Privacy Policy

Effective Date: May 2026 · Version 1.0

This Privacy Policy explains how Café Ciel collects, uses, and protects your personal data when you interact with our landing page and opt in to receive marketing communications and updates. We are committed to handling your data in accordance with the UK GDPR and the Data Protection Act 2018.

1. Data Controller

Café Ciel is the primary data controller responsible for your personal data collected via this landing page.
Entity: Café Ciel (Wonderbite Ltd)
Address: 12 Charles II St, London, SW1Y 4QU
Email: hello@cafeciel.com
Data Protection Contact: hello@cafeciel.com

Magnolia Bakery acts as a joint data controller / data recipient for the purposes described in Section 5. Their privacy policy is available on their website.

2. What Data We Collect

When you opt in via our landing page, we collect:

• Your name
• Your email address
• Your phone number
• Your marketing preferences (what types of updates you wish to receive)
• Date and time of your consent
• The specific consent wording presented to you at the time of opt-in

We do not collect sensitive personal data (special category data) via this form.

3. Legal Basis for Processing

We process your personal data based on your freely given, specific, informed, and unambiguous consent (Article 6(1)(a) UK GDPR).

You may withdraw your consent at any time by clicking Unsubscribe in any email or by contacting hello@cafeciel.com. Withdrawal does not affect the lawfulness of processing carried out before withdrawal.

4. How We Use Your Data

We use your data solely for consented purposes, including:

• Sending marketing communications about Café Ciel x Magnolia Bakery events, offers, new menu items, and collaborations.
• Sharing updates about limited-edition products and pop-up experiences.
• Delivering exclusive early access, promotions, and loyalty communications from both brands.

5. Sharing Your Data with Magnolia Bakery

Your data will be shared with Magnolia Bakery as a named partner for this campaign.

• They will only use your data for the marketing purposes you consented to.
• Your data will not be sold to Magnolia Bakery or any other third party.
• Magnolia Bakery will not pass your data to further third parties without your consent.

6. Data Retention

We retain your data as long as your consent is valid. Upon withdrawal:

• Within 10 business days: Suppressed from active marketing lists.
• Within 30 days: Deleted from all systems, unless required for legal compliance (retained in anonymized form for up to 3 years).

7. Your Rights under UK GDPR

You have the following rights:

• Access: Request a copy of your data.
• Rectification: Correct inaccurate data.
• Erasure: Request deletion ("right to be forgotten").
• Restriction: Limit how we use your data.
• Data Portability: Receive your data in a machine-readable format.
• Object/Withdraw Consent: Stop processing at any time.

Contact hello@cafeciel.com to exercise these rights; we will respond within 30 days. You may also lodge a complaint with the Information Commissioner's Office (ICO).

8. Data Security

We use encrypted data transmission (SSL/TLS), access controls, and secure third-party processors compliant with UK GDPR to protect your data.

9. International Transfers

Magnolia Bakery is US-based. Transfers outside the UK are protected via the UK-US Data Bridge, Standard Contractual Clauses (SCCs), or the UK International Data Transfer Agreement (IDTA).

10. Cookies & Tracking

We may use essential cookies. Analytical or marketing cookies require separate consent per PECR. See our separate Cookie Policy for details.

11. Changes to This Policy

We may update this policy and will notify you of material changes via email or our website.

12. Contact Us

Café Ciel — Data Privacy
Email: hello@cafeciel.com
Post: Café Ciel, Wonderbite Ltd, 12 Charles II St, SW1Y 4QU