1. Introduction and company information
This Privacy Policy explains how Greenhollow Orchard Limited collects, uses, stores, shares, and protects personal data when you visit our website, contact us, make enquiries, purchase goods or services, attend our orchard premises, or otherwise interact with us.
Greenhollow Orchard Limited is the data controller responsible for your personal data.
Company details:
Greenhollow Orchard Limited
Greenhollow Orchard, Unit 4, Riverside Business Park, Hasketon Road, Great Horkesley, Colchester CO6 4HS, United Kingdom
Email: [email protected]
Phone: +44 1206 736 842
This Policy is intended to provide clear information about our data practices in connection with our orchard business, including customer enquiries, product orders, event bookings, deliveries, marketing communications, and customer support.
2. Data collection and processing
We may collect and process the following categories of personal data:
- Identity data: name, title, and where relevant, business name.
- Contact data: address, email address, telephone number, and other communication details.
- Transaction data: records of purchases, orders, invoices, payments, refunds, and delivery details.
- Account and correspondence data: information provided in enquiries, complaints, feedback, forms, emails, phone calls, or other communications.
- Technical data: IP address, browser type, device identifiers, operating system, and website usage information.
- Marketing and preferences data: consent choices, communication preferences, and responses to marketing.
- Special category data: only where strictly necessary and with a valid legal basis, for example health or dietary information provided in relation to an event booking, allergy handling, or accessibility needs.
We may collect personal data directly from you, from your interactions with our website, from payment and delivery providers, from business partners, or from publicly available sources where appropriate and lawful.
3. Purpose of data processing
We process personal data for the following purposes:
- to respond to enquiries and provide customer support;
- to process orders, manage payments, arrange delivery, and fulfil contracts;
- to administer bookings, visits, tastings, orchard events, and related services;
- to manage business records, accounting, tax, and audit obligations;
- to communicate service updates, notices, and administrative information;
- to send marketing communications where permitted by law or with consent;
- to maintain and improve our website, services, and customer experience;
- to protect our premises, systems, staff, customers, and property;
- to comply with legal and regulatory obligations;
- to establish, exercise, or defend legal claims.
4. Legal basis for processing
We process personal data only where we have a lawful basis to do so. Depending on the context, this may include:
- Contract: where processing is necessary to enter into or perform a contract with you.
- Legal obligation: where processing is necessary to comply with applicable laws, including tax, accounting, and regulatory requirements.
- Legitimate interests: where processing is necessary for our legitimate business interests, provided your interests and rights do not override those interests. This may include managing our orchard operations, responding to enquiries, improving services, and ensuring security.
- Consent: where you have given clear consent, for example to receive certain marketing communications or where required for specific types of processing.
- Vital interests: where necessary to protect someone’s life in an emergency.
- Public interest / legal claims: where applicable under relevant privacy laws.
Where we rely on consent, you may withdraw it at any time, without affecting the lawfulness of processing carried out before withdrawal.
5. Data sharing and third parties
We may share personal data with trusted third parties where necessary for the purposes described in this Policy. These may include:
- payment processors and financial institutions;
- delivery and logistics providers;
- IT hosting, cloud storage, email, website maintenance, and security providers;
- professional advisers such as accountants, auditors, insurers, and legal advisers;
- marketing service providers, where permitted and appropriate;
- public authorities, regulators, law enforcement, or courts where required by law;
- other third parties involved in our business operations, where necessary and lawful.
We require third parties to handle personal data securely and in accordance with applicable legal requirements. They are not permitted to use your personal data for their own independent purposes unless they are separately acting as a data controller and have a lawful basis to do so.
6. Data transfer to third countries
Some of our service providers may process personal data outside the United Kingdom and/or the European Economic Area. Where such transfers occur, we will take appropriate steps to ensure an adequate level of protection for your personal data in accordance with applicable law. These measures may include:
- transfers to countries recognised as providing an adequate level of protection;
- use of standard contractual clauses or equivalent safeguards;
- additional technical and organisational measures where appropriate.
If you would like more information about international transfers, please contact us using the details below.
7. Storage duration
We retain personal data only for as long as necessary for the purposes for which it was collected, including to meet legal, accounting, reporting, and security requirements.
The retention period will depend on the nature of the data and the reason for processing. In general:
- enquiry and correspondence records may be kept for a reasonable period after the matter is closed;
- transaction, invoice, and tax-related records are typically retained for the period required by law;
- marketing records are retained until you unsubscribe, withdraw consent, or object where applicable;
- security and website logs are retained for a limited period unless needed for investigation or legal reasons.
When personal data is no longer required, we will delete, anonymise, or securely archive it as appropriate.
8. User rights (access, rectification, erasure, restriction, data portability, objection)
Subject to applicable law, you may have the following rights in relation to your personal data:
- Access: to request confirmation of whether we process your personal data and to obtain a copy of it.
- Rectification: to request correction of inaccurate or incomplete data.
- Erasure: to request deletion of your personal data in certain circumstances.
- Restriction: to request that we limit processing in certain circumstances.
- Data portability: to receive certain data in a structured, commonly used, machine-readable format and, where technically feasible, have it transmitted to another controller.
- Objection: to object to processing based on legitimate interests or for direct marketing purposes.
To exercise any of these rights, please contact us using the details in Section 12. We may need to verify your identity before responding. We will respond within the time limits required by applicable law.
9. Withdrawal of consent
Where we rely on your consent to process personal data, you have the right to withdraw that consent at any time. Withdrawing consent will not affect the lawfulness of processing carried out before withdrawal.
You may withdraw consent by contacting us using the details below or, where relevant, by using an unsubscribe link or preference setting in our communications.
10. Right to complain
If you have concerns about how we handle your personal data, we encourage you to contact us first so that we can try to resolve the issue.
You also have the right to lodge a complaint with the relevant data protection supervisory authority. In the United Kingdom, this is the Information Commissioner’s Office (ICO).
ICO contact details:
Website: https://www.ico.org.uk
Telephone: 0303 123 1113
11. Data security
We use appropriate technical and organisational measures to help protect personal data against accidental loss, unauthorised access, disclosure, alteration, or destruction. These measures may include:
- access controls and authentication procedures;
- secure systems and encrypted communications where appropriate;
- staff confidentiality and data protection awareness;
- back-up and recovery procedures;
- regular review of security practices and supplier arrangements.
However, no method of transmission over the internet or method of electronic storage is completely secure, and we cannot guarantee absolute security.
12. Contact information
If you have any questions about this Privacy Policy or wish to exercise your rights, please contact:
Greenhollow Orchard Limited
Greenhollow Orchard, Unit 4, Riverside Business Park, Hasketon Road, Great Horkesley, Colchester CO6 4HS, United Kingdom
Email: [email protected]
Phone: +44 1206 736 842
13. Changes to privacy policy
We may update this Privacy Policy from time to time to reflect changes in our practices, legal requirements, or business operations. Any updated version will be made available on our website or through other appropriate communication channels.
We encourage you to review this Privacy Policy periodically to stay informed about how Greenhollow Orchard Limited processes personal data.