Robertshaw’s Farm Shop Ltd Customer Privacy Statement

Introduction:

 Robertshaw’s Farm Shop Limited regards the lawful and correct processing of personal information as an integral part of its business purpose. We believe this is vital for maintaining the trust and confidence of our customers, suppliers, team members and others about whom we process data.

 This privacy statement sets out our commitments to looking after your personal information, it explains who we are, what information we collect and from where, what the information is used for and why, the lawful basis of our processing, who we may need to share the information with, how long we will keep information, what your rights are and how you can exercise them, and how to make a complaint about how we have processed your data.

 Robertshaw’s Farm Shop Ltd’s Commitments:

• We respect and embrace the individual rights enshrined in the General Data Protection Regulation;
• We are committed to upholding the data protection principles;
• We will comply with data protection laws, Information Commissioners Office guidance and recognised best practice;
• We will be open and honest with all individuals whose personal data we handle;
• We will provide training and support for all team members who are involved in handling personal data so that they can do so confidently and consistently;
• We will ensure that all team members and others handling personal information on our behalf are aware of their obligations;
• We will implement adequate and appropriate physical and technical measures to ensure the security and integrity of all data contained in or handled by our systems, and
• We will notify the Information Commissioners Office in the event of any data breach without delay

 Who we are:

 Robertshaw’s Farm Shop Limited (Company No. 08474146) is a data controller of personal information and is entered in the Information Commissioner’s Office (ICO) Register of Data Controllers with registration number ZA478885.

 Our registered office address is:

Robertshaw’s Farm Shop Limited, Keelham Farm Hall, Bradford, West Yorkshire, BD13 3SS, United Kingdom

 We can be contacted by telephone on +44 1274 833472

And by email at help@robertshawsfarmshop.co.uk

The person responsible for data protection matters is our Business Support Manager.

 What information do we collect and from where?

 We may collect, use, store and otherwise process different kinds of personal data about you. The type of data collected will differ according to the reason for data collection. This may include:

• Identity Data such as first name, last name, username or similar identifier, title and gender.
• Contact Data such as billing address, delivery address, email address and telephone numbers.
• Financial Data such as bank account and payment card details.
• Transaction Data such as details about payments to and from you and other details of products and services you have purchased from us.
• Technical Data such as internet protocol (IP) address, MAC address, your login data, browser type and version, time zone setting and location, browser plug-in types and versions, operating system and platform and other technology on the devices you use to access our website.
• Profile Data such as your username and password, purchases or orders made by you, your interests, preferences, feedback and survey responses.
• Usage Data such as information about how you use our website, products and services.
• Marketing and Communications Data such as your preferences in receiving marketing from us and your communication preferences.

 We do not collect any Special Categories of Personal Data about you (this includes details about your race or ethnicity, religious or philosophical beliefs, sex life, sexual orientation, political opinions, trade union membership, information about your health and genetic and biometric data). Nor do we collect any information about criminal convictions and offences.

 Data Security:

 We have put in place appropriate security measures to prevent your personal data from being accidentally lost, used or accessed in an unauthorised way, altered or disclosed. In addition, we limit access to your personal data to those team members and other third parties who have a business need to know. They will only process your personal data on our instructions and they are subject to a duty of confidentiality.

We have put in place procedures to deal with any suspected personal data breach and will notify you and the Information Commissioners Office of a breach.

 Data Retention:

 We will only retain your personal data for as long as necessary to fulfil the purposes we collected it for, including for the purposes of satisfying any legal, accounting, or reporting requirements.

To determine the appropriate retention period for personal data, we consider the amount, nature, and sensitivity of the personal data, the potential risk of harm from unauthorised use or disclosure of your personal data, the purposes for which we process your personal data and whether we can achieve those purposes through other means, and the applicable legal requirements.

In some circumstances we may anonymise your personal data (so that it can no longer be associated with you) for research or statistical purposes in which case we may use this information indefinitely without further notice to you.

When you place an order in the shop

When you place an order in the shop, we may collect the following personal data directly from you:

• Name
• Postal address
• Email address
• Telephone number

We use this information to process your order and facilitate collection.

The lawful basis on which we process this information is for the performance of a contract.

We retain this information until 28 days following completion of your transaction.

 When you place an order online:

When you make a purchase through our website or on any device in the shop or over the phone, we will collect the following personal data directly from you:

• Name
• Age/Date of birth (for age verification purposes)
• Postal address (billing and delivery)
• Email address
• Payment details
• Data collected via cookies and Google analytics (covered in further detail later in this document)

We use this information to process your order and payment, to confirm your order, to verify your age (if the order relates to an age restricted product), to contact you in the event of any difficulties and to facilitate the dispatch and delivery of your order.

Our online shop is powered by Shopify.

When online delivery is set up, we will share your name and address with our chosen logistics partner (TBC) in order to facilitate delivery of your items.

The lawful basis on which we process this information is for the performance of a contract.

We retain financial transaction information for seven years.

 When you sign up for our Customer Loyalty Scheme

When we introduce our Loyalty Scheme we will collect the following personal information directly from you:

• Title
• Full name
• Postcode
• Email address

Data will be stored within our EPOS system on a secure database.

If you choose to receive information on Loyalty offers, information, vouchers and promotions by email, your Name, Account Number and Email Address will be stored on a third-party database provided by Mailchimp https://mailchimp.com/legal/privacy/ .

We use this information to maintain and administer your account.

We will also compile information to enable us to provide you with details of your order history.

We may need to contact you to help us to maintain your account.

The lawful basis on which we process this information is with your consent.

We retain this information until you close your account (withdraw consent), however financial transaction data will be retained for 7 years.

When you create an online account:

When we introduce the facility to create an online account we will collect the following personal information directly from you:

• Name
• Email address
• A user-created user name and password
• Postal address (billing and delivery)
• Payment details

Data will be stored within the database on our website, hosted by Shopify.

We use this information to maintain and administer your account.

We will also compile information to enable us to provide you with details of your order history.

We may need to contact you to help us to maintain your account.

The lawful basis on which we process this information is with your consent.

We retain this information until you close your account (withdraw consent).

When you sign up for our newsletter and promotional information:

When you sign up to receive our newsletter we will collect the following personal information directly from you:

• Name
• Email address
• Loyalty account number (if applicable)

We use this information to email you news, updates and special offers from Robertshaw’s.

Our mailing list is held on a third-party database provided by Mailchimp https://mailchimp.com/legal/privacy/ .  

The lawful basis on which we process this information is with your consent.

We retain this information until you withdraw your consent to receiving our newsletter and promotional information.

When you visit or browse our website:

Our website is hosted by FastHosts https://www.fasthosts.co.uk/terms/policies/privacy-notice .

When you visit www.robertshawsfarmshop.co.uk we use third-party service providers, Google Analytics https://policies.google.com/privacy , to collect standard internet log information and details of visitor behaviour patterns. We do this to find out things such as the number of visitors to the various parts of the site. We do not make, and do not allow Google to make, any attempt to find out the identities of those visiting our website. 

 We use device information that we collect to help us screen for potential risk and fraud (in particular your IP address) and more generally to improve and optimise our site.

 This privacy statement does not cover the links within the Robertshaw’s Farm Shop website that link to other websites. We encourage you to read the privacy statements on the other websites you visit.

 Use of Cookies:

To make full use of the online shopping and personalised features on our website, your computer, tablet or smart phone will need to accept cookies, as we can only provide you with certain personalised features of this website by using them.

Cookies are tiny text files stored on your computer when you visit certain web pages. The main purposes for which cookies are used are:

• For technical purposes essential to effective operation of the website, particularly in relation to online transactions;
• To drive Robertshaw’s marketing
• To enable Robertshaw’s to collect information about the browsing and shopping habits and activities of customers, including the evaluation of campaigns and competitions;
• To enable Robertshaw’s to meet its contractual obligations;
• To make payments to third parties when a product is purchased by someone who has visited our website from a site operated by those parties.

 Disabling Cookies:

If you want to disable cookies you need to change your browser settings to reject cookies. How you do this will depend on which browser you are using. In general the site may not operate properly if cookies are switched off. If you only disable third party cookies you will not be prevented from making purchases on our site. If you disable all cookies you will be unable to complete a purchase on the site.

 Do Not Track Requests:

We do not alter our website’s data collection and use practices when we see a ‘Do Not Track’ signal from your browser.

 Website Security:

We use internet standard encryption technology (‘SSL’ or ‘Secure Socket Layer’ technology) to encode personal data that you send to us when placing an order or browsing through the website. To check that you are in a secure area of the website before sending personal data please look at your browser and check that it displays an image of a closed padlock or an unbroken key.

If you are using a computer or terminal in a public location we recommend that you always log out and close the web browser when you complete an online session.

When you make an enquiry or complaint or raise a concern:

When you make an enquiry or complaint or raise a concern we will collect some or all of the following personal information directly from you:

• Name
• Postal address
• Email address
• Telephone number
• Details of your enquiry/complaint or concern

When we receive a complaint, information given is held in a password protected document on site, behind our company firewall. 

We use the information only to investigate and resolve your enquiry, complaint or concern and to contact you about the matter and its resolution.

The lawful basis on which we process this information is with your consent or for the performance of a contract.

We retain this information until your request or enquiry has been satisfactorily resolved, or until satisfactory reporting has been completed for the investigation.

When you contact us by telephone:

When you contact us by telephone we may collect some or all of the following personal information directly from you:

• Name
• Postal address
• Email address
• Telephone number
• Details of the reason for contacting us

We use the information only to process your enquiry and communicate further with you about the matter.

The information that you provide to us may be held in in a password protected document on site, behind our company firewall, depending on the nature of the phone call. Where possible, no personal details will be recorded.

Telephone conversations are not recorded.

The lawful basis on which we process this information is with your consent or for the performance of a contract.

We retain this information until your request or enquiry has been satisfactorily resolved or until satisfactory reporting has been completed for any required investigation.

When you email us:

When you contact us by email we will collect the following information directly from you:

• Your email address
• Any personal information contained in the body of the email

We use the information only to process your request or enquiry and to contact you about the matter.

The information that you provide to us may be held in a password protected document on site, behind our company firewall. 

We use Microsoft Outlook email system to communicate by email.

The lawful basis on which we process this information is with your consent or for the performance of a contract.

We retain this information until you request deletion. Robertshaw’s employees are trained to delete emails containing personal information at the earliest possible time.

When you contact us using social media:

When you contact us by social media (Facebook, Twitter, Instagram, LinkedIn) we will collect the following information directly from you:

• Your contact details
• Any personal information contained in the body of the message/comment

We use this information only to process your request or enquiry and to contact you about the matter.

The information that you provide to us may be held in a password protected document on site, behind our company firewall, and also on the site by which you have chosen to contact us.

The lawful basis on which we process this information is with your consent or for the performance of a contract.

We retain this information until you request deletion. Robertshaw’s employees are trained to delete correspondence containing personal information at the earliest possible time.

 When you visit our shop:

When you visit our shop, we may collect personal information in the form of images captured on a CCTV surveillance system.

We use this information only for maintaining the security of our property, safety and security of team members and customers and the prevention, detection and investigation of crime.

Our CCTV system is provided by Live View. Live View have no remote access to this system, but may be required to view CCTV when performing repairs or maintenance tasks.

The lawful basis on which we process this information is for legitimate interests.

We securely retain CCTV images for a period of 30 days, and they are then deleted except where required for evidential purposes.

Images retained for evidential purposes may be shared with law enforcement agencies, our lawyers and insurers. All such images are deleted when no longer required for use in civil or criminal legal proceedings.

When you open a Credit Customer Account

When you open a Credit Customer Account, we will process the following personal information:

• Name (Business name and contact name)
• Postal address (billing)
• Telephone number
• Email address
• Transaction and payment details

We use this information only to maintain and operate your account. This information is held on our Sage database and our EPOS system.

The lawful basis on which we process this information is for the performance of a contract.

We will retain this information until the account is closed. Financial transaction data will be retained for 7 years.

When you report an accident on our premises:

When you report an accident, we may collect some or all of the following information directly from you:

• Name
• Postal address (including postcode)
• Telephone number
• Age and date of birth
• Occupation
• Email address
• Details relating to the circumstances of the accident

We will use this information to investigate the accident and to contact you in relation to the matter.

This information may be shared with our insurers and regulatory bodies.

The lawful basis on which we process this information is legal obligation.

We will retain this information for a period of 3 years from the time of the accident or where a claim has been made until that claim is settled. [Where the information relates to an accident to a child, we are required to retain the information until the child has reached the age of 21 years].

When you report lost property

When you report that you have lost your property, we will collect the following information directly from you:

• Your name
• Your address
• Your telephone number
• Description of the property

 We will use this information only to contact you about the matter, verify ownership of item(s) found and their subsequent repatriation.

The lawful basis on which we process this information is with your consent.

We will retain this information for three months or until you withdraw your consent

When you participate in promotional photographs

When you participate in promotional photographs, we collect personal information in the form of images and in some cases a consent form in order for us to use the images on social media and in marketing materials. We may also collect information such as your name, address and age together with details relevant to the promotion.

We will use this information only for marketing and promotional purposes.

The lawful basis on which we process this information is with your consent.

We will retain this information for three years or until you withdraw your consent

When we detect fraud or criminal activity

If we detect fraud or other criminal activity we may share personal information with law enforcement agencies.

The lawful basis of processing is legal obligation.

Children

We do not and will not knowingly collect information from any person under the age of 18 without explicit consent of their parent or guardian.

Persons under the age of 18 must not use the Robertshaw’s Farm Shop website or submit any personal data via the website or via social media.

When we share your information with Third Parties

We will not disclose, sell or otherwise pass on your personal information to any third party except as set out in this privacy statement.

Where, as set out in this privacy statement, we do share your information with a third party for processing we ensure through a legally binding agreement that:

• They only act on our written instructions
• People involved in processing the data are bound by a duty of confidence
• Appropriate measures are taken to ensure the security of the information
• Sub-processors are only engaged with our prior consent and under a written contract
• They assist us in meeting our data protection obligations, providing subject access and facilitating the exercise of individuals rights
• They delete or return all personal data at the end of the contract, and
• They submit to audits and inspections and provide us with any necessary information required for us to meet our data protection obligations.

Protecting your data outside the European Economic Area

The EEA includes all EU Member countries as well as Iceland, Liechtenstein and Norway. We may transfer personal data that we collect from you to third-party data processors in countries that are outside the EEA.

If we do this, we have procedures in place to ensure your data receives the same protection as if it were being processed inside the EEA. For example, our contracts with third parties stipulate the standards they must follow at all times. If you wish for more information about these contracts please contact us.

Any transfer of your personal data will follow applicable laws and we will treat the information under the guiding principles of this Privacy Notice. 

Your Rights

You have the following rights:

• a right to be kept informed about how we process your data. This is the purpose of this Privacy Statement.
• a right to withdraw consent at any time.
• a right to access the personal data that we hold about you. (To exercise this right you will need to complete and submit a subject access request).
• a right to rectification where the data we hold is either inaccurate or incomplete.
• a right to erasure where:
  • the data is no longer required for the purpose that it was originally collected or you have withdrawn your consent;
  • you have objected to processing and there is no overriding legitimate interest to us continuing with our processing activities, and
  • the personal data has been unlawfully processed or must be erased to comply with a legal obligation.
• a right to restrict processing of personal data where:
  • you contest its accuracy;
  • you have objected to the processing and we are considering that objection;
  • the processing is unlawful, and
  • we no longer need the data but you require it to establish, exercise or defend a legal claim.
• a right to data portability.
• a right to object to:
  • processing based on legitimate interests, performance of a task in the public interest or the exercise of official authority;
  • direct marketing, and
  • processing for scientific/historic research or statistical purposes.
• a right to not be subject to a decision when it is based on automated processing and it produces a legal effect or a similarly significant effect on you.

If you wish to exercise any of these rights please contact help@robertshawsfarmshop.co.uk or contact the Business Support Manager on +44 1274 833472 or in writing to the Business Support Manager, Robertshaw’s Farm Shop Limited, Brighouse and Denholme Road, Thornton, Bradford, West Yorkshire, BD13 3SS

Further Information

We try to meet the highest standards when collecting and using personal information. For this reason, we take any complaints we receive about this very seriously. We encourage our customers to bring it to our attention if they think that our collection or use of information is unfair, misleading or inappropriate. We also welcome any suggestions for improving our procedures.

This privacy statement has been drafted with brevity and clarity in mind. It does not provide exhaustive detail of every aspect of our collection and use of personal information. However, we are happy to provide any additional information or explanation needed.

You can also get further information on:

• agreements we have with other organisations for sharing information;
• circumstances where we can pass on personal data without consent for example, to prevent and detect crime and to produce anonymised statistics;
• our instructions to team members on how to collect, use and delete personal data; and
• how we check that the information we hold is accurate and up to date.

Any requests should be sent to help@robertshawsfarmshop.co.uk or contact the Business Support Manager on +44 1274 833472 or in writing to the Business Support Manager, Robertshaw’s Farm Shop Limited, Brighouse and Denholme Road, Thornton, Bradford, West Yorkshire, BD13 3SS

Changes to this privacy statement

We keep our privacy statement under regular review. This privacy statement was last updated on 29^th August 2019.

How to complain

If you wish to make a complaint about how we have processed your data, you can do so by contacting:

Information Commissioner's Office
Wycliffe House
Water Lane
Wilmslow
Cheshire
SK9 5AF