( reviews)
( reviews)
Last updated: 1/7/2026
Koko Cakes (“Koko Cakes,” “we,” “us,” or “our”) respects your privacy and is committed to protecting your personal information.
This Privacy Policy explains how we collect, use, store, and share your personal information when you:
place an order with us;
visit our website or online store;
contact us through telephone, email, WhatsApp, social media, or another channel;
visit our store;
request delivery; or
participate in our promotions, competitions, or loyalty programmes.
We process personal information in accordance with the applicable laws of the Kingdom of Bahrain, including Bahrain’s Personal Data Protection Law, Law No. 30 of 2018.
Koko Cakes is a cake and bakery business operating in the Kingdom of Bahrain.
Business or legal name: [Full registered business name]
Commercial Registration number: [CR number]
Business address: [Full Bahrain address]
Email: [Privacy or customer-service email]
Telephone/WhatsApp: [Telephone number]
For the purposes of applicable data-protection law, Koko Cakes is responsible for deciding how and why your personal information is processed.
Depending on how you interact with us, we may collect the following information:
your name;
telephone number;
email address;
billing and delivery address;
order details, including cake design, flavour, size, message, photograph, theme, and event date;
delivery instructions;
payment and transaction information;
correspondence and customer-service enquiries;
reviews, feedback, and competition entries;
marketing preferences; and
dietary, ingredient, or allergy information that you choose to provide.
Please provide only the dietary or allergy information that is necessary for us to understand your order. We will use this information only for handling your request and fulfilling your order, where permitted by law.
When you visit our website or online store, we may automatically collect:
IP address;
browser and device information;
pages visited and actions taken;
approximate location derived from your IP address;
cookie identifiers; and
website usage and diagnostic information.
We may receive information from:
online ordering or e-commerce platforms;
payment service providers;
delivery companies or drivers;
social-media platforms;
advertising and analytics providers; and
a person placing an order or arranging a delivery on your behalf.
If you provide another person’s information to us, such as the recipient of a cake delivery, you should ensure that you are permitted to provide that information.
We may use your personal information to:
receive, prepare, customise, and fulfil your order;
process payments, refunds, and deposits;
confirm orders and communicate changes;
arrange collection or delivery;
respond to questions, complaints, and special requests;
maintain transaction, accounting, and tax records;
prevent fraud, misuse, and security incidents;
improve our products, services, and customer experience;
manage promotions, competitions, and loyalty programmes;
send marketing communications where you have consented or where otherwise permitted by law;
manage our website, cookies, analytics, and advertising;
establish, exercise, or defend legal claims; and
comply with applicable legal and regulatory obligations.
We will not use your personal information for a purpose that is materially different from the purposes described in this Privacy Policy without providing appropriate notice or obtaining consent where required.
Depending on the circumstances and applicable law, we process personal information:
with your consent;
where processing is necessary to accept and fulfil your order or take steps at your request before an order is confirmed;
where processing is necessary to comply with a legal obligation;
where processing is necessary to protect someone’s vital interests; or
where another lawful ground is available under applicable law.
You may withdraw your consent at any time by contacting us. Withdrawal will not affect processing that was lawfully carried out before consent was withdrawn.
Payments may be processed by third-party banks, payment gateways, card processors, or online ordering platforms.
We may receive transaction details such as the payment amount, payment status, payment method, and transaction reference. We generally do not receive or store your complete payment-card number when payment is processed directly by an external payment provider.
The payment provider’s handling of your information may also be governed by its own privacy policy.
When delivery is requested, we may share the recipient’s name, telephone number, address, order reference, and delivery instructions with our employees, drivers, or delivery-service providers.
Delivery partners must use this information only as necessary to complete the delivery and provide related support, subject to their own legal obligations.
You may send us photographs, names, messages, logos, or other materials for a customised cake.
We will use these materials only to prepare and fulfil your order unless you separately agree that we may display the finished cake or related content on our website, social-media accounts, advertisements, or portfolio.
We will not intentionally publish a customer’s personal photograph, private message, or identifying event information for promotional purposes without permission.
You are responsible for ensuring that you have permission to provide any photograph, logo, artwork, or personal information belonging to another person.
Where permitted by law, we may send you news, offers, product updates, or promotional messages by email, SMS, WhatsApp, telephone, or social media.
You may stop receiving marketing communications at any time by:
using the unsubscribe option included in the communication;
replying “STOP” where that option is provided; or
contacting us using the details in Section 17.
Stopping marketing messages will not prevent us from sending necessary communications about an active order, payment, delivery, refund, or customer-service request.
Our website may use cookies and similar technologies to:
keep the website functioning;
remember your preferences or shopping basket;
understand website usage;
measure performance;
prevent fraud; and
provide or measure advertising.
Where required, we will ask for your consent before using non-essential cookies.
You may control cookies through our cookie banner, where available, or through your browser settings. Blocking some cookies may affect the operation of the website.
For more information, please see our [Cookie Policy/link], if applicable.
We may share personal information with carefully selected third parties where necessary, including:
payment processors and banks;
delivery companies and drivers;
website hosting and e-commerce providers;
cloud-storage and business-software providers;
email, SMS, and WhatsApp communication providers;
accountants, auditors, insurers, lawyers, and professional advisers;
advertising and analytics providers, where permitted;
government bodies, regulators, courts, law-enforcement agencies, or other authorities where required by law; and
a buyer, investor, or successor in connection with a proposed or completed sale, restructuring, or transfer of our business.
We do not sell your personal information.
Where a service provider processes information on our behalf, we require it to protect the information and use it only for the agreed services, as appropriate.
Some service providers, cloud platforms, payment providers, social-media companies, or technical systems that we use may process or store information outside the Kingdom of Bahrain.
Where personal information is transferred outside Bahrain, we will take the steps required under applicable law. These may include confirming that the destination provides an adequate level of protection, using approved contractual or organisational safeguards, obtaining necessary authorisation, or obtaining consent where appropriate.
We keep personal information only for as long as reasonably necessary for the purposes described in this Privacy Policy, including to fulfil orders and meet legal, accounting, tax, warranty, dispute-resolution, and recordkeeping requirements.
Typical retention periods are:
Order and transaction records: [Insert period, for example, five years or the legally required period];
Customer-service correspondence: [Insert period];
Custom photographs and design files: [Insert period after order completion];
Marketing information: until you unsubscribe, withdraw consent, or the information is no longer needed;
Website analytics and cookie information: according to the relevant cookie or provider retention period.
We may retain information for a longer period where required by law or reasonably necessary for a dispute, investigation, or legal claim. When information is no longer required, we will securely delete, destroy, or anonymise it.
We use reasonable technical and organisational safeguards designed to protect personal information against accidental or unlawful loss, alteration, destruction, access, use, or disclosure.
These safeguards may include:
limiting access to employees and providers who need the information;
password and account-access controls;
secure payment providers;
staff confidentiality requirements;
secure storage and disposal procedures; and
appropriate system updates and security monitoring.
No website, communication service, or storage system is completely secure. You should avoid sending unnecessary sensitive information through unsecured channels.
Subject to Bahrain law and any applicable exceptions, you may have the right to:
ask whether we process your personal information;
request access to your personal information;
request correction of inaccurate or incomplete information;
request blocking, deletion, or erasure of information in certain circumstances;
withdraw consent where processing is based on consent;
object to processing in certain circumstances;
object to the use of your information for direct marketing;
object to certain decisions based solely on automated processing; and
submit a complaint to the competent Personal Data Protection Authority.
To exercise a right, contact us using the details in Section 17. We may request reasonable proof of identity before acting on your request.
Your rights may be limited where we are legally required or permitted to retain or process the information.
Our products may be purchased for children, but our services are intended to be ordered by adults.
A parent, guardian, or authorised adult should place orders involving a child’s name, photograph, dietary information, or other personal details. We ask customers not to provide more information about a child than is necessary to fulfil the order.
Our website or social-media pages may contain links to third-party websites, payment pages, delivery services, or platforms.
We are not responsible for the privacy practices of organisations that independently control your information. You should review their privacy notices before providing personal information.
For questions about this Privacy Policy or to exercise your privacy rights, contact:
Koko Cakes
Address: [Full address]
Email: [Email address]
Telephone/WhatsApp: [Number]
Please write “Privacy Request” in the subject line or at the beginning of your message.
We encourage you to contact us first so that we can try to resolve your concern.
You may also have the right to submit a complaint to the competent Personal Data Protection Authority in the Kingdom of Bahrain. Current contact and complaint information can be obtained through the Authority’s official website.
We may update this Privacy Policy to reflect changes in our services, systems, providers, or legal obligations.
The updated version will be published on our website or otherwise made available to customers. The “Last updated” date at the top will show when the policy was most recently revised.