Privacy Policy
1. Introduction and company information
This Privacy Policy explains how Northfield Potato Supplies Ltd collects, uses, stores, shares, and protects personal data when you interact with us, including when you visit our website, contact us, place an order, request a quotation, or otherwise engage with our business.
Data controller: Northfield Potato Supplies Ltd
Registered/operating address: Northfield Potatoes, Unit 4, Manor Farm Business Park, Church Lane, Boroughbridge, York YO51 9AR, United Kingdom
Email: [email protected]
Telephone: +44 1423 658 741
We are a potato business supplying products and related services to customers, business partners, and other stakeholders. This policy is intended to provide clear information about our privacy practices and the rights available to individuals in relation to their personal data.
2. Data collection and processing
We may collect and process the following categories of personal data, depending on how you interact with us:
- Identity data: name, title, job title, company name.
- Contact data: address, email address, telephone number, delivery address, billing address.
- Transaction data: order details, invoices, payment status, delivery instructions, purchase history.
- Communication data: correspondence with us by email, phone, web forms, or other channels.
- Technical data: IP address, browser type, device information, cookie identifiers, and website usage data.
- Account and customer service data: records of enquiries, complaints, preferences, and support interactions.
- Compliance data: information needed for legal, tax, accounting, audit, and regulatory obligations.
We may collect data directly from you, automatically when you use our website, and from third parties such as payment providers, delivery partners, business partners, and publicly available sources where lawful and appropriate.
3. Purpose of data processing
We process personal data for the following purposes:
- to supply products and services, including processing enquiries, quotations, orders, and deliveries;
- to manage customer and supplier relationships;
- to issue invoices, process payments, and maintain accounting records;
- to communicate with you about your orders, enquiries, and service matters;
- to improve our website, products, operations, logistics, and customer experience;
- to maintain internal records and support business administration;
- to detect and prevent fraud, misuse, and security incidents;
- to comply with legal, regulatory, tax, and contractual obligations;
- to defend or establish legal claims;
- where permitted, to send service updates or marketing communications.
Because we operate in the potato supply business, we may also process delivery and logistics information to ensure products are supplied efficiently, safely, and in line with order requirements.
4. Legal basis for processing
We rely on one or more of the following legal bases, depending on the context and applicable law:
- Performance of a contract: where processing is necessary to enter into or perform a contract with you, such as fulfilling orders or responding to requests.
- Legitimate interests: where processing is necessary for our legitimate business interests, provided those interests are not overridden by your rights and freedoms. This may include managing our business, improving services, preventing fraud, and securing our systems.
- Legal obligation: where we must process personal data to comply with applicable laws, including tax, accounting, and regulatory requirements.
- Consent: where we have asked for your consent, for example for certain marketing or cookie-related activities where required by law.
5. Data sharing and third parties
We may share personal data with the following categories of recipients, where necessary and lawful:
- service providers that support our operations, including IT, hosting, email, website, and security providers;
- payment processors and financial institutions;
- delivery companies, logistics partners, and warehouse or fulfilment providers;
- professional advisers such as accountants, auditors, insurers, and legal advisers;
- public authorities, regulators, courts, and law enforcement bodies where required by law;
- business partners, customers, or suppliers involved in order fulfilment or service delivery;
- third-party analytics or cookie providers, where applicable and permitted.
We require third parties to handle personal data securely and in accordance with applicable legal requirements. Where third parties act on our behalf, they are expected to process data only in line with our instructions and contractual obligations.
6. Data transfer to third countries
Where personal data is transferred outside the United Kingdom, we will take appropriate steps to ensure that it remains protected in accordance with applicable privacy laws. These safeguards may include:
- transfers to countries recognised as providing an adequate level of protection;
- use of standard contractual clauses or equivalent safeguards;
- technical and organisational measures designed to protect the data during transfer and processing.
If you would like more information about international data transfers, you may contact us using the details below.
7. Storage duration
We retain personal data only for as long as necessary for the purposes for which it was collected, including to satisfy legal, accounting, tax, contractual, and reporting obligations.
- Customer and transaction records: retained for the duration of the business relationship and thereafter for a period required by law or legitimate business needs.
- Enquiries and correspondence: retained for as long as needed to respond to and manage the communication, and for a reasonable period thereafter.
- Marketing preferences: retained until you unsubscribe or object, or until we determine the data is no longer needed.
- Technical and website data: retained for a period appropriate to security, analytics, and operational purposes.
When personal data is no longer required, we will delete, anonymise, or securely archive it where appropriate.
8. User rights
Subject to applicable law, you may have the following rights in relation to your personal data:
- Access: to request confirmation of whether we process your data and to receive a copy of that data.
- Rectification: to request correction of inaccurate or incomplete personal data.
- Erasure: to request deletion of your personal data in certain circumstances.
- Restriction: to request that we limit processing in certain situations.
- Data portability: to request that we provide certain data in a structured, commonly used, machine-readable format, where applicable.
- Objection: to object to processing based on legitimate interests and, in some cases, to direct marketing.
To exercise any of these rights, please contact us using the details provided in the Contact information section. We may need to verify your identity before responding to your request.
9. Withdrawal of consent
Where we rely on your consent to process personal data, you have the right to withdraw that consent at any time. Withdrawal of consent will not affect the lawfulness of processing carried out before the withdrawal.
If you withdraw consent, we may still be able to process your data where we have another lawful basis to do so, such as a legal obligation or legitimate interest.
10. Right to complain
If you have concerns about how we handle your personal data, please contact us first so we can try to resolve the matter promptly and fairly.
You may also have the right to lodge a complaint with the relevant supervisory authority in the United Kingdom, such as the Information Commissioner's Office (ICO), or with another applicable data protection authority if required by law.
11. Data security
We take appropriate technical and organisational measures to protect personal data against unauthorised access, disclosure, alteration, loss, or destruction. These measures may include access controls, secure systems, staff training, backup procedures, and supplier due diligence.
While we strive to protect your information, no system can be guaranteed to be completely secure. You should also take appropriate steps to protect your own information, particularly when using email or online services.
12. Contact information
If you have any questions, requests, or concerns about this Privacy Policy or our processing of personal data, please contact:
Northfield Potato Supplies Ltd
Northfield Potatoes, Unit 4, Manor Farm Business Park, Church Lane, Boroughbridge, York YO51 9AR, United Kingdom
Email: [email protected]
Telephone: +44 1423 658 741
13. Changes to privacy policy
We may update this Privacy Policy from time to time to reflect changes in our practices, legal requirements, or business operations. Any revised version will be posted on our website with an updated effective date where appropriate.
We encourage you to review this Privacy Policy periodically to stay informed about how Northfield Potato Supplies Ltd protects your personal data.