We collect what the shop needs
Order, delivery and contact details, plus limited technical information needed to run and secure the website.
The quiet ledger
Your Privacy in The Hidden Glen
What we collect, why we need it, who may receive it, how long it stays, and the choices that remain firmly in your hands.
Last updated:
The plain-English version
Privacy Without the Fog
The full details follow. These four stones mark the main path.
We do not sell personal data
Information is shared only with services needed to fulfil orders, take payment, deliver parcels, host the site or meet legal duties.
Payment details stay with the provider
Stripe or PayPal handles payment credentials. Half Baked CBD does not receive or store your full card number.
You have rights and choices
You may ask for access, correction, deletion, restriction or objection where the law provides those rights.
The keeper of the ledger
Who We Are
Half Baked CBD is the data controller for personal information collected through this website and shop. That means we decide why and how that information is used.
- Controller
- Half Baked CBD
- Location
- Scotland, United Kingdom
- Privacy contact
- Send a Raven
The legal business name, contact email and service address should match the details shown in the website Terms and on customer invoices. The installation guide explains what to confirm before publishing.
What enters the ledger
Information We Collect
We collect information from you directly, from your browser or device, and from providers involved in an order.
Orders and delivery
Name, email, optional phone number, company name, delivery address, postcode, basket contents, order note, shipping choice, payment status and order reference.
Payments
Payment provider, amount, currency, transaction or session identifier and payment result. Full card or bank credentials remain with Stripe or PayPal.
Messages and support
Your name, email, enquiry type, optional order number, subject, message, reply preference and any files or photographs you voluntarily provide.
Website and security
IP address, browser and device information, requested pages, timestamps, referring page, server errors and security events recorded by the website or hosting service.
Marketing choices
Email address, consent record, preferences and unsubscribe history when you actively choose to receive workshop news or offers.
Local browser data
Basket contents, a basket note and an unfinished checkout draft may be stored in your browser so the shop remembers your progress.
Please do not send medical records
Product questions do not require diagnoses, prescriptions, photographs of medical documents or detailed health history. If you need advice about medication, pregnancy, breastfeeding or a health condition, speak to a doctor or pharmacist.
Purpose and lawful basis
Why We Use Your Information
UK data protection law requires a lawful basis for each use. The bases most relevant to this shop are contract, legal obligation, legitimate interests and consent.
| Purpose | Information used | Lawful basis |
|---|---|---|
| Prepare, take payment for and deliver an order | Customer, address, basket, shipping and transaction information | Contract |
| Send confirmations, delivery updates and respond to order problems | Contact details, order history and messages | Contract and legitimate interests |
| Maintain tax, accounting, refund and transaction records | Orders, invoices, payments and refunds | Legal obligation |
| Protect the website, prevent fraud and investigate misuse | Technical logs, transaction signals and communications | Legitimate interests |
| Answer product, trade or general enquiries | Contact details and message contents | Legitimate interests or steps requested before a contract |
| Send optional news and offers | Email address and marketing preferences | Consent, unless a lawful customer exception is deliberately and correctly used |
| Establish, exercise or defend legal claims | Relevant orders, communications and records | Legitimate interests and legal obligation where applicable |
Where we rely on legitimate interests, those interests include operating a secure shop, answering customers, preventing abuse, improving service reliability and keeping proportionate records. We consider the impact on your rights before relying on this basis.
You are not generally required by law to give us personal information. However, name, contact, delivery and payment information are necessary to enter into and perform an order contract. Without them, checkout cannot be completed.
Across borders
International Processing
Some providers may process information outside the United Kingdom. Where UK data protection law requires safeguards, we expect the relevant provider to use an approved transfer mechanism, such as UK adequacy regulations, the UK International Data Transfer Agreement, the UK Addendum to approved standard contractual clauses, or another lawful safeguard.
Provider privacy notices contain more detail about their locations and transfer arrangements.
How long it remains
Retention and Deletion
We keep personal information only for as long as needed for the purpose described, including legal, accounting, security and dispute requirements.
Retention periods are reviewed when systems, legal duties or providers change. Information may be anonymised instead of deleted where it can no longer identify anyone.
Cookies and browser storage
What This Device Remembers
The current shop uses browser local storage for functions requested by you, such as remembering a basket and unfinished checkout. This information remains on the device rather than being sent to us merely because it is stored.
Live device check
Local Glen Data
Basket contents
Checking…
halfBakedBasketWorkshop note
Checking…
halfBakedBasketNoteUnfinished checkout details
Checking…
halfBakedCheckoutDraftThird-party storage
Stripe or PayPal may use cookies or similar technologies when their payment service is loaded or opened. The current site should not activate advertising pixels or non-essential analytics unless suitable information and controls are added first.
Browser settings can block or remove storage, but doing so may empty the basket, forget an unfinished checkout or prevent a payment service from working properly.
Your choices
Your Data Protection Rights
Depending on the circumstances, UK data protection law may give you the right to:
Be informed
Know how your information is collected and used.
Access
Ask for a copy of personal information we hold about you.
Rectification
Correct inaccurate information or complete information that is incomplete.
Erasure
Ask for deletion where there is no lawful reason to keep the information.
Restriction
Ask us to limit how information is used in certain situations.
Object
Object to processing based on legitimate interests or used for direct marketing.
Portability
Receive certain information in a reusable format where the right applies.
Withdraw consent
Change your mind where processing relies on consent, without affecting earlier lawful use.
These rights are not absolute. We may need to verify your identity, ask for enough detail to locate the information, or retain certain records despite a deletion request where law requires it. We normally respond within one month, subject to lawful extensions for complex requests.
Build a request
Privacy Request Helper
Choose a request and copy a simple message to send through the raven form.
Official guidance about these rights is available from the Information Commissioner’s Office .
Keeping the gate
Security, Children and Automated Decisions
Security
We use proportionate technical and organisational measures intended to protect personal information, including HTTPS, restricted server access, server-side price verification, payment-provider handoff, input validation and protected order storage. No online system can promise absolute security.
Children
This website and its CBD products are not intended for anyone under 18. We do not knowingly seek personal information from children. If you believe a child has submitted information, contact us so it can be reviewed and deleted where appropriate.
Automated decisions
We do not use customer information to make solely automated decisions that produce legal or similarly significant effects.
Questions, complaints and changes
Contact Us or the ICO
Contact Half Baked CBD first through Send a Raven for privacy questions, rights requests or complaints. Mark the subject clearly as “Privacy request”.
We will take appropriate steps to investigate a data protection complaint, keep you informed, and provide a final response without unnecessary delay and no later than one calendar month, subject to any lawful extension for a complex matter.
You also have the right to complain to the UK Information Commissioner’s Office. You can find current complaint routes and contact details on the ICO website .
Changes to this notice
We may update this notice when the website, providers, products or law change. The date at the top identifies the current version. Material changes should be highlighted clearly and, where appropriate, brought to existing customers’ attention.
Policy review date
19 July 2026
The official signposts
Guidance Beyond the Glen
Privacy rules can change. These official sources outrank ancient scrolls, copied policies and a confident raven with a law degree drawn in crayon.
Something unclear?
Send a Privacy Raven
Ask what we hold, request a correction or raise a concern. Clear wording helps the right records fly back faster.