privacy
policy

Privacy Policy

Last updated: 23 July 2026

About us

The Bagel Shop is a trading name of Devon Wave Trading Company Limited.

Devon Wave Trading Company Limited is the data controller responsible for the personal information described in this privacy policy.

Our details are: Devon Wave Trading Company Limited
Company number: 13118107
Registered office: Cosmopolitan House, Old Fore Street, Sidmouth, England, EX10 8LS
Email: hello@wavetrading.co.uk

This policy explains what personal information we collect, why we use it, who we may share it with and the rights available to you.

Personal information we collect

Depending on how you interact with us, we may collect:

Your name
Email address
Telephone number
Postal or billing address
Details contained in enquiries, feedback or complaints
Information about orders, bookings, payments, refunds and gift cards
Dietary requirements, allergies or intolerances you choose to tell us about
Newsletter and marketing preferences
Your CV, employment history, qualifications and other recruitment information
Technical information including your IP address, browser type, device information and website activity
Information collected through cookies and similar technologies
Correspondence between you and our team

We may collect your date of birth where it is genuinely relevant, such as during recruitment or where you have chosen to take part in a birthday promotion. Providing this information for an ordinary customer enquiry should be optional.

How we use your information

Customer enquiries

We use your contact details and the contents of your message to respond to questions, requests, feedback or complaints.

Our lawful basis is our legitimate interest in communicating with customers and managing our business. Where your enquiry relates to a potential order or booking, we may also use the information to take steps at your request before entering into a contract.

Orders, collections and gift cards

We use information about your order and contact details to:

Process and fulfil your order
Arrange collection or delivery
Take and confirm payment
Contact you about changes or problems
Issue refunds where appropriate
Maintain financial and transaction records
Prevent fraud and resolve disputes

Our lawful bases are performance of a contract, compliance with legal obligations and our legitimate interests in administering and protecting our business.

Payment card details are normally processed directly by our payment provider. We do not ordinarily receive or retain your complete card details.

Allergies and health-related information

Where you voluntarily tell us about an allergy, intolerance, disability or other health-related requirement, we will use that information only to deal with your request or order safely.

Because this may be health information, we rely on your explicit consent to use it for that purpose. You can withdraw your consent, although this may mean we are unable to fulfil a particular request safely.

Marketing

Where you have chosen to receive news, offers or updates, we may use your name and email address to contact you.

Our lawful basis is your consent. You can unsubscribe at any time using the link in any marketing email or by contacting us.

Unsubscribing will not prevent us from sending necessary messages relating to an existing order, enquiry or transaction.

Recruitment

Where you apply to work with us, we may use your information to:

Assess your suitability for a role
Communicate with you about your application
Arrange interviews or trial shifts
Check references, qualifications or your right to work where appropriate
Keep records of our recruitment decisions
Make an offer and prepare an employment or freelance agreement

Our lawful bases include taking steps before entering into a contract, compliance with legal obligations and our legitimate interest in recruiting suitable people.

Where you provide health, disability or other special-category information, we will only use it where necessary and where an additional lawful condition applies, including employment-law obligations or your explicit consent.

Website operation, security and analytics

We use technical information to operate and secure the website, diagnose faults, prevent misuse and understand how visitors use it.

Strictly necessary website functions may be used on the basis of our legitimate interests. We will only use non-essential analytics, functional or advertising cookies after you have given consent through our cookie controls.

Where we obtain information

We normally obtain information directly from you.

We may also receive information from:

Our website and hosting provider
Payment and ordering providers such as Square
Delivery platforms
Social-media platforms where you contact us
Recruitment websites or agencies
Other people making an enquiry or booking on your behalf
Public sources where appropriate

Who we share information with

We may share relevant information with trusted organisations that help us operate, including:

Website hosting and support providers
Email and cloud-storage providers
Payment, ordering and gift-card providers
Delivery and collection platforms
Accountants, payroll providers and professional advisers
IT and cybersecurity providers
Recruitment providers
Regulators, law-enforcement bodies or public authorities where legally required
Insurers or legal advisers in connection with a complaint, claim or dispute

These organisations may act as processors handling information on our instructions or as separate controllers responsible for their own use of information.

We do not sell personal information to advertisers.

International transfers

Some of our service providers may process information outside the United Kingdom.

Where this happens, we require appropriate protections to be in place, such as processing in a country recognised as providing adequate protection or the use of approved contractual safeguards.

How long we keep information

We retain personal information only for as long as reasonably necessary.

Our usual periods are:

General enquiries: up to 12 months after the enquiry is closed
Complaints and significant incidents: normally up to six years, depending on the circumstances
Orders, payments and accounting information: normally six years from the end of the relevant financial year
Marketing records: until you unsubscribe or withdraw consent
Suppression records: a minimal record may be retained to ensure we do not contact you again
Unsuccessful job applications: normally six months after the recruitment process ends
Applications retained for future vacancies: only with your agreement and normally for no more than 12 months
Successful applications: transferred to the individual’s employment record
Cookie information: for the periods shown in our Cookie Settings

We may retain information for longer where required by law or where necessary in connection with a legal claim. Limited companies are generally required to retain relevant accounting records for six years.

Keeping information secure

We use reasonable organisational and technical measures to protect personal information against loss, misuse, unauthorised access, alteration or disclosure.

Access is limited to people who reasonably need the information for their work.

Your rights

Depending on the circumstances, you may have the right to:

Ask for a copy of your personal information
Ask us to correct inaccurate or incomplete information
Ask us to delete information
Ask us to restrict how information is used
Object to certain uses of information
Receive certain information in a portable format
Withdraw consent at any time
Complain about how your information has been used

These rights are not absolute and may be subject to legal exceptions. The UK GDPR requires businesses to explain clearly what they do with personal information and how people can exercise their rights.

To exercise a right, contact:

hello@wavetrading.co.uk

We may need to verify your identity before acting on a request.

Complaints

Please contact us first so that we have an opportunity to resolve your concern.

You also have the right to complain to the Information Commissioner’s Office, the UK regulator responsible for data protection.

Changes to this policy

We may update this policy where our services, suppliers or legal obligations change.

The latest version will always be published on this website with its effective date.