Legal

Privacy policy and cookie notice

This page explains what happens to your information when you read this guide, send us a message, or ask about a gift box. It is written in plain language on purpose — if anything is unclear, write to us and we will explain it.

Last updated: Applies to: sugarandsage.studio Version 1.0

1. Who we are

Sugar & Sage Confectionery (“we”, “us”, “our”) is a small confectionery studio based in Tallinn, Estonia. We are the data controller for the personal data described on this page, which means we decide why and how it is used.

This site is an informational guide to our candy and our craft. We do not sell products online, we do not run advertising profiles, and we do not ask you to create an account.

2. What we collect

Information you give us

When you use the contact form or the gift box builder, the form prepares an email in your own mail app. The details are only sent to us if you press send in that app. If you do send it, we receive:

  • Your name
  • Your email address
  • The topic or box selection you chose
  • Anything you wrote in the message field, including any dietary needs you choose to mention
  • The date and time of your message

Information stored in your browser

The site itself does not have a database or a login. Instead, it uses your browser’s local storage to remember your cookie choice, an optional count of page views on your own device, and (if you subscribe) the email address you entered in the newsletter field. This information stays on your device and is not transmitted to us by this website.

Technical information

Our web host processes standard server logs — IP address, browser type, requested page and timestamps — to deliver pages and to protect the site against abuse. We do not combine those logs with anything else and do not use them to identify visitors.

3. Why we use it, and on what legal basis

What we do Data used Legal basis (GDPR Art. 6)
Answer an enquiry about candy, gifting or a studio visit Name, email, message content Steps taken at your request before a contract (1)(b), and our legitimate interest in replying (1)(f)
Prepare and fulfil a custom or gift order Name, email, delivery details you provide Performance of a contract (1)(b)
Keep records for accounting and tax Order and invoice details Legal obligation (1)(c)
Remember your cookie preference A local storage entry in your browser Strictly necessary — consent not required for essential storage, otherwise your consent (1)(a)
Count anonymous page views, if you allow it A counter in your browser’s local storage Your consent (1)(a), withdrawable at any time
Protect the site from spam and abuse Server logs Legitimate interest (1)(f)

We never use your information for automated decision-making or profiling, and we do not send marketing email to people who have not subscribed.

4. Cookies and local storage

This site does not set advertising or tracking cookies. The banner you saw on arrival refers to three small pieces of local storage that the page itself uses. Local storage works like a cookie but never leaves your browser unless a script sends it, and here nothing does.

Name Type Purpose Expires
sugarSage.cookieConsent Essential Remembers whether you accepted or declined optional measurement, so the banner does not reappear on every visit. Until you clear browser data
sugarSage.localPageViews Optional Counts page views on your own device so we can see which guide sections are useful. Created only if you allow measurement. Until you clear browser data
sugarSage.newsletter Optional Stores the address you typed into the newsletter field, so the demo can confirm the subscription. Created only if you subscribe. Until you clear browser data

Changing your mind

Open “Cookie preferences” in the footer at any time to switch optional measurement on or off. To remove everything at once, clear site data in your browser settings — the site will work normally afterwards.

Back to the guide

If we ever add analytics that send data to a third party, we will update this page and ask for consent before anything is loaded.

5. Who we share it with

We share as little as possible. In practice, that means:

  • Our email provider, which stores the mailbox that receives your message.
  • Our web host, which keeps technical server logs.
  • A courier or postal service, if you order something and we need to deliver it.
  • An accountant, where the law requires us to keep records of a transaction.

We do not sell personal data, we do not share it with advertising networks, and we do not transfer it outside the European Economic Area except where a service provider relies on standard contractual clauses approved by the European Commission.

6. How long we keep it

  • Enquiries that do not become an order: up to 12 months after the last exchange, then deleted.
  • Order and delivery details: for the period required by Estonian accounting law, currently seven years.
  • Newsletter subscriptions: until you unsubscribe, plus a short suppression record so we do not email you again by mistake.
  • Server logs: typically 30 to 90 days, depending on the host.
  • Browser storage: until you clear it, as described above.

7. Your rights

Under the GDPR you have the right to:

  • Access the personal data we hold about you and receive a copy.
  • Correct information that is wrong or incomplete.
  • Erase information we no longer have a lawful reason to keep.
  • Restrict or object to certain processing, including processing based on our legitimate interests.
  • Portability — receive your data in a structured, machine-readable format.
  • Withdraw consent at any time, without affecting what was done before you withdrew it.

To exercise any of these, email sugarandsage.studio@gmail.com with the subject “Privacy request”. We answer within 30 days and may ask for proof of identity to protect your data. If you are unhappy with our answer, you can complain to the Estonian Data Protection Inspectorate (Andmekaitse Inspektsioon), Tatari 39, 10134 Tallinn, or to the supervisory authority in your own country.

8. How we protect it

The site is served over HTTPS. Access to our mailbox and order records is limited to the two people who run the studio, protected by two-factor authentication. Paper order notes are kept in a locked drawer and shredded once they are no longer needed. No system is perfectly secure, but we keep the amount of data we hold deliberately small.

9. Children

Our website is not directed at children. We do not knowingly collect personal data from anyone under 16. If a child has sent us a message, write to us and we will delete it. Note that hard candy is a choking hazard and is not suitable for children under three.

10. Changes to this policy

When we change how the site works, we update this page and the date at the top. If a change affects your rights, we will say so clearly at the top of the page for at least 30 days.

11. Contact

Questions about privacy, or a request about your data, can go to the same place as everything else:

We answer within two business days, Wednesday to Saturday.

One page, no dark patterns

There is no pre-ticked box, no “accept or leave” wall, and no hidden third-party script on this site. The cookie banner offers “Essential only” with the same prominence as “Accept all”, because that choice belongs to you.

Your choice

Cookie preferences

Essential storage keeps the site working and remembers this choice. Optional measurement helps us understand which sections readers use. You can change this at any time from the footer.

Essential

Remembers your cookie choice and keeps the mobile menu and forms working. Required, cannot be switched off.

Always on

Anonymous measurement

Counts page views locally in your browser so we can see which guide sections are useful. No advertising, no profile, no third-party scripts.