This policy describes the personal information we collect when you visit cakeday.com.au or use the Cakeday service, why we collect it, how we use it, and the rights you have under the Privacy Act 1988 (Cth) and the Australian Privacy Principles.
“We”, “us” and “our” refer to CakedayCo. By using the site, creating an account, or completing a team link form, you agree to the practices described here.
It covers two groups: client businesses that use our service, and the employees of those businesses who receive a celebration.
We ask for your name, the day and month of your birthday, and what you can’t eat. We never ask for the year you were born, and we do not ask for your home address — celebrations are delivered to your workplace.
Your answers are shared with your employer so they can keep your details accurate. Anything you enter here — including dietary requirements and allergies — is visible to the people at your workplace who manage your account.
We collect the following categories of personal information, directly from you and from the business you work for:
Client account and billing information, including business name, ABN, office addresses, contact name, work email, phone number, and payment details held by our payment processor.
Celebration calendar information provided by a client business, including an employee’s name, the day and month of their birthday, and their office location. We do not collect year of birth.
Information you give us through the team link, including dietary requirements, allergies, flavour preference, whether you are usually in the office, an optional mobile number, and whether you have opted out.
Communications, including emails, support messages and other correspondence you send us.
Device and connection data when you use the site, including IP address, browser type, operating system and pages visited.
Home addresses. Year of birth. Government identifiers. Employment, performance or health information beyond what you choose to tell us about food. We also do not buy personal information from data brokers or advertising platforms, and we do not draw inferences about you for marketing.
Some dietary requirements reveal information the Privacy Act treats as sensitive — a medical allergy is health information, and a halal or kosher requirement relates to religious belief. We collect this only with your consent, which you give by choosing to complete the form. You do not have to.
You can describe a requirement without saying why — “no nuts” is enough, and we never ask for a reason. You can leave the field blank and receive a standard product, or opt out of celebrations altogether. We use this information to arrange your celebration. It is also visible to your employer’s account administrators.
A client business shares one private link with its team. What you enter through it is visible both to us and to the account administrators at your workplace. If you would rather your employer did not hold this information, use the opt-out — no celebration will be arranged and nothing will be recorded beyond your exclusion
We use personal information to:
Schedule and arrange celebrations, including working out the correct delivery day where a date falls on a weekend, public holiday or office closure.
Order a product that matches a recipient’s dietary requirements.
Arrange delivery to the workplace and confirm it beforehand.
Maintain a record of opt-outs so nobody is asked twice.
Invoice client businesses and meet our tax and accounting obligations.
Respond to questions, resolve problems and improve the service.
Establish, exercise or defend a legal claim.
Share your details with your employer’s account administrators so they can keep them accurate
We do not use personal information for advertising, remarketing, lookalike audiences or profiling. We do not use it to train machine-learning models. We do not sell it, and we do not share it with advertising platforms or data brokers. These are commitments, not omissions.
We share personal information only with the parties below, and only the minimum each one needs:
|
Who |
What they receive |
|
Bakeries and suppliers |
First name, dietary requirement and delivery date. Not your email, phone number or employer. |
|
Couriers and delivery partners |
Recipient name, the workplace delivery address, the delivery date, and a mobile number only where one was given. |
|
Payment processor |
Client billing information only. No employee information. |
|
Hosting, email and support providers |
Data stored or transmitted through their systems under contract. |
|
Professional advisors |
Accountants, auditors or lawyers, where necessary. |
|
Your employer |
Everything you enter through the team link, including dietary requirements and allergies. |
We may also disclose information where required by law, where necessary to enforce our terms, or where necessary to protect someone’s safety. In the event of a merger, acquisition or sale of assets, personal information may transfer to the counterparty, and we will tell client businesses if that happens.
We use cookies and similar technologies to operate the site, remember your preferences and understand how the site is used. [CONFIRM: name your analytics tool here, or state that you use none and delete the rest of this section.]
We do not use advertising cookies, tracking pixels or third-party marketing tags. Most browsers let you reject cookies; some parts of the site may not work as well if you do.
We are an Australian business and the service is run from Australia. Our bakeries, couriers and suppliers are all Australian. Some of our service providers, however, store or process data overseas.
Payments. We use Stripe to process payments. Stripe is a global company and may store and process payment information outside Australia, including in the United States. Card details are entered directly with Stripe — we never see or store them, and we do not send Stripe any employee information.
Website hosting. Our website is hosted by ServeTech Global. Our website does not store employee information.
Email and documents. We use Google for email and for the documents in which celebration calendars are held. Google stores and processes data across global regions, including the United States and the European Union.
Where personal information is transferred overseas, we take reasonable steps under Australian Privacy Principle 8 to ensure the recipient handles it consistently with the Australian Privacy Principles.
We keep personal information only for as long as it is needed:
|
Information |
Kept for |
|
Delivery contact details |
Deleted or de-identified within 30 days after the relevant delivery |
|
Name, birthday, dietary requirements |
While your employer holds an account and you remain on their team |
|
Opt-out record |
While the account is active, so you are not asked again |
|
Client billing records |
7 years, as required by Australian tax law |
When a client account closes, we delete or de-identify employee information within [90] days, except where we are required to keep it by law. You may request deletion at any time under section 9.
We use technical and organisational measures appropriate to the sensitivity of the information, including HTTPS in transit, encryption at rest where applicable, role-based access limiting who on our team can see what, and contractual obligations on our providers.
No system is perfectly secure. If a data breach occurs that is likely to result in serious harm, we will notify affected individuals and the Office of the Australian Information Commissioner as required under the Notifiable Data Breaches scheme.
You have the right to ask us what personal information we hold about you, to have it corrected if it is wrong, and to have it deleted. Where we rely on your consent — including for dietary and allergen information — you may withdraw it at any time.
To exercise any of these rights, email [hello@cakeday.com.au] with the subject “Privacy Request”. We will respond within 30 days, at no charge. We may need to verify your identity first. If we refuse a request, we will tell you why in writing.
If you are not satisfied with our response, you can complain to the Office of the Australian Information Commissioner at oaic.gov.au or 1300 363 992.
The service is directed at businesses and their employees. It is not directed at children, and we do not knowingly collect personal information from anyone under 16.
We may update this policy. The “last updated” date at the top reflects the current version. Where a change materially affects how we handle personal information, we will notify client businesses by email at least 30 days beforehand.
