Creating and managing your account with us

To perform our contract with you or to take steps at your request before entering into a contract

Providing products AND/OR services to you

To perform our contract with you or to take steps at your request before entering into a contract

Conducting checks to identify you and verify your identity or to help prevent and detect fraud against you or us

Depending on the circumstances:

—to comply with our legal and regulatory obligations

—in other cases, for our legitimate interests; to protect our business, interests and rights and to minimise fraud that could be damaging for you and/or us

Enforcing legal rights or defending or undertaking legal proceedings

Depending on the circumstances:

—to comply with our legal and regulatory obligations

—in other cases, for our legitimate interests; to protect our business, interests and rights

Customising our website and its content to your particular preferences based on a record of your selected preferences or on your use of our website

Depending on the circumstances:

—your consent as gathered by the separate cookies tool on our website—see ‘Cookies and other tracking technologies’ below

—where we are not required to obtain your consent and do not do so, for our legitimate interests; to be as efficient as we can so we can deliver the best service to you at the best price

If you have provided such a consent, you may withdraw it at any time by changing the setting on the cookies tool (this will not affect the lawfulness of our use of your personal data in reliance on that consent before it was withdrawn)

Retaining and evaluating information on your recent visits to our website and how you move around different sections of our website for analytics purposes to understand how people use our website so that we can make it more intuitive or to check our website is working as intended

Depending on the circumstances:

—your consent as gathered by the separate cookies tool on our website—see ‘Cookies and other tracking technologies’ below

—where we are not required to obtain your consent and do not do so, for our legitimate interests; to be as efficient as we can so we can deliver the best service to you at the best price

If you have provided such a consent, you may withdraw it at any time by changing the setting on the cookies tool (this will not affect the lawfulness of our use of your personal data in reliance on that consent before it was withdrawn)

Communications with you not related to marketing, including about changes to our terms or policies or changes to the products AND/OR services or other important notices

Depending on the circumstances:

—to comply with our legal and regulatory obligations

—in other cases, for our legitimate interests; to be as efficient as we can so we can deliver the best service to you at the best price

Protecting the security of systems and data used to provide the services

To comply with our legal and regulatory obligations

We may also use your personal data to ensure the security of systems and data to a standard that goes beyond our legal obligations, and in those cases our reasons are for our legitimate interests; to protect systems and data and to prevent and detect criminal activity that could be damaging for you and/or us

Statistical analysis to help us understand our customer base

For our legitimate interests; to be as efficient as we can so we can deliver the best service to you at the best price

Updating and enhancing customer records

Depending on the circumstances:

—to perform our contract with you or to take steps at your request before entering into a contract

—to comply with our legal and regulatory obligations

—where neither of the above apply, for our legitimate interests; making sure that we can keep in touch with our customers about existing orders and new products

Disclosures and other activities necessary to comply with legal and regulatory obligations that apply to our business; to record and demonstrate evidence of your consents where relevant.

To comply with our legal and regulatory obligations

Marketing our services to existing and former customers

For our legitimate interests; to promote our business to existing and former customers

See ‘Marketing’ below for further information

To share your personal data with third parties that will or may take control or ownership of some or all of our business (and professional advisors acting on our or their behalf) in connection with a significant corporate transaction or restructuring, including a merger, acquisition, asset sale, initial public offering or in the event of our insolvency

In such cases information will be anonymised where possible and only shared where necessary

Depending on the circumstances:

—to comply with our legal and regulatory obligations

—in other cases, for our legitimate interests; to protect, realise or grow the value in our business and assets

Klaviyo, Inc – a company incorporated in Massachusetts USA with registered number 0001835830, whose registered address is 125 Summer Street, Floor 6, Boston, MA, 02110

Administration of our e-newsletter and mailing list, stores a copy of your contact information to enable our e-newsletter to be sent to you.

Any of the personal data we collect when you sign-up for our e-newsletter (see Personal data we collect about you),

Global Payments, a branch of Pay and Shop Limited, a company incorporated in Ireland with registered number 324929, whose registered office is at The Observatory, 7-11 Sir John Rogerson’s Quay, Dublin 2, Dublin, D02VC42, Ireland

Administration of our online order system and transactions made by telephone or online.

Any of the personal data we collect about you relating to payment for placed orders (see Personal data we collect about you),

Google Inc. – a company incorporated in California USA, with the registered number 0001288776, whose registered office is 1600 Amphitheatre Parkway, Mountain View, CA, 94043

Cookies and similar technologies used for functionality purposes allow you to access features that are fundamental to a service. These cookies are used in order to deliver and maintain Google services. 

Personal data collected from Cookies and other tracking technologies, as set out below.

Information is shared with Google on an aggregated and anonymised basis

Hubspot Inc. – a company incorporated in Delaware USA with the registered number 0001404655, whose registered office is at 2 Canal Park, Cambridge, MA, 02141

Administration of our order and customer records management systems.

Any of the personal data we collect about you (see Personal data we collect about you),

WorldPay Limited – a company incorporated in England with the registered number 03424752, whose registered office is at The Walbrook Building, 25 Walbrook, London, EC4N 8AF

Administration of our transaction systems for orders placed online and facilitation of any payments made.

Any of the personal data we collect about you relating to payment for placed orders (see Personal data we collect about you),

Stripe Payments UK Limited – a company incorporated in England with the registered number 08480771, whose registered office is at 9^th Floor, 107 Cheapside, London, EC2V 6DN

Administration of our transaction systems for orders placed online and facilitation of any payments made.

Any of the personal data we collect about you relating to payment for placed orders (see Personal data we collect about you),

Citric Media, whose office is at 125 Greenleach Lane, Worsley, Manchester, M28 2RS

Information is shared with our website developer to ensure that the website functions properly for all individuals who access it and to ensure a good service is delivered to all customers.

Any of the personal data we collect about you (see Personal data we collect about you),

Steve Pye & Co (KL) Limited – a company incorporated in England with the registered number 08541522, whose registered office is at Unit 3, North Lynn Business Village, Bergen Way, North Lynn Industrial Estate, King’s Lynn, England, PE30 2JG

Information is shared with our accountants for tax purposes. For example, we share invoices we issue and receive with our accountants for the purpose of completing tax returns and our end of year accounts.

Any of the personal data we collect about you relating to the issuance and receipt of invoices (see Personal data we collect about you),

Xero Limited – a company incorporated in England with the registered number 0424347, whose registered office is at 56 Canford Cliffs Road, Poole, Dorset, BH13 7AA

Information is shared with our accountants for tax purposes. For example, we share invoices we issue and receive with our accountants for the purpose of completing tax returns and our end of year accounts.

Any of the personal data we collect about you relating to the issuance and receipt of invoices (see Personal data we collect about you),

DPD Local UK Limited – a company incorporated in England with the registered number 01421773, whose registered office is at DPD Local UK Ltd, Roebuck Lane, Smethwick, West Midlands, United Kingdom, B55 1BY

Information is shared to enable goods to be delivered from our warehouses to a delivery address by the processor.

Any of the personal data we collect about you relating to the delivery of products (see Personal data we collect about you),

GE-BE Transport Limited – a company incorporated in England with the registered number 03958095, whose registered office is at Castle Acre Road, Swaffham, Norfolk, England, PE37 7HY

Information is shared to enable goods to be delivered from our warehouses to a delivery address by the processor.

Any of the personal data we collect about you relating to the delivery of products (see Personal data we collect about you),

Invictor Transport Limited – a company incorporated in England with the registered number 09904635, whose registered office is at Invictor House, Oaktree Business Park, Bristol Road, Highbridge, Somerset, United Kingdom, TA9 4HA

Information is shared to enable goods to be delivered from our warehouses to a delivery address by the processor.

Any of the personal data we collect about you relating to the delivery of products (see Personal data we collect about you),

Parcelforce Limited – a company incorporated in England with the registered number 04585181, whose registered office is at 185 Farringdon Road, London, United Kingdom, EC1A 1AA

Information is shared to enable goods to be delivered from our warehouses to a delivery address by the processor.

Any of the personal data we collect about you relating to the delivery of products (see Personal data we collect about you),

IBA Insurance Services Limited – a company incorporated in England with the registered number 02875870, whose registered office is at Osborne House, 111 High Street, King’s Lynn, Norfolk, PE30 1DA

Information is shared in relation to any insurance claims made against us by you or that we may have to make in relation to products that you have purchased.

Any of the personal data we collect about you relating to an insurance claim (see Personal data we collect about you)

Cin7 UK Limited – a company incorporated in England with the registered number 09794306, whose registered office is at 10 John Street, London, United Kingdom, WC1N 2EB

Information is shared to enable goods to be tracked and inventory managed within our warehouses.

Any of the personal data we collect about you relating to products you order (see Personal data we collect about you),

InXpress – a company incorporated in England with the registered number 04825340, whose registered office is at 5 Blueberry Business Park, Wallhead Road, Rochdale, England, OL16 5DB

Information is shared to enable goods to be delivered from our warehouses to a delivery address by the processor.

Any of the personal data we collect about you relating to the delivery of products (see Personal data we collect about you),

The Alternative Parcels Company Limited (APC) – a company incorporated in England with the registered number 02855735, whose registered office is at National Sortation Centre Blakeney Way, Kingswood Lakeside, Cannock, Staffordshire, WS11 8LD

Information is shared to enable goods to be delivered from our warehouses to a delivery address by the processor.

Any of the personal data we collect about you relating to the delivery of products (see Personal data we collect about you),

Clerk.io ApS, VAT: DK33952848, Kigkurren 8G, 2300 Copenhagen, Denmark

Personalisation of product recommendations, on-site search optimisation, user behaviour tracking, and (if applicable) abandoned cart tracking

IP address, device/browser information, browsing behaviour (e.g. page views, clicks), purchase history, search queries, cart contents, and (if integrated) email address

Krystal Hosting Ltd – a company incorporated in England with the registered number 07571790, whose registered office is at 124 City Road, London, EC1V 2NX

Web and data hosting services;  stores a copy of your personal data on computer equipment so it can be accessed by us and permitted third parties online.

Any of the personal data we collect about you (see Personal data we collect about you),

Record

Retention period

Storage format

Reason

Customers’ account details

Examples:

—records relating to the management of a customer’s account, including the delivery and maintenance of products/services, contract or order records;

—records relating to the administration of customer contracts including billing and accounting, credit notes, invoices, acknowledgement of payment and payment data.

7 years from end of relationship with customer, ie end of contractual relationship or date of last contact (whichever is later)

If permanent historical archive is needed, personal data contained in the record should be deleted.

Electronic and paper

Evidential and business

Sales analysis records

Example: sales reports or usage trend reports containing personal data.

5 years from the date of the earliest record being analysed (where possible the data should be pseudonymised or anonymised)

You may retain the analytical data beyond the retention period if you have removed the personal data

Electronic

 Business

Customer advice and opinions

Example: any advice provided to customers (not including legal advice).

7 years from end of relationship with customer

Where the advice is retained in our know-how database beyond this period, all personal data in advice/opinion must be removed

Electronic

Evidential and business

Customer complaints

Example: records relating to all complaints received, and their status (including those resolved or remaining at deadlock).

7 years from end of relationship with customer (including any extension to the relation while dealing with the complaint)

Where details of the complaint are retained beyond this period, eg for statistical purposes, all personal data must be removed

Electronic and paper

Evidential and business

Details of accounts and products/services not taken up

Example: Quotes or samples provided to customers who do not subsequently make an order.

5 years from end of relationship with customer

Electronic

Business

Customer debt management—internal and/or third party records

Example: Records relating to monitoring, collection and resolution/write-off of customer debts, including records made when a third party is managing the recovery.

7 years from the date resolution, eg recovery or write-off

Where information is retained thereafter, eg for trend reporting, all personal data must be removed

Electronic/paper

Evidential and business

Voice recording—customers (where a privacy notice is provided, recorded, verbal or otherwise)

Example: records of telephone conversations with customers for:

—contract fulfilment purposes;

—training and quality purposes.

6 months from date of the telephone conversation

Retention period may be extended further in the event of an ongoing complaint, claim or dispute—this requires approval from our Data Protection Officer.

Electronic

Evidential and business

If no privacy notice is provided, we should not make a recording—Telecommunications (Lawful Business Practice) (Interception of Communications) Regulations 2000, SI 2000/2699, reg 3(2)

Customer feedback—employee performance

Example: Instant message quality ratings and feedback from customers.

18 months from the date of the record

If records are retained after this date, eg for monitoring trends, all personal data must be removed

Electronic

Business

Reviews by customers

Example: Reviews and evaluation of products/services made by customers to ensure standards are being maintained—includes surveys, interviews, focus groups, product evaluations etc.

5 years from end of relationship with customers

Where information is retained thereafter, eg for trend reporting, all personal data must be removed

Electronic

Business

Records of customers who have signed-up to receive non-marketing newsletters

Until customer unsubscribes

Electronic

Business

Online customer accounts—lapsed

Example: Registered user account of a former customer, who no longer subscribes.

7 years from end of the relationship with customer

Where information is retained thereafter, eg for trend reporting, all personal data must be removed

Electronic

Evidential and business

Direct marketing information relating to a current customer, ie a customer we have engaged with in the past 6 months

2 years from last active engagement

Electronic

Business

Website cookie data for targeted advertising

12 months from the date the cookie or tracking code was created

If records are retained after this date, all personal data must be removed

Electronic

Evidential and business

USA

Google Inc. – a company incorporated in California USA, with the registered number 0001288776, whose registered office is 1600 Amphitheatre Parkway, Mountain View, CA, 94043

Cookies and similar technologies used for functionality purposes allow you to access features that are fundamental to a service. These cookies are used in order to deliver and maintain Google services. 

UK Extension to the EU-US Data Privacy Framework

USA

Klaviyo, Inc – a company incorporated in Massachusetts USA with registered number 0001835830, whose registered address is 125 Summer Street, Floor 6, Boston, MA, 02110

Administration of our e-newsletter and mailing list, stores a copy of your contact information to enable our e-newsletter to be sent to you.

UK Extension to the EU-US Data Privacy Framework

USA

Hubspot Inc. – a company incorporated in Delaware USA with the registered number 0001404655, whose registered office is at 2 Canal Park, Cambridge, MA, 02141

Administration of our order and customer records management systems. Ensuring that customers can place orders and that their information pertaining to their order is retained where necessary.

UK Extension to the EU-US Data Privacy Framework

Ireland

Global Payments, a branch of Pay and Shop Limited, a company incorporated in Ireland with registered number 324929, whose registered office is at The Observatory, 7-11 Sir John Rogerson’s Quay, Dublin 2, Dublin, D02VC42, Ireland

Administration of our online order system and transactions made by telephone or online.

Adequacy regulation further to paragraph 5(1)(a) of Part 3 of Schedule 21 to the Data Protection Act 2018

Access to a copy of your personal data

The right to be provided with a copy of your personal data

A more detailed explanation of this right under UK law is available here

Correction (also known as rectification)

The right to require us to correct any mistakes in your personal data

A more detailed explanation of this right under UK law is available here

Erasure (also known as the right to be forgotten)

The right to require us to delete your personal data—in certain situations

A more detailed explanation of this right under UK law is available here

Restriction of use

The right to require us to restrict use of your personal data in certain circumstances, eg if you contest the accuracy of the data

A more detailed explanation of this right under UK law is available here

Data portability

The right to receive the personal data you provided to us, in a structured, commonly used and machine-readable format and/or transmit that data to a third party—in certain situations

A more detailed explanation of this right under UK law is available here

To object to use

The right to object:

—at any time to your personal data being used for direct marketing (including profiling)

—in certain other situations to our continued use of your personal data, eg where we use your personal data for our legitimate interests unless there are compelling legitimate grounds for the processing to continue or the processing is required for the establishment, exercise or defence of legal claims

A more detailed explanation of this right under UK law is available here

Not to be subject to decisions without human involvement

The right not to be subject to a decision based solely on automated processing (including profiling) that produces legal effects concerning you or similarly significantly affects you

We do not make any such decisions based on data collected by our website

A more detailed explanation of this right under UK law is available here

The right to withdraw consents

If you have provided us with a consent to use your personal data you have a right to withdraw that consent easily at any time

You may withdraw consents by contacting us at [email protected]

Withdrawing a consent will not affect the lawfulness of our use of your personal data in reliance on that consent before it was withdrawn

Address: Foodcare Systems Limited, 1 North Lynn Business Village, Bergen Way, King’s Lynn, PE30 2JG.

Email: [email protected]

Telephone: 01553 770 444

Data Protection Officer Contact Details

Name: Joe Wells

Address: Foodcare Systems Limited, 1 North Lynn Business Village, Bergen Way, King’s Lynn, PE30 2JG.

Email: [email protected]

Telephone: 01553 770 444