Bake Theory Privacy Policy

Effective Date: February 18, 2026

At Bake Theory, we are committed to protecting your privacy and handling your personal information in a responsible and transparent manner. This Privacy Policy explains how we collect, use, disclose, and safeguard your personal information when you visit our website (baketheory.ca), place an order, or interact with us through our online forms. We operate our website using the Shopify platform, and this policy is designed to comply with the Personal Information Protection and Electronic Documents Act (PIPEDA) in Canada, as well as other applicable privacy laws.

By using our website or providing us with your personal information, you consent to the practices described in this policy. If you do not agree with this policy, please do not use our website or services.

Personal Information We Collect

We collect personal information that is necessary to provide our services, process your orders, and improve your experience. The types of personal information we may collect include:

• Contact and Identification Information: Full name, email address, phone number.
• Shipping and Billing Information: Shipping address, billing address.
• Payment Information: Credit card details or other payment method information (processed securely through Shopify Payments or third-party payment processors).
• Order and Form Details: Information provided in our wholesale, catering, contact, or other related forms, such as custom order notes or preferences.
• Health-Related Information: Dietary preferences or allergies, which are collected only in the context of bulk orders (e.g., catering or wholesale) and are not tied to specific individuals but rather to the order as a whole.

We do not collect sensitive personal information beyond what is necessary for fulfilling orders, and we handle health-related details (like allergies) with care to ensure safe product preparation.

How We Collect Your Information

Your personal information is collected through:

• Shopify Cart and Checkout Process: When you add items to your cart, create an account, or complete a purchase.
• Website Forms: Submissions via our wholesale, catering, contact, or other inquiry forms.
• Automated Technologies: Through Shopify's built-in analytics, which may use cookies or similar technologies to track website usage and improve functionality (see "Cookies and Tracking Technologies" below). We do not use third-party analytics tools, advertising trackers, or personalization technologies.

We only collect information that you voluntarily provide or that is automatically gathered during your interaction with our site.

How We Use Your Information

We use your personal information for the following primary purposes:

• Processing Orders: To fulfill your purchases, including preparing and shipping bakery goods, handling payments, and providing order confirmations.
• Marketing Communications: To send you promotional emails about our products, special offers, or updates, but only if you have opted in or provided consent. You can unsubscribe at any time.
• Improving Our Website and Services: To analyze site usage through Shopify's built-in analytics, troubleshoot issues, and enhance user experience.
• Customer Support: To respond to your inquiries, provide assistance, or resolve disputes.
• Legal Compliance: To comply with legal obligations, such as tax reporting or responding to lawful requests from authorities.

We do not use your information for any other purposes without your consent.

Sharing Your Information

We do not sell, rent, or share your personal information with third parties for their marketing purposes. However, we may disclose your information in the following limited circumstances:

• Service Providers: With couriers or shipping partners (e.g., Canada Post or similar services) for delivery purposes. This may include sharing your name, shipping address, and phone number to generate shipping labels and facilitate delivery.
• Shopify and Its Partners: As our website is hosted on Shopify, your data is stored and processed on their platform. Shopify may share data with its subprocessors (e.g., payment processors or cloud service providers) as necessary for hosting, payment processing, or order fulfillment. We do not share data with other platforms unless required for order processing or shipping.
• Legal Requirements: If required by law, such as in response to a court order, subpoena, or regulatory demand, or to protect our rights, safety, or property.

For more details on how Shopify handles data, please refer to Shopify's Privacy Policy.

Data Retention

We retain your personal information only as long as necessary to fulfill the purposes outlined in this policy, including for order processing, legal compliance, and dispute resolution. Retention periods are managed through the Shopify platform, where data is typically kept for the duration of your account or order history. For example:

• Account information is retained until you delete your account.
• Order-related data may be kept for up to two years after an order is completed or a store is closed, in line with Shopify's practices.
• Once no longer needed, data is securely deleted or anonymized.

If you request deletion of your data, we will remove it from our active systems, subject to any legal retention requirements.

Security Measures

We rely on Shopify's robust security infrastructure to protect your personal information. Shopify implements industry-standard measures, including:

• Encryption of data in transit and at rest.
• Access controls, firewalls, and regular security audits.
• Compliance with standards for processing financial information.

While no system is completely secure, Shopify undergoes independent audits to ensure the integrity of its platform. For more information, visit Shopify's Security Page.

We advise you to use strong passwords and keep your account information confidential.

International Data Transfers

As a Canadian-based business using Shopify, your personal information is primarily stored and processed in Canada. However, Shopify operates globally and may transfer data to facilities in the United States and other countries for storage, processing, or backup purposes. These transfers are governed by applicable laws, including PIPEDA.

For residents of the European Economic Area (EEA), UK, or Switzerland, data may be transferred to Canada (recognized as providing adequate protection under EU law) or other locations using safeguards like Standard Contractual Clauses. If you are outside Canada, your data may be subject to the laws of those jurisdictions, which may differ from Canadian privacy laws.

Your Rights Under PIPEDA

As a Canadian business, we comply with PIPEDA, which grants you certain rights regarding your personal information. You have the right to:

• Access: Request a copy of the personal information we hold about you.
• Correction: Update or correct inaccurate information.
• Deletion: Delete your account or specific data, subject to legal requirements (e.g., you can delete your Shopify account at any time through your account settings).
• Withdrawal of Consent: Opt out of marketing communications or withdraw consent for certain uses by contacting us.
• Complaint: File a complaint with us or the Office of the Privacy Commissioner of Canada if you believe your rights have been violated.

To exercise these rights, please contact us using the details below. We will respond to your request within 30 days, as required by PIPEDA.

Children's Privacy

Our website and services are not directed to children under the age of 13 (or 16 in some jurisdictions). We do not knowingly collect personal information from children. If an order is placed, it must be done by a parent or guardian. We encourage parents to supervise their children's online activities. If we become aware that we have collected information from a child without parental consent, we will delete it promptly.

Cookies and Tracking Technologies

Our website uses cookies and similar technologies provided by Shopify for essential functions, such as maintaining your cart and session, and for built-in analytics to understand site performance. These do not include third-party advertising or personalization trackers. Cookies are small text files stored on your device.

You can manage cookies through your browser settings, but disabling them may affect site functionality. We do not use a cookie consent banner, as our use is limited to necessary and analytical purposes compliant with PIPEDA.

Changes to This Privacy Policy

We may update this policy from time to time to reflect changes in our practices or legal requirements. The updated policy will be posted on our website with a revised effective date. We encourage you to review it periodically.

Contact Us

If you have questions about this Privacy Policy, your personal information, or wish to exercise your rights, please contact our Privacy Officer:

Ivy Chipman Bake Theory Dartmouth, Nova Scotia, Canada Email: baketheoryco@gmail.com (or use the contact form on our website)