Who is responsible for your data?
This website is run for Golden Crust Bakery (demo business), 45-B Main Boulevard, Gulberg III, Lahore, using the SmartPOS Hub storefront and till system. "We", "us" and "our" mean Golden Crust. To contact us about privacy, use the Show email button on the contact page or call +92 42 3575 1100.
Golden Crust is a demo store powered by SmartPOS Hub. Orders are not fulfilled. Please do not enter real sensitive information; any details you submit are handled as described below.
What data do we collect?
We collect only what is needed to take, prepare and support your order.
| Data | What it includes | Where it comes from | Why |
|---|---|---|---|
| SmartPOS customer account | Name, mobile number, email address, saved addresses, password (stored hashed) | You, when you register or check out | To log you in, show your orders and speed up checkout |
| Orders | Items, add-ons, cake messages, uploaded cake photos, branch, pickup slot or delivery address, payment method, order status | You, at checkout | To prepare, hand over or deliver the order and keep sales records |
| Form entries | Custom-cake, bulk-order and contact form answers, and any files you attach | You | To reply and quote |
| Reviews and questions | Your review or question and the display name you choose | You | To publish them on product pages, after moderation |
Activity beacon (sp_vid) |
A random visitor ID, pages viewed, products viewed or added to cart | Your browser — only after you consent | To understand which pages and products are useful |
| Technical logs | IP address, browser type, time of request | Our hosting provider | Security, fraud prevention and fixing errors |
We do not ask for or store card numbers on this website. Payment is cash on delivery, pay at pickup or bank transfer.
What do we store on your device?
| Name | Type | Purpose | Set when | Lasts |
|---|---|---|---|---|
| Session cookie | Strictly necessary cookie | Keeps you signed in and protects forms against forgery | When you visit or sign in | Until you sign out or close the browser |
| Consent cookie | Strictly necessary cookie | Remembers your cookie choice so we do not ask again | When you make a choice | Up to 12 months |
| Cart | Browser localStorage | Keeps the items in your bag between visits | When you add an item | Until you check out or clear it |
sp_vid |
First-party analytics cookie | Random ID for our own activity beacon | Only after you accept | Up to 12 months |
Preferences such as light or dark theme, colour palette, text size and the dismissed announcement bar may also be kept in localStorage on your device; they are not sent to us. See our cookie policy for how to change your choice.
What is our legal basis?
- Contract: to process your order and account.
- Legitimate interest: to keep the site secure and answer your messages.
- Consent: for the
sp_vidactivity beacon. You can withdraw consent at any time from the cookie settings link in the footer. - Legal obligation: to keep sales and tax records.
We handle data in line with the Prevention of Electronic Crimes Act, 2016, which makes unauthorised access to and misuse of personal identity information an offence, and with good practice from the draft Personal Data Protection Bill.
Who do we share data with?
We never sell your data and we do not run third-party advertising pixels. We share data only with:
- SmartPOS Hub, which hosts the storefront and the till system that stores your account and orders.
- Our hosting and security providers, which serve the website and protect it from abuse.
- Our riders, who receive your name, phone number and delivery address for delivery orders only.
- Authorities, where Pakistani law requires it, for example a lawful request under PECA 2016 or a food-safety enquiry by the Punjab Food Authority.
Some providers may process data on servers outside Pakistan. We choose providers that protect data with encryption and access controls.
How long do we keep it?
| Data | Kept for |
|---|---|
| Account | Until you ask us to delete it |
| Orders and sales records | As long as tax and accounting rules require, then deleted or anonymised |
| Form entries | Up to 12 months after the enquiry is closed |
| Uploaded cake photos | Up to 30 days after your order date |
sp_vid activity data |
Up to 12 months, then aggregated |
| Technical logs | Up to 90 days |
What are your rights?
You can ask us to:
- See the personal data we hold about you.
- Correct anything wrong — most details can be edited in your account.
- Delete your account and data we no longer need to keep by law.
- Withdraw consent for the activity beacon at any time.
- Stop marketing — we only send newsletters if you subscribe, and every email has an unsubscribe link.
To make a request, use the Show email button on the contact page or call +92 42 3575 1100. We may ask you to confirm your identity and will reply within 30 days.
How do we protect your data?
The website runs over HTTPS, passwords are hashed, staff access to customer data is limited to people who need it to prepare orders, and forms are protected against spam and forgery. No system is perfectly secure; if we learn of a breach affecting you, we will tell you promptly.
Children
The website is not intended for children under 13 to use without a parent or guardian. We do not knowingly collect their data; a parent can contact us to remove it.
Changes to this policy
We update this page when what we collect or how we use it changes. The date at the top shows the latest version.