Privacy Policy

Last updated: 5 October 2026

Who we are

GPC Specialist Tea Room C.I.C. runs Grandmas Pudding Co, a community tea room. We run this website, grandmaspuddingco.uk. In this notice, “we” and “us” mean GPC Specialist Tea Room C.I.C.

We decide how the personal data described on this page is used. This makes us the controller under UK data protection law.

GPC Specialist Tea Room C.I.C.
GPC Tearoom
Manor Bungalow
Howgarth Lane
Friskney
Boston
PE22 8PQ
United Kingdom

We are a community interest company registered in England and Wales. We are a limited company. Company number: 12467780. Registered office: Manor Bungalow, Howgarth Lane, Friskney, Boston, PE22 8PQ.

To ask about your data, use our contact form or write to us at the address above.

Visiting this website

Like all web hosts, our host, DreamHost, keeps technical logs of requests to the site. These are called server logs. They include your internet address, the pages you visit, the date and time, and the type of browser and device you use. They are used to keep the site running and secure.

DreamHost also uses these logs to give us simple visit counts, such as how many people looked at a page. These counts do not use cookies. We do not use Google Analytics or any other analytics service.

Our pages do not load maps, videos or posts from Google or Facebook until you press a button to show them. The one exception is our Facebook profile picture on the home page. It sets no cookies. See “Google Maps and Facebook” below.

What we collect, why, and how long we keep it

Messages you send us

• What: the answers you give on our contact form. These are what your message is about, your message, your name and your email address. They also include the tea room topic or volunteering days, if you choose to tell us. With your message, the website also saves the address of the page you sent it from and a short description of your browser and device. It does not save your internet address.
• Why: to reply to you and deal with your message, including questions about volunteering.
• Lawful basis: our legitimate interest in answering people who contact us. If you ask us to do something for you, such as a booking, the lawful basis can also be taking the steps you ask for before we make an agreement with you.
• How long: the copy on this website is deleted automatically after 1 year. Emails in our team inbox are deleted after 1 year. The copy sent to you is in your own inbox, so you decide how long to keep it.

The form emails your message to our team inbox. It also sends a copy to the email address you give, so you have a record of it. Sending a message doesn’t add you to any mailing list, and we do not use it for marketing.

Please only tell us what we need to deal with your message. Do not include health details or other sensitive information unless you want us to take it into account. If you do include it, we will only use it to deal with your message.

We may keep a message for longer if we need it to deal with a complaint, a legal claim or a safeguarding concern. We will delete it when we no longer need it.

Spam checks

• What: the contact form checks how quickly it was filled in. It also has a hidden box that only automatic spam programs fill in. It counts how many messages come from each internet address. These checks all run on our own website. We do not send your details to any outside spam-checking service.
• Why: to stop spam.
• Lawful basis: our legitimate interest in keeping our website and inbox working and free of spam.
• How long: each count is kept for up to 1 hour, then deleted.

Server logs

• What: the server logs described in “Visiting this website”.
• Why: to keep the website running and secure, and to give us simple visit counts.
• Lawful basis: our legitimate interest in keeping our website working and secure, and in knowing how much it is used.
• How long: 7 days, then DreamHost deletes them.

Showing a Google map or a Facebook video or post

• What: when you press the button, Google or Facebook receive your internet address and details about your browser and device. They can also set or read cookies on your device. We do not receive or keep any of this.
• Why: to show you the map, video or post you asked to see.
• Lawful basis: your consent, which you give by pressing the button.
• How long: we keep nothing. Google and Meta decide how long they keep it.

Google Maps and Facebook

Our Contact us page can show a Google map. Some of our news posts can show videos and posts from our Facebook page.

These do not load when you open the page. In their place you see a short notice and a button: Show the map, Play the video here or Show the post here. There is also a link to see it on Google Maps or Facebook instead.

No map, video or post loads from Google or Facebook, and they set no cookies, until you press the button. Pressing it shows that one map, video or post, on that page only. We do not remember your choice. Next time you open the page, you will see the notice again.

When you press the button, your browser connects to Google (for the map and the fonts it uses) or to Facebook. They see your internet address and details about your browser and device. They can set or read cookies on your device. If you are signed in to Facebook, Facebook may link this to your account.

Google and Meta (the company that owns Facebook) decide how they use this information, and they may send it to the United States. To find out more, read the Google privacy policy and the Meta privacy policy.

Our home page also shows recent posts from our Facebook page. Our website’s server collects these posts from Facebook and shows them as part of our page. The one exception is our own profile picture next to each post. Your browser loads this picture from Facebook’s image servers. This means Facebook sees your internet address and details about your browser. No cookies are set, and nothing is stored on your device. Our lawful basis for this is our legitimate interest in showing our Facebook posts on our home page. If you follow a link to Facebook, Facebook’s own privacy policy applies there.

Cookies

Cookies are small files that websites save on your device.

• This website sets no cookies for visitors. Our contact form does not set any cookies.
• Our staff get WordPress’s sign-in cookies when they sign in to manage the website. These are only used to keep them signed in.
• Google and Facebook can set their own cookies, but only after you press a button to show a map, video or post.

We do not use cookies for tracking or advertising. There is no cookie banner. Instead, each map, video and post waits for you to press its button.

Who we share it with

We do not sell your personal data. These people and organisations can see it:

• Our team, who read and reply to messages.
• HolmesPortfolio, who look after our website for us. They can see stored messages when they work on the website.
• DreamHost, our web host. It stores this website, its data and the server logs, and runs our email. DreamHost passes email through MailChannels, a service it uses to filter spam.

These organisations handle your information for us, as part of the service they provide to us.

Google only receives information if you press the button to show the map. Meta (Facebook) sees your internet address and browser details when our home page loads our profile picture. It receives more if you press a button to show a video or post.

We will also share personal data if the law requires us to, for example with the police.

Where your data is stored

This website and its data are stored in DreamHost’s data centre in Amsterdam, in the Netherlands. UK law recognises the Netherlands as giving an adequate level of protection.

DreamHost is based in the United States, so its staff may handle data from there to run and support its services. DreamHost’s data processing terms protect this with standard contractual clauses and the UK International Data Transfer Addendum approved by the Information Commissioner.

Keeping your information secure

Our website uses a secure connection (HTTPS). Messages saved on the website can only be seen by people who sign in to manage it.

Your rights

Under UK data protection law you can ask us to:

• give you a copy of the personal data we hold about you
• correct it
• delete it
• limit how we use it
• send it to you, or to someone else, in a format a computer can read

You can also object to us using your data where we rely on our legitimate interests.

Where we rely on your consent, you can withdraw it at any time. This does not affect anything that happened before. To stop showing a map, video or post, leave or reload the page. Any cookies Google or Facebook set stay on your device until they run out or you delete them in your browser settings.

Some of these rights only apply in certain situations. To use any of them, use our contact form or write to us at the address above. It is free. We may need to check who you are first. We will reply within one month. If your request is complicated, we may need up to two more months. We will tell you if so.

Complaints

If you are unhappy with how we use your data, please tell us first. Use our contact form or write to us. We will acknowledge your complaint within 30 days, look into it and tell you the outcome.

You can also complain to the Information Commissioner’s Office (ICO), the UK’s data protection regulator, at ico.org.uk/make-a-complaint or on 0303 123 1113.

Changes to this notice

When we change this notice, we update the date at the top.

Our terms and conditions explain the rules for using this website.