PRIVACY POLICY
Policy Statement
Every day our business may receive, use and store personal information about our customers and employees. It is important that this information is handled lawfully and appropriately in line with the requirements of the Data Protection Act 2018 and the General Data Protection Regulation (collectively referred to as the ‘Data Protection Requirements’).
We take our data protection duties seriously because we respect the trust that is being placed in us to use personal information (Personal Data) appropriately and responsibly.
About this Policy
This Policy, and any other documents referred to in it, sets out the basis upon which we will process Personal Data we collect or use.
Please read it carefully as it describes our collection, use, disclosure, retention and protection of your Personal Data.
If you are an individual employee or representative of an organisation, you are still considered as an individual and have the same rights.
Criterion Ices Ltd is responsible for ensuring compliance with the Data Protection Requirements and with this Policy.
Criterion Ices Ltd are the Data Controller with regards to any Personal Data processed and our contact details are: Criterion Ices Ltd, Manor Farm Creamery, Bird Green, Thurston, Bury St Edmunds, Suffolk IP31 3QJ.
Any questions about the operation of this Policy or any concerns that the Policy has not been followed should be referred to Paul Myatt or Charles Myatt.
Employees of Criterion Ices Ltd are also responsible for Data Protection and are required to follow the processes detailed within this Policy, and any other documents referred to in it, where appropriate in line with their employment.
Changes to our Data Protection Policy
We may change this Data Protection Policy from time to time although this will not reduce your rights under the Data Protection Requirements as they stand at that time.
Bases for processing your information
Where you provide us with your personal information (Personal Data), you agree that we may collect, store and use it.
We will only collect Personal Data to the extent that it is required for the specific purpose notified to you.
In accordance with the Data Protection Requirements, we will only process Personal Data where it is required for a lawful purpose. The lawful purposes include (amongst others):
Consent – The individual has given their consent to the processing of their Personal Data, which can be withdrawn at any time.
Contractual – Processing of Personal Data is necessary to perform our contractual and/or pre-contractual obligations to you.
Legitimate Interests – Processing of Personal Data is necessary under the Legitimate Interests of Criterion Ices Ltd (i.e. for internal administrative purposes, data analytics and benchmarking, direct marketing, maintaining automated back-up systems or for the detection or prevention of crime) unless these interests are overridden by the individual’s interests or fundamental rights.
How we collect your Personal Data
In accordance with the Data Protection Requirements, in the course of our business we may collect and process Personal Data about you, your organisation and any other party whose details you provide to us when you contact us via telephone, email, website or other means, including social media.
This may include your name (including business name), address, email address and telephone number. We may also ask you to provide additional information about your business and your requirements and preferences. It may also include your bank or card details for the processing of payments.
Providing us with Personal Data about others
If you provide us with Personal Data about another person, you are responsible for ensuring that you comply with any obligation and consent obligations under the Data Protection Requirements in relation to such disclosure.
We will then treat that Personal Data in the same way as your individual Data.
How we use your Personal Data
In accordance with the Data Protection Requirements, we may use your Personal Data to:
- Provide any information, products and services that you have requested or ordered
- Provide, manage, support, maintain, protect and improve any products, services and information that you have requested from us
- Manage our relationship with you (for example, customer services and support activities)
- Contact you regarding feedback on our products and services
- Deliver targeted advertising, marketing or information to you which may be useful to you, based on your use of our products and services
- Carry out research and development to improve our existing products and services
- Develop and provide new products and services
- Provide you with any information that we are required to send you to comply with our regulatory or legal obligations
- Detect, prevent, investigate or remediate crime, illegal or prohibited activities or to otherwise protect our legal rights (including liaison with regulators and law enforcement agencies for these purposes)
We may record our communications with you, including e-mails and phone conversations, which may then be used for maintaining and developing our business relationship with you.
You have the right to object to the processing of your Personal Data, although this may affect our ability to provide certain products or services for your benefit.
If we hold any Personal Data about you which is incorrect or if there are any changes to your details, please let us know so that we can keep our records accurate and up to date.
If you withdraw your consent to our use of your Personal Data for purposes set out in our Data Protection Policy, we may not be able to continue to provide you with all the products and services from us you previously had.
We will retain your Personal Data for the duration of our business relationship and afterwards for as long as is necessary and relevant for our legitimate business purposes as permitted by the Data Protection Requirements.
Where we no longer need your Personal Data, we will take all reasonable steps to destroy, or erase from our systems, all such Personal Data without further notice to you.
Sharing your Personal Data
We may share your Personal Data with:
- Our Sales Consultants
- Our service providers (Wholesalers, Transport providers, Distribution Centres, Debt Collection Services, etc.)
- Third parties used to provide freezers and other items directly to you once we process an order on your behalf
- Third parties used to facilitate payment transactions
- Third parties where you have a relationship with that third party and you have consented to us sending information (e.g. social media or other third-party providers)
- Credit reference and fraud prevention agencies
- Law enforcement agencies so that they may detect or prevent crime or prosecute offenders
- Any third party in the context of actual or threatened legal proceedings, provided we can do so lawfully (for example in response to a court order)
- Government departments or any other third party to meet our legal and regulatory obligations, including statutory or regulatory reporting or the detection or prevention of unlawful acts
We will not provide this Data to any third parties for the purposes of their marketing activities unless agreed by you where this will help you and us in providing you with products and services.
Sales and Marketing
We may use your Personal Data to contact you with details about our products and services which we feel may be of interest to you.
We may contact you for this purpose by telephone, post or e-mail. You have the right at any time to stop us from contacting you for marketing purposes.
If you no longer wish to receive information or be contacted by a particular means or at all, please contact us.
Your Rights
You have the following rights regarding your Personal Data:
- To be told how we use your Personal Data
- To obtain access to your Personal Data
- To have your Personal Data rectified or erased or place restrictions on processing your Personal Data
- To object to the processing of your Personal Data e.g. for direct marketing purposes or where the processing is based on our legitimate interests
- To have any Personal Data you provided to us on an automated basis returned to you
- Where the processing of your Personal Data is based on your consent, the right to withdraw that consent subject to legal or contractual restrictions
- To object to any decisions based on the automated processing of your Personal Data
- To lodge a complaint with the supervisory authority responsible for data protection matters (e.g. in the UK, the Information Commissioner’s Office).
Security and storage
We will keep your Personal Data secure by taking appropriate technical and organisational measures against its unauthorised or unlawful processing and against its accidental loss, destruction or damage.
We will do our best to protect your Personal Data but we cannot guarantee the security of your Personal Data which is transmitted to our website, applications or services or to other websites, applications and services via an internet or similar connection.
We will maintain procedures and technologies to try to ensure the security of all Personal Data from the point of the determination of the means for processing and point of Data collection to the point of destruction. Personal Data will only be transferred to a Data Processor if they agree to comply with these procedures and policies, or if they put in place adequate measures.
We will maintain Data security by protecting the confidentiality, integrity and availability of the Personal Data.
Subject Access Requests
Data Subjects must make a formal request for Personal Data we hold about them to Paul Myatt or Charles Myatt at Criterion Ices Ltd, Manor Farm Creamery, Bird Green, Thurston, Bury St Edmunds, Suffolk IP31 3QJ. No fee will be charged for providing the information except where the request is manifestly unfounded or excessive in which case a reasonable fee will be charged for the administrative costs of complying with the request. The information will be provided without delay and within one month of receipt of the request.