Privacy Policy

1. Introduction and company information

This Privacy Policy explains how Greenfield Dairy Co. collects, uses, stores, shares, and protects personal data when you visit our website, contact us, place an order, subscribe to updates, or otherwise interact with us. We are committed to handling personal data lawfully, fairly, transparently, and securely.

The data controller is Greenfield Dairy Co., of Greenfield Dairy Co., 18 High Street, Goole, DN14 5AA, United Kingdom.

If you have any questions about this Privacy Policy or our data practices, you may contact us using the details provided in Section 12.

2. Data collection and processing

We may collect and process the following categories of personal data, depending on your relationship with us and how you interact with our services:

• Identity data: name, title, and similar identifiers.
• Contact data: billing address, delivery address, email address, and telephone number.
• Account data: login details, account preferences, and communication settings, where applicable.
• Transaction data: details of purchases, orders, returns, refunds, and payment-related records.
• Communication data: correspondence with us by email, telephone, contact forms, or other channels.
• Technical data: IP address, browser type, device information, operating system, and website usage data.
• Marketing and preference data: your choices regarding marketing communications and product preferences.
• Delivery and service data: information necessary to fulfil dairy product orders, manage subscriptions, and provide customer support.

We may collect personal data directly from you, automatically through our website and related systems, and from third parties such as payment processors, delivery partners, and service providers.

We do not intentionally collect special category data unless you voluntarily provide it and we are legally permitted to process it. Please avoid including sensitive information in general enquiries unless necessary.

3. Purpose of data processing

We process personal data for the following purposes:

• to provide and manage our products and services;
• to process orders, payments, deliveries, returns, and refunds;
• to communicate with customers, suppliers, and website users;
• to manage customer accounts and preferences;
• to respond to enquiries, complaints, and support requests;
• to send service-related notices and administrative communications;
• to improve our website, products, operations, and customer experience;
• to comply with legal, regulatory, tax, accounting, and reporting obligations;
• to prevent fraud, misuse, and security incidents;
• to conduct marketing, where permitted by law and subject to your preferences;
• to manage business relationships with suppliers, distributors, and other partners.

4. Legal basis for processing

We process personal data only where we have a lawful basis to do so. Depending on the context, our legal bases may include:

• Contract: processing necessary to enter into or perform a contract with you, such as fulfilling orders or managing subscriptions.
• Legal obligation: processing necessary to comply with applicable laws and regulatory requirements.
• Legitimate interests: processing necessary for our legitimate business interests, provided those interests are not overridden by your rights and freedoms. This may include improving services, preventing fraud, securing systems, and managing business operations.
• Consent: processing based on your consent, such as certain marketing communications or optional cookies, where required by law.
• Vital interests: in rare circumstances, processing necessary to protect someone’s vital interests.

Where we rely on legitimate interests, we assess and balance those interests against your rights. Where we rely on consent, you may withdraw it at any time as described in Section 9.

5. Data sharing and third parties

We may share personal data with third parties where necessary for the purposes described in this Privacy Policy. These may include:

• Payment service providers to process card and online payments securely;
• Delivery and logistics providers to deliver dairy products and related goods;
• IT, hosting, cloud, and website service providers to operate our systems and website;
• Professional advisers such as accountants, auditors, insurers, and legal advisers;
• Marketing and communications providers where permitted and appropriate;
• Regulators, law enforcement, and public authorities where required by law or necessary to protect rights and safety;
• Business partners and suppliers involved in the fulfilment of orders or provision of services.

We require third parties to handle personal data in accordance with applicable data protection laws and to use appropriate safeguards. We do not sell personal data in the ordinary sense of the term.

6. Data transfer to third countries

Where personal data is transferred outside the United Kingdom or other applicable jurisdictions, we will take appropriate steps to ensure that such transfers are protected by suitable safeguards and comply with applicable law. These safeguards may include:

• transfers to countries recognised as providing an adequate level of protection;
• standard contractual clauses or equivalent contractual protections;
• supplementary technical and organisational measures where appropriate;
• other lawful transfer mechanisms permitted by applicable privacy laws.

If you would like more information about international transfers and the safeguards we use, please contact us using the details in Section 12.

7. Storage duration

We retain personal data only for as long as necessary for the purposes for which it was collected, including to satisfy legal, accounting, tax, regulatory, and reporting requirements.

Retention periods may vary depending on the type of data and the context in which it is processed. In general:

• customer and transaction records are retained for the period required to manage the relationship and meet legal obligations;
• communication records are retained for as long as needed to resolve enquiries or maintain business records;
• marketing preferences are retained until you unsubscribe or otherwise update your preferences;
• technical and website usage data are retained for a limited period, unless longer retention is required for security, legal, or operational reasons.

When personal data is no longer required, we will delete it securely or anonymise it where appropriate.

8. User rights

Depending on applicable law, you may have the following rights in relation to your personal data:

• Access: to request confirmation of whether we process your personal data and obtain a copy of it;
• Rectification: to request correction of inaccurate or incomplete data;
• Erasure: to request deletion of your personal data in certain circumstances;
• Restriction: to request that we limit the processing of your personal data in certain circumstances;
• Data portability: to receive certain data in a structured, commonly used, machine-readable format and, where feasible, have it transmitted to another controller;
• Objection: to object to processing based on legitimate interests or to direct marketing at any time;
• Automated decision-making rights: where applicable, to obtain information about any automated decision-making and to request human review where required by law.

To exercise any of these rights, please contact us using the details in Section 12. We may need to verify your identity before responding. We will respond within the time limits required by applicable law.

9. Withdrawal of consent

Where we rely on your consent to process personal data, you may withdraw that consent at any time. Withdrawal of consent will not affect the lawfulness of processing carried out before withdrawal.

You may withdraw consent by following the unsubscribe instructions in our communications, adjusting your preferences where available, or contacting us directly using the details in Section 12.

10. Right to complain

If you are concerned about how we handle your personal data, please contact us first so that we can try to resolve the matter promptly and fairly.

You also have the right to lodge a complaint with the relevant data protection supervisory authority. In the United Kingdom, this is the Information Commissioner’s Office (ICO). You may contact the ICO or your local supervisory authority if applicable.

11. Data security

We take appropriate technical and organisational measures to protect personal data against accidental or unlawful destruction, loss, alteration, unauthorised disclosure, or access. These measures may include:

• access controls and role-based permissions;
• encryption and secure transmission methods where appropriate;
• regular system updates and security monitoring;
• staff training and confidentiality obligations;
• backup and recovery procedures;
• supplier due diligence and contractual protections.

While we take reasonable steps to protect personal data, no system can be guaranteed to be completely secure. If we become aware of a personal data breach that is likely to result in a risk to your rights and freedoms, we will take appropriate action in accordance with applicable law.

12. Contact information

If you have any questions, requests, or concerns regarding this Privacy Policy or our processing of personal data, please contact:

• Greenfield Dairy Co.
• Address: Greenfield Dairy Co., 18 High Street, Goole, DN14 5AA, United Kingdom
• Email: [email protected]
• Phone: +44 1405 768 294

13. Changes to privacy policy

We may update this Privacy Policy from time to time to reflect changes in our practices, legal requirements, or operational needs. Any updated version will be posted on our website with a revised effective date where appropriate.

We encourage you to review this Privacy Policy periodically to stay informed about how Greenfield Dairy Co. processes personal data. Your continued use of our services after any changes are posted may signify your acknowledgement of the updated policy, to the extent permitted by law.