Islington, Monday to Friday, 10 to 6 Holborn opens late autumn 2026 at Unit 2, Sicilian Avenue Catering across London with 24 hours' notice
Privacy and cookies

Your data, plainly

What we collect when you order, write to us or sign up, why we collect it, and how to change your mind. No legalese where plain English will do.

Last updated 7 October 2026

Who we are

Santo Cielo bakes Tuscan schiacciata and sells sandwiches, platters and merch from Unit 5, 149 Roman Way, London N7 8XH. We are the data controller for the personal information described on this page.

Questions, requests or complaints about your data: info@santocielo.co.uk or write to the address above. We reply within one month.

What we collect and why

Only what the job needs
When you order
WhatName, email, phone, delivery address, what you ordered, and the time you want it. Payment is taken by Square. We never see your full card number.
WhyTo make your order, take payment, get it to you, and deal with any problem afterwards.
Lawful basisPerforming a contract with you. Keeping sales records is a legal obligation.
Kept forSix years after the order, because HMRC requires it. Your Square account is yours to delete at any time.

Orders placed through Deliveroo or Uber Eats are covered by their privacy notices as well as ours. They pass us only what we need to make and hand over the food.

When you write to us
WhatWhatever you put in the contact, platter, wholesale or partnership form: usually your name, email, phone, company and your message.
WhyTo answer you and, if it leads somewhere, to arrange the order or the work.
Lawful basisOur legitimate interest in replying to people who contact us, or steps you've asked us to take before a contract.
Kept forUp to 12 months after the conversation ends, longer if it became an order.

The forms are delivered to our inbox by FormSubmit, a form-to-email service. It passes the message on and does not use it for anything else.

When you sign up
WhatYour email address, the date you signed up, and which emails you open or click.
WhyTo send you news: new sandwiches, specials, the Holborn opening, the odd offer. A few emails a month at most.
Lawful basisYour consent, which you can withdraw at any time.
Kept forUntil you unsubscribe. We then keep a record of the unsubscribe so we don't email you again.
When you've bought from us

If you've ordered from us online, we may email you about similar things we sell: new sandwiches, platters, merch and offers. UK law allows this for existing customers, as long as you were given the chance to opt out when we took your details and in every email since. Every email we send has an unsubscribe link, and one click ends it. We never sell, rent or swap our customer list.

When you visit the site

Our hosting provider keeps standard server logs: the IP address of each request, the page asked for, and the browser used. These are used to keep the site running and secure and are deleted on the provider's normal schedule. If you click Accept all on the cookie banner, we also use Google Analytics to count visits and see which pages and buttons get used, and may use the Meta pixel so we can show our posts to people who have visited the site. Both are off until you say yes, and neither gives us your name or email.

Cookies and similar things

Short list
Change your choice
What this site stores
sc_consentYour cookie choice from the banner, so we don't ask again. Stored in your browser for 12 months. Essential.
sc_holborn_seen_v1Remembers that you've seen the Holborn opening note, so it doesn't pop up every visit. Stored in your browser. Essential.
Google AnalyticsCounts visits and which pages and buttons get used. Sets _ga and _ga_* cookies for up to 2 years. Only after Accept all.
Meta pixelLets Instagram and Facebook show our posts to people who have visited. Sets the _fbp cookie for 3 months. Only after Accept all, and only if we have switched it on.
Google MapsThe maps on the contact page are loaded from Google, which sets its own cookies. We only load them if you accept all cookies, or click Show map.
FontsServed from our own site. Nothing is sent to a font provider.
Instagram, TikTok, FacebookWe link to them. We do not embed them, so nothing from them loads on this site unless you click through.

The banner has two choices. Essential only keeps the first two items and nothing else. Accept all also switches on Google Analytics, the Meta pixel if we are using it, and the Google maps. You can change your choice at any time from the link in the footer.

Who we share it with

Only to do the job
Our providers
SquareRuns the online shop, the till and payments. Square is a payment provider in its own right and has its own privacy notice.
DeliveryOur delivery partner gets your name, address, phone and the delivery time for the orders they carry, and nothing else.
FormSubmitPasses form messages from the website to our inbox.
EmailThe service we use to send newsletters stores your email address and sends on our behalf.
HostingThe company that hosts this website keeps the server logs described above.

Each of them works under a contract that limits what they can do with your data to the job we've asked for. Some are based outside the UK; where they are, the transfer is covered by the UK's adequacy decisions or the standard contractual safeguards. We would only hand data to anyone else if the law required it.

Your rights

Free, and usually quick
What you can ask
See itA copy of the personal data we hold about you.
Fix itCorrection of anything that's wrong or out of date.
Delete itErasure, unless we have to keep it, for example sales records for HMRC.
Stop itObject to marketing at any time, or ask us to restrict what we do with your data while we sort something out.
Take itA copy of the data you gave us in a format you can use elsewhere.
Change your mindWithdraw consent, for example to the newsletter, without affecting anything done before.

Email info@santocielo.co.uk. We'll reply within a month. If you're not happy with how we've handled your data, you can complain to the Information Commissioner's Office at ico.org.uk or on 0303 123 1113. We'd rather hear from you first so we can put it right.

The rest
Security

Payments are handled entirely by Square over encrypted connections. Our own records are kept in password protected systems with access limited to the people who need it. No system is perfect, but we take reasonable care and would tell you and the ICO without delay if something went wrong with your data.

Children

This site and our emails are aimed at adults. We don't knowingly collect data from anyone under 16. If you think we have, tell us and we'll delete it.

Links to other sites

Deliveroo, Uber Eats, our suppliers, our merch shop and our social channels each have their own privacy notices. Once you click through, theirs apply.

Changes to this notice

If we change how we use your data we'll update this page and the date at the top. If the change matters to you, for example a new kind of use, we'll email customers and subscribers first.