Who we are
Ferment & Fold (also Ferment & Fold Diagnostics) is run by Matthew Smith, a sole trader, trading as Ferment & Fold. We are the controller of your personal data.
- Address: Chimneys, New Mills, Newtown, Powys SY16 3NQ
- Email: hello@fermentandfold.co.uk
- Regulator: the Information Commissioner's Office (ICO), the UK's data protection regulator
What we collect
- Audit enquiries: your name, bakery, email address, phone number (optional), production details such as your formula, process and equipment, and any photographs you upload.
- Purchases: your name, email address and payment confirmation when you buy through Stripe. We never see your full card details.
- Emails: anything you send us, and our replies.
- Business outreach: a bakery's name, the generic business email address it publishes (for example hello@ or info@), and short notes on why our services may be relevant. We take these from public sources such as the bakery's own website and Companies House.
- Website: our hosting and security provider, Cloudflare, processes technical data such as your IP address. It sets one strictly necessary security cookie (
__cf_bm), which helps block automated traffic and expires after 30 minutes. Fonts load from Google Fonts, so Google receives your IP address. We don't use analytics or advertising cookies.
Why we use it (lawful bases)
- Contract: to assess your audit enquiry, deliver audits and reports, and supply products you buy.
- Legal obligation: to keep tax and accounting records.
- Legitimate interests: to answer enquiries, and to send short, relevant business-to-business emails about our services to bakeries' business addresses. We keep them few, personal and easy to stop.
Business emails and sole traders
We only send unsolicited emails to limited companies, LLPs and other corporate bodies, at business addresses they publish. Under the Privacy and Electronic Communications Regulations (PECR), sole traders and partnerships are treated like individuals. We won't send them marketing emails unless they've agreed to it, or they've bought from us or asked about our services and had a chance to opt out ("soft opt-in"). Every email says who we are and how to opt out.
Who we share it with
These providers process data on our behalf:
- Make (automation, EU-hosted), including its built-in AI tools for sorting enquiries and replies
- Dropbox (storing intake forms and uploaded photos)
- Stripe (payments)
- Apple iCloud Mail (email)
- ChatGPT Sites (OpenAI) and Cloudflare (website hosting and security)
- Google Fonts (website fonts)
Some process data outside the UK, for example in the US, under UK adequacy regulations or approved contract clauses. We never sell your data, and no decisions about you are made by automated means alone.
How long we keep it
- Outreach records with no reply: 12 months after last contact
- Opt-outs: kept permanently, as the email address and date only, so we never contact you again
- Enquiries that don't go ahead: 6 months
- Audit files, photographs and reports: 2 years after delivery
- Purchase and accounting records: 6 years, as UK tax rules require
- General emails: 2 years
Your rights
You can ask to see, correct, delete or move your data, or restrict or object to how we use it. You can object to marketing at any time. Email hello@fermentandfold.co.uk and we'll reply within one month.
To stop our emails: reply "no thanks" to any email, or write to hello@fermentandfold.co.uk. We'll add you to our do-not-contact list straight away.
If you're unhappy, please tell us first. You can also complain to the Information Commissioner's Office at ico.org.uk/make-a-complaint or on 0303 123 1113.