Privacy policy

HOT CAKE HOLDINGS LTD

STORE PRIVACY POLICY

Last updated: April 2026

1. Who We Are

This store is operated by Hot Cake Holdings Ltd (“Hot Cake”, “we”, “us”, “our”), a company registered in England and Wales.


This store is published on behalf of Chase & Status (“the Artist”). Hot Cake acts as the merchant of record for all transactions processed through this store. By placing an order or using this website, you are entering into a transaction with Hot Cake Holdings Ltd.


For data protection purposes, Hot Cake Holdings Ltd is the data controller in respect of the personal data collected through this store.


Contact: privacy@hotcake.ltd


2. What Personal Data We Collect

When you use this store, we may collect the following types of personal data:


Order and transaction data

  • Your name and delivery address

  • Email address

  • Phone number (if provided)

  • Order details, including items purchased, quantities and transaction value


Payment data

Payment transactions are processed securely by Shopify Payments and/or third-party payment providers (such as Stripe or PayPal). Hot Cake does not store your full card details. Please refer to your payment provider's privacy policy for further information.


Technical and usage data

  • IP address

  • Browser type and version

  • Pages visited and time spent on site

  • Cookie data (see our Cookie Policy for more detail)


Communications data

If you contact us for support or in relation to an order, we will retain records of that correspondence.


3. How We Use Your Personal Data

We use your personal data for the following purposes:


  • To process and fulfil your order, including packing, dispatch and delivery

  • To send order confirmations, dispatch notifications and delivery updates

  • To handle returns, exchanges and refunds

  • To respond to customer service enquiries

  • To comply with our legal and financial obligations

  • To detect and prevent fraud or misuse of the store


We do not use your purchase data for marketing purposes without your consent. If the Artist operates a separate mailing list or fan communications service, that is governed by their own privacy policy.


4. Legal Basis for Processing

Under UK GDPR, we rely on the following legal bases for processing your personal data:


  • Contract performance — processing your order and communicating with you about it

  • Legal obligation — compliance with tax, consumer rights and fraud prevention requirements

  • Legitimate interests — improving how the store operates and preventing fraudulent transactions, where these interests are not overridden by your rights


5. Who We Share Your Data With

We share your data only where necessary to fulfil your order or comply with the law. This includes:


  • Shopify Inc. — our e-commerce platform provider (data may be processed in the USA; Shopify is certified under the EU-US Data Privacy Framework)

  • Shipping and fulfilment partners — to dispatch your order (e.g. Royal Mail, DHL, or similar carriers)

  • Payment processors — such as Stripe or PayPal, for secure transaction processing

  • Our accountants and legal advisers — where required for financial or legal compliance


We do not sell your personal data to third parties. We do not share your data with the Artist for their own marketing purposes without your separate consent.


6. International Data Transfers

Some of our service providers are based outside the UK. Where personal data is transferred internationally, we ensure appropriate safeguards are in place, including standard contractual clauses or transfers to countries deemed adequate by the UK ICO.


7. How Long We Keep Your Data

We retain your order and transaction data for a minimum of 6 years to comply with HMRC financial record-keeping requirements. Communications data is retained for as long as is reasonably necessary to resolve any related queries or disputes.


Where data is no longer required, we will delete or anonymise it securely.


8. Your Rights

Under UK data protection law, you have the right to:


  • Access the personal data we hold about you

  • Request correction of inaccurate or incomplete data

  • Request deletion of your data (subject to legal retention requirements)

  • Object to or restrict processing in certain circumstances

  • Request transfer of your data to another provider (data portability)

  • Withdraw consent where we rely on consent as a legal basis


To exercise any of these rights, please contact us at privacy@hotcake.co.uk. We will respond within one month of receiving your request.


9. Cookies

This store uses cookies to enable core functionality, improve performance and (where you have consented) to support analytics and advertising. For full details of the cookies used on this store, please refer to our Cookie Policy.


10. Security

We take appropriate technical and organisational measures to protect your personal data from unauthorised access, loss or disclosure. Access to order data is restricted to authorised Hot Cake staff and service providers only.


In the event of a data breach that is likely to affect your rights and freedoms, we will notify you and the Information Commissioner's Office (ICO) as required by law.


11. Complaints

If you have concerns about how we handle your personal data, please contact us in the first instance at privacy@hotcake.ltd


You also have the right to lodge a complaint with the UK's data protection regulator:


Information Commissioner's Office (ICO)

www.ico.org.uk

0303 123 1113


12. Changes to This Policy

We may update this policy from time to time. The current version will always be published on this store. We recommend checking back periodically.


Nothing in this policy affects your statutory rights under the Consumer Rights Act 2015, UK GDPR, or any other applicable legislation.

Hot Cake Holdings Ltd — Registered in England and Wales