Your details, handled with care
What we collect when you order, what we do with it, and how to ask us to remove it.
This is a working draft prepared for Uju Cakes. The details in [square brackets] still need to be filled in, and it has not yet been reviewed by an attorney. Last updated 8 September 2026.
What we collect when you order a cake, why we are allowed to hold it, how long we keep it, and what you can make us do about it. Written to POPIA.
Uju Cakes, a sole proprietorship, is the “responsible party” for your personal information under the Protection of Personal Information Act 4 of 2013 (“POPIA”).
This policy explains what we collect when you browse this site or order a cake, why we hold it, how long we keep it, who else sees it, and what you can require us to do about it.
Our Information Officer can be reached at uju.cakes@gmail.com.
When you orderyour name, contact number, email address, the occasion, the date, your delivery address if you want delivery, your design brief and any allergy or dietary information you give us.
When you payproof of payment and the reference on it. We do not take card details on this website and we never see or store your card number.
When you message usthe content of the emails, WhatsApp messages or social media messages you send us.
Automatically, when you browsebasic technical information such as your IP address, browser and the pages you visited. This site does not run advertising trackers or third-party analytics.
Health informationan allergy or dietary requirement is “special personal information” under POPIA section 26. We only collect it because you have chosen to give it to us so that we can bake safely for you, we use it for nothing else, and we delete it with the rest of your order record.
To perform our contract with youwe cannot quote, bake, or deliver without your name, contact details, brief and date.
Because the law requires itinvoices and financial records must be kept for five years under the Tax Administration Act.
Our legitimate interestskeeping a record of past orders so we can answer a question about one, and protecting ourselves if there is a dispute.
Your consentfor marketing, and for processing an allergy or dietary requirement. You can withdraw consent at any time and we will stop.
We will only send you marketing if you have asked for it, or if you are an existing customer and it relates to something similar to what you ordered, which is what POPIA section 69 allows.
Every marketing message carries a way to stop it, and stopping is free and immediate. Ask once and we will not ask again.
We do not sell, rent or trade your details to anyone, ever.
Only where it is needed to fulfil your order or run the business:
Where a provider processes information for us they are an “operator” under POPIA, and are required to keep it confidential and secure and to process it only on our instructions.
Some of these providers store data outside South Africa. Where that happens we rely on POPIA section 72, which permits a transfer where the recipient is bound by rules giving comparable protection, or where the transfer is necessary to perform our contract with you.
After that we delete or destroy the information securely.
We keep access to your information limited to the people who need it, we use password-protected accounts and devices, and this website is served over an encrypted connection.
We are a small business and we do not pretend to have enterprise security. What we do have is a small footprint: we hold very little, we do not sell it, and we do not keep it longer than we said we would.
If your information is ever accessed by someone who should not have it, POPIA section 22 requires us to notify you and the Information Regulator as soon as reasonably possible. We will tell you what happened, what it means for you and what we are doing about it.
Under POPIA you may:
To exercise any of these, email uju.cakes@gmail.com. We will respond within 30 days. There is no charge, unless a request is repetitive or excessive.
The Information Regulator can be reached at enquiries@inforegulator.org.za, or at JD House, 27 Stiemens Street, Braamfontein, Johannesburg.
We do not knowingly collect information about anyone under 18. Cakes are often for children, but the order comes from the adult placing it, and we do not need the child’s details beyond a name to pipe on the cake.
If you believe we hold a child’s information without a parent or guardian’s consent, tell us and we will delete it.
This website uses only what it needs to work. It does not set advertising or profiling cookies and does not run third-party analytics.
Your browser may store a small amount of data locally to remember things like a form in progress. You can clear that at any time from your browser settings without affecting your ability to use the site.
This policy was last updated on 8 September 2026.
If we change it materially we will say so on this page. Continuing to use the site after a change means you accept the updated policy.
Still want cake?
Questions about any of the above? Ask Uju when you send your order through.
