off normally removes that device’s local draft, but does not remove copies on other devices. Reports downloaded, printed or copied by staff remain separate copies under the control of whoever holds them.
Retention, corrections and requests
We retain records for as long as reasonably necessary for food-safety management, applicable legal obligations, audits and the handling of incidents or claims. The app currently has no automatic age-based deletion. Signed originals are not edited through the app; corrections are recorded as separate, dated amendments. Those amendments do not silently replace the original report already exported to Google Drive.
You can contact us to request access to your personal information, a correction, restriction or deletion. Requests are considered alongside our record-keeping obligations and the need to preserve accurate safety evidence; a request may not result in removal of the original record. Deletion or correction may need to be handled separately for the app database, Google copies, device drafts and downloaded copies.
The Google account holder can revoke the app’s permission in their Google Account connection settings. This stops future authorised Google uploads once the permission is no longer valid, but does not automatically delete existing app records or Google copies.
For questions about this app or personal information, contact gary.lawson@bakedbynicola.com or enquiries@bakedbynicola.com.
