Privacy policy
Berry and Bump Ltd — last updated 28 September 2026
This policy explains what we do with your personal information when you visit berryandbump.com, buy from us, subscribe, or get in touch. We've written it to be read, not skimmed past.
If you'd rather just ask a person: hello@berryandbump.com.
1. Who we are
Berry and Bump Ltd is the data controller for the information described here. That means we decide what's collected and why, and we're responsible for looking after it.
| Registered name | Berry and Bump Ltd |
| Company number | 16846137 (England and Wales) |
| Registered office | 124 City Road, London, England, EC1V 2NX |
| Contact | hello@berryandbump.com |
We are registered with the Information Commissioner's Office as a data controller.
We haven't appointed a Data Protection Officer. We're not required to: our core business is making and selling food, not monitoring people or handling health data at scale. Email the address above and it reaches a founder.
2. What we collect
When you buy or subscribe Your name, delivery address, billing address, email address, and your phone number if you give one. What you ordered, when, how much you paid, and your subscription settings.
We never see your full card details. Card payments are handled entirely by our payment providers. We receive only confirmation that payment succeeded, plus the card type and last four digits, so we can identify a transaction if you query it.
When you create an account Shopify runs our accounts and stores your login credentials. We can see your saved addresses and order history; we cannot see your password.
When you contact us Whatever you put in your message, and our replies. If you report a problem with an order, any photos you send.
When you sign up for our newsletter Your email address, and the date and source of your sign-up so we can show you consented.
When you use our website Your IP address, browser and device type, pages visited, and how you arrived. See section 6.
What we don't collect We don't ask for your date of birth, your due date, your baby's details, or anything about your health. We don't buy personal data from anyone else.
What you have to give us, and what's optional
To buy from us we need your name, delivery address, email address and payment details — without them we can't form a contract with you or get a parcel to your door, so an order can't go ahead. Everything else is optional: a phone number only helps the courier reach you, and marketing sign-up is entirely your choice and makes no difference to your order.
3. A specific note about health information
We sell food to mothers, so people sometimes tell us things that count as health data — that they're breastfeeding, recovering from a caesarean, managing an allergy, or that a bar disagreed with them.
Health data gets extra protection under Article 9 of the UK GDPR. Our position on it:
- We don't ask for it, and you never have to give it. You can buy from us without telling us anything about your health.
- If you tell us anyway, we use it only to answer your question or resolve your issue. We rely on your explicit consent (Article 9(2)(a)) — you've chosen to tell us so that we can help. You can withdraw that consent at any time.
- We don't add it to your customer record and we don't use it to target marketing at you. We will never build a mailing list segment based on whether someone is breastfeeding, pregnant, or postpartum. That's a commitment, not an aspiration.
- If you report a reaction to one of our products, we keep and investigate that report. As well as your consent, we rely on Article 9(2)(f) — establishing or defending legal claims — because a safety report may lead to an insurance or legal matter. We may need to share it with our manufacturer, our insurer, or, if the law requires, the Food Standards Agency or your local authority's environmental health team. If someone is seriously unwell and can't consent for themselves, we rely on Article 9(2)(c), vital interests.
- How long we keep it. We keep the incident — what product, which batch, what happened — for 6 years, because product safety records and potential claims require it. We remove or pseudonymise your identifying health details once the investigation is closed, unless a claim or regulatory matter is still live.
4. Why we use your information, and our lawful basis
| What we do | Why | Lawful basis |
|---|---|---|
| Take and fulfil your order, take payment, send it to you, handle returns | To do what you paid us to do | Contract — Art.6(1)(b) |
| Manage your subscription, take renewal payments, send renewal reminders | Same | Contract — Art.6(1)(b) |
| Reply to your emails and sort out problems | To help you | Contract, or legitimate interests if you're not yet a customer |
| Keep accounting, VAT and tax records | We're legally required to | Legal obligation — Art.6(1)(c) |
| Check orders for fraud and handle chargebacks | So that card fraud doesn't cost us stock and money, and genuine customers aren't blocked | Legitimate interests — Art.6(1)(f) |
| Investigate product complaints, run recalls, meet food law | To keep people safe | Legal obligation; Art.9 conditions in section 3 for any health details |
| Send marketing emails if you signed up | You asked us to | Consent — Art.6(1)(a) |
| Send marketing emails to existing customers | See the box below | Legitimate interests, under the PECR "soft opt-in" |
| Keep the site running, secure and free from abuse and bot traffic | So the shop works and checkout is safe | Legitimate interests — Art.6(1)(f) |
| Measure how the site is used | To make it better | Consent — see section 6 |
| Share your order and browsing activity with Shopify for its cross-merchant insights and advertising features ("Shopify Network Intelligence") | It powers the abandoned-basket emails, payment options and Shop app features we use | Consent — only where you've accepted marketing cookies. See section 5 |
| Defend a legal claim, or deal with a regulator | To protect the business | Legitimate interests; Legal obligation where compelled |
About marketing to existing customers. If you've bought from us, or started a checkout and given us your email, we may email you about our own similar products — bars, flavours, subscriptions. We gave you the chance to say no when we collected your email, and every email we send has a one-click unsubscribe. Those are the conditions the law sets (PECR regulation 22(3)) and we hold ourselves to all of them. We don't email you about anything unrelated, and we don't pass your address to anyone else to market to you.
Where we rely on legitimate interests, we've weighed our interest against your privacy and concluded it doesn't override your rights. You can ask us to explain that assessment, and you can object — see section 9.
Where we rely on consent, you can withdraw it at any time. That doesn't affect anything we did before you withdrew it.
5. Who else sees your information
We share your information only with organisations that need it to deliver what you've asked for.
| Who | What they get | Their role |
|---|---|---|
| Shopify | Everything you enter on the site | Our processor for hosting our shop, checkout and customer records — bound by written contract to act only on our instructions. Also a controller in its own right for the Network Intelligence features described below |
| Mission Logix Limited (company number 11456662), warehouse at Advantage One, Third Avenue, Bletchley, Milton Keynes MK1 1DR, United Kingdom | Your name, delivery address, phone number and order contents | Our processor — they store our bars and pack and dispatch your order. All processing takes place in the UK |
| Amazon — [ACTIVATE THIS ROW ONLY WHEN FBA GOES LIVE] | Order and delivery details for orders fulfilled by Amazon | Processor for orders we send them to fulfil; independent controller for anything you buy through the Amazon marketplace, under Amazon's own privacy notice |
| Our accountant | Transaction records | Our processor |
| Notify Me! (back-in-stock alerts) | Your email address and which product you asked to be told about | Our processor — they send the alert you asked for and nothing else |
| Payment providers (Shopify Payments, and PayPal or a wallet if you choose one) | Your payment and billing details | Independent controllers for fraud prevention and their own regulatory duties, under their own privacy policies |
| Couriers | Your name, delivery address, and phone or email for delivery notifications | Independent controllers for much of what they do with delivery data |
| Our manufacturer and insurer | Details of a product complaint — without your contact details unless you agree | Independent controllers |
Shopify Network Intelligence
Our shop runs on Shopify, and Shopify processes your data as part of hosting it. Shopify also operates a feature called Network Intelligence, which combines data from our store with data from other Shopify merchants. Shopify uses that combined data to generate insights, to power features we rely on — including our abandoned-basket emails, our checkout payment options and our page in the Shop app — and to target advertising based on customer activity across merchants. This may involve sharing data with Shopify companies and partners outside the UK.
We only allow this where you've accepted marketing cookies. If you decline, or change your choice later using the cookie settings link on our site, your data isn't used this way. You can withdraw that consent at any time and it takes effect going forward.
Shopify's own privacy policy explains what it does with the data and how to exercise your rights directly with them: shopify.com/legal/privacy/consumers. Shopify also operates a privacy portal at privacy.shopify.com.
We may also disclose information where we're legally required to — to HMRC, the Food Standards Agency, a local authority, a regulator, the police or a court — or where we need to in order to establish or defend a legal claim. If we ever sell or restructure the business, customer records may transfer to the buyer, and we'd tell you.
We don't sell your personal data, and we have no plans to. We're not in the data business; we're in the snack bar business.
6. Cookies and similar technologies
Cookies are small files a website stores on your device. UK law (the Privacy and Electronic Communications Regulations, Schedule A1) sets out narrow exceptions where they don't need your consent. Everything outside those exceptions does.
Strictly necessary — no consent needed (PECR Schedule A1, paragraph 4). These are the ones you'd notice if they vanished: remembering your basket, keeping your checkout session secure, load balancing, and recording your cookie choice. The test is whether you need them to get what you asked for, not whether we find them useful.
| Cookie | What it does | How long |
|---|---|---|
cart, cart_ts, cart_ver
|
Remembers what's in your basket | 2 weeks |
_secure_session_id |
Keeps your checkout session secure | 24 hours |
_tracking_consent |
Remembers your cookie choice | 1 year |
secure_customer_sig |
Keeps you logged in | 20 years |
Analytics and advertising — we ask first. Shopify sets analytics and attribution cookies by default, and we've configured our store so they are only set once you accept. You can change your mind at any time using the cookie settings link on our site.
| Cookie | What it does | How long |
|---|---|---|
_shopify_y |
Recognises a returning visitor, for visitor analytics | 1 year |
_shopify_s |
Tracks a single visit, for session analytics | 30 minutes |
_landing_page, _orig_referrer
|
Records which page and which site you arrived from | 2 weeks |
Third-party tools on our site.
| Tool | What it does | Consent |
|---|---|---|
| Notify Me! | Lets you ask to be told when a sold-out flavour is back, and measures whether those alerts work | Only runs after you accept |
[FOUR PIXELS ARE CURRENTLY INSTALLED IN THIS STORE — 3 app pixels and 1 custom pixel, all tagged analytics and marketing. NAME EACH ONE HERE WITH WHAT IT DOES AND HOW LONG IT LASTS BEFORE PUBLISHING. Shopify holds them until the visitor accepts, so the consent position is fine, but an unnamed pixel is an undisclosed recipient.]
You can also block or delete cookies in your browser settings. Blocking the strictly necessary ones will stop checkout from working.
7. Sending information outside the UK
Our fulfilment partner, Mission Logix Limited, processes your data entirely within the UK. The Shopify Network Intelligence sharing described in section 5 may involve transfers outside the UK, and happens only with your consent. Some of our other providers do not. Shopify is headquartered in Canada and uses infrastructure in the United States and elsewhere.
Where information leaves the UK, we make sure it's protected to UK standards using one of these:
- UK adequacy regulations, where the government has decided a country's protection is equivalent. These are narrower than they sound — for Canada the decision only covers organisations subject to PIPEDA, and for the United States it only covers organisations certified under the UK Extension to the EU–US Data Privacy Framework.
- The UK International Data Transfer Agreement, or the UK Addendum to the EU Standard Contractual Clauses, where adequacy doesn't apply. Our contract with Shopify includes these.
Email hello@berryandbump.com and we'll tell you which safeguard covers a particular transfer and send you a copy of it.
8. How long we keep it
| What | How long | Why |
|---|---|---|
| Order and payment records | 6 years from the end of the financial year | Company tax records (Finance Act 1998, Sch.18 para.21) and VAT records both require 6 years, and it's the limitation period for contract claims (Limitation Act 1980, s.5) |
| Account details | While your account is open; then 6 years if you've ordered, 12 months if you haven't | As above |
| Customer service emails | 2 years from the end of the conversation | Long enough to pick up a repeat issue |
| Product safety and complaint records | 6 years, longer if a claim or investigation is open | Food safety and potential claims |
| Identifying health details within a complaint | Removed or pseudonymised once the investigation closes | See section 3 |
| Newsletter subscribers | Until you unsubscribe; we review inactive subscribers every 2 years and remove them | Consent shouldn't sit unused forever |
| Analytics cookies | As set out in section 6 | — |
After that we delete it, or strip it of anything that identifies you.
9. Your rights
Stopping marketing
You have an absolute right to tell us to stop sending you marketing, at any time, and we must comply. No reason needed, no questions asked. Click unsubscribe in any email, or email hello@berryandbump.com. We'll action it immediately. This right is separate from everything below and we won't ask you to justify it.
Your other rights
You can ask us to:
- give you a copy of the information we hold about you;
- correct anything wrong or incomplete;
- delete it, where we have no legal reason to keep it;
- restrict what we do with it while a dispute is sorted out;
- hand it over to you or another provider in a machine-readable format, where we hold it on the basis of consent or contract;
- stop processing it where we rely on legitimate interests and you object.
We don't make decisions about you by automated means alone, and we don't profile you in ways that have legal or similarly significant effects.
How to use them. Email hello@berryandbump.com. It's free. We'll respond within one month. If your request is complex, or you've made several, we can extend that by up to two further months — we'll tell you within the first month if we need to, and why. If we have to confirm your identity first, or ask you to clarify what you want, the clock pauses until you come back to us.
10. Complaining to us
You have a legal right to complain to us directly about how we handle your personal information, under section 164A of the Data Protection Act 2018.
Email hello@berryandbump.com with "Data protection complaint" in the subject line. We will:
- acknowledge it within 30 days;
- investigate it properly;
- tell you the outcome without undue delay.
You don't have to come to us first, and complaining to us doesn't affect your right to go to the regulator — see section 12.
11. Keeping it safe
Our site runs over an encrypted connection. Account passwords are held by Shopify in hashed form, not as readable text, and we can't see them. Access to customer records is limited to the founders and to the providers who need it for their part of the job. We never store full card numbers; our payment providers state that they are PCI DSS compliant.
No system is perfect. If there's ever a breach likely to risk your rights, we'll report it to the ICO within 72 hours of becoming aware, and tell you directly where the risk to you is high.
12. Complaining to the regulator
You can complain to the UK's data protection regulator at any time:
Information Commissioner's Office Wycliffe House, Water Lane, Wilmslow, Cheshire SK9 5AF Helpline: 0303 123 1113 ico.org.uk/make-a-complaint
13. Children
Our shop is for adults, and we don't direct our advertising at children. We recognise that some of our customers are young mothers, and we treat their information exactly as we treat everyone's.
If you're a parent or guardian and believe a child has given us personal information you'd like removed, email hello@berryandbump.com and we'll deal with it.
14. Changes to this policy
We'll update this page when what we do changes, and the date at the top tells you when it last changed. Where a change materially affects how we use your information, we'll bring it to your attention — by email to subscribers and account holders, or by a notice on the site.
Berry and Bump Ltd, company number 16846137, registered office 124 City Road, London, England, EC1V 2NX. hello@berryandbump.com