FREE DELIVERY AVAILABLE ON ALL HAMPERS, LETTERBOXES AND TINS
1. WHO WE ARE
We are Lottie Shaw's Limited. We bake and deliver traditionally baked Yorkshire treats.
We are a limited company in England (number 2875578) whose registered office is The Riverside Building, Livingstone Road, Hessle, East Yorkshire, United Kingdom, HU13 0DZ. We are the data controller in respect of all personal data collected via our website, email, telephone, or in person.
Whenever you submit your information to us, by these or any other means, we will collect and use such information in accordance with the terms of this policy, and we will ensure that all personal data we hold is treated properly and in accordance with applicable data protection legislation.
We are registered as a data controller with the Information Commissioner’s Office ("ICO") and our registration number is ZB332609. In accordance with data protection legislation, we are required to explain to you how we will treat any personal data which we collect from or about you.
We are registered as a data controller with the Information Commissioner’s Office ("ICO") and our registration number is ZB332609. In accordance with data protection legislation, we are required to explain to you how we will treat any personal data which we collect from or about you.
If you have any concerns about the way we have used, shared or processed your data you have the right to lodge a complaint with the ICO.
However, we would always appreciate the opportunity to address your concerns before you approach the ICO so please do contact us by email at data.privacy@wjfg.co.uk or by writing to Data Protection Office, Lottie Shaw's, The Riverside Building, Livingstone Road, Hessle, East Yorkshire, United Kingdom, HU13 0D
2. INTRODUCTION
We appreciate the trust you place in us when sharing your personal data. The security of that data is very important to us. In this document, we explain how we collect, use and protect your personal data. We also explain what rights you have with regard to your personal data and how you can exercise those rights.
This Privacy Notice is based on the terms used by the United Kingdom General Data Protection Regulation (UKGDPR) but for ease of understanding the following definitions apply.
Controller: the natural or legal person, public authority, agency or other body which, alone or jointly with others, determines the purposes and means of the processing of personal data; where the purposes and means of such processing are determined by the Information Commissioners Office.
Personal data: any information relating to an identified or identifiable natural person (“Data Subject”). An identifiable natural person is one who can be identified, directly or indirectly, in particular by reference to an identifier such as a name, an identification number, location data, an online identifier or to one or more factors specific to the physical, physiological, genetic, mental, economic, cultural or social identity of that natural person.
Data subject: any identified or identifiable natural person, whose personal data is processed by the controller responsible for the processing.
Processor: a natural or legal person, public authority, agency or other body which processes personal data on behalf of the controller.
Recipient: a natural or legal person, public authority, agency or another body, to which the personal data are disclosed, whether a third party or not.
Third Party: a natural or legal person, public authority, agency or body other than the data subject, controller, processor and persons who, under the direct authority of the controller or processor, are authorised to process personal data.
Data Asset Information Inventory: also known as a ROPA, Record of Processing Activities is a register outlining where personal data is held, how long it is retained for and who it is shared with. This is a living document which is continually reviewed and updated.
Restriction of processing: the marking of stored personal data with the aim of limiting their processing in the future.
Processing: any operation or set of operations which is performed on personal data or on sets of personal data, whether or not by automated means, such as collection, recording, organisation, structuring, storage, adaptation or alteration, retrieval, consultation, use, disclosure by transmission, dissemination or otherwise making available, alignment or combination, restriction, erasure or destruction.
Profiling: any form of automated processing of personal data consisting of the use of personal data to evaluate certain personal aspects relating to a natural person, in particular to analyse or predict aspects concerning that natural person's performance at work, economic situation, health, personal preferences, interests, reliability, behaviour, location or movements. Consent:
Consent of the data subject is any freely given, specific, informed and unambiguous indication of the data subject's wishes by which he or she, by a statement or by a clear affirmative action, signifies agreement to the processing of personal data relating to him or her.
3. THE INFORMATION WE COLLECT AND HOW WE USE IT
We process your personal information to meet our legal, statutory and contractual obligations and to provide you with our products and services. You may give us information about you by corresponding with us by phone, email, social-media or otherwise by submitting an enquiry or order via our website, by opting in to receive a newsletter, or when you take part in a prize draw, competition or survey. We will never collect any unnecessary personal data from you and do not process your information in any way, other than as specified in this notice.
Your personal data will not be shared across the Groups other businesses. The personal data that we collect from is:
- Name
- Personal Email
- Business Email
- Business Telephone Number
- Mobile Telephone Number
- Address
Technical information
In addition, to ensure that each visitor to any of our websites can use and navigate the site effectively, we may collect the following:
- Technical information, including the IP (Internet Protocol) address used to connect your device to the Internet.
- Your login information, browser type and version, browser plugin types and versions.
- Operating system and platform.
- Information about your visit, including the URL (Uniform Resource Locator) through and from our site.
Our cookies policy, which can be viewed from the homepage of each of our websites, describes in detail how we use cookies.
How long we retain your personal data for
We only retain your personal data for as long as we need it and for the purpose for which it was collected and whilst taking into consideration our legal obligations, we will on an ongoing basis review the length of time we retain your personal data. We will consider the purpose or purposes for which we hold your personal data. We will securely delete your personal data if it is no longer needed for such purpose or purposes and update or archive or securely delete your personal data if it goes out of date.
For further information on how long we retain your personal data please refer to the table below.
4. THIRD PARTIES
Some data may be shared with third parties and this is also identified where this happens. We may share personal data about you with third parties:
a) who are directly involved in dealing with any request or enquiry made by you
b) where such disclosure is required by law
c) with third parties who are providing us with professional advice
d) with third parties who are providing us with corporate services
e) where the disclosure is in connection with any criminal investigation legal proceedings or respective legal proceedings were permitted by law f) where the disclosure is in order to establish exercise or defend our legal rights including providing information to fraud prevention or reducing credit risk g) where we are required to enforce our terms of use
h) where we use third parties to provide various systems to support company activities
i) where we have stated or informed you otherwise (e.g. in this privacy policy or website)
j) we will not pass on your information to a third party for the purposes of marketing
k) we may also disclose your personal data to third-parties in the event that we sell or buy any businesses or assets (in which case we may disclose your personal data to the prospective seller or buyer of such businesses or assets)l) or if all of our assets are acquired by third-party in which case personal data held by us about our clients and subscribers will be one of the transferred assets.
b) where such disclosure is required by law
c) with third parties who are providing us with professional advice
d) with third parties who are providing us with corporate services
e) where the disclosure is in connection with any criminal investigation legal proceedings or respective legal proceedings were permitted by law f) where the disclosure is in order to establish exercise or defend our legal rights including providing information to fraud prevention or reducing credit risk g) where we are required to enforce our terms of use
h) where we use third parties to provide various systems to support company activities
i) where we have stated or informed you otherwise (e.g. in this privacy policy or website)
j) we will not pass on your information to a third party for the purposes of marketing
k) we may also disclose your personal data to third-parties in the event that we sell or buy any businesses or assets (in which case we may disclose your personal data to the prospective seller or buyer of such businesses or assets)l) or if all of our assets are acquired by third-party in which case personal data held by us about our clients and subscribers will be one of the transferred assets.
5. YOUR RIGHTS
You have a legal right to see a copy of your personal data that we keep about you subject to certain exemptions request for such information should be made by email to data.privacy@wjfg.co.uk or by writing to Data Protection Officer at The Riverside Building, Livingstone Road, Hessle, East Yorkshire, HU13 0DZ, United Kingdom.
In some circumstances you may also have the right to:
- Right to be Informed: you shall have the right to obtain clear and transparent information about the data controllers data processing activities. This is provided by this privacy notice.
- Right to Rectification: you shall have the right to obtain from the controller without undue delay the rectification of inaccurate personal data concerning the data subject. The data subject shall have the right to have incomplete personal data completed.
- Right to Erasure (Right to be forgotten): you shall have the right to obtain from the controller the erasure of personal data without undue delay, and the controller shall have an obligation to erase personal data without undue delay where one of the statutory grounds applies, as long as the processing is no longer necessary.
- Right of Restriction of Processing: you shall have the right to obtain from the controller restriction of processing where a statutory reason applies
- Right to Data Portability: you shall have the right, to receive the personal data, which was provided to a controller or processor, in a structured, commonly used and machine-readable format. Right to Object: you shall have the right to object, on grounds relating to a particular situation, at any time, to the processing of personal data.
- Right to Withdraw Consent: If you have given your consent to receive marketing materials you may withdraw your consent at any time by either opting out of any emails or by contacting us at data.privacy@wjfg.co.uk
- Automated individual decision-making, including profiling: we do not process personal data for automatic decision- making or profiling.
6. SECURITY MEASURES
We take your privacy seriously and take every reasonable measure and precaution to protect and secure your personal data. We work hard to protect you and your information from unauthorised access, alteration, disclosure or destruction and have several layers of security measures in place, including: -
- Latest and widely accepted TLS protocols.
- Restricted access to areas used to store data, via firewalls, encryption, and the latest widely accepted security protocols.
7. TRANSFERS OUTSIDE THE UK (if applicable) NOT APPLICABLE CURRENTLY
Personal data in the United Kingdom is protected by the UK GDPR and Data Protection Act 2018, however some other countries may not necessarily have the same high standard of protection for your personal data.
We utilise some products or services (or parts of them) that may be hosted/stored outside of the UK, which means that we may transfer any information which is submitted by you through the website outside the UK for analytical and performance data.Therefore, when you use our website/send us an email/sign up to our newsletter etc, the personal information you submit may be stored on servers which are hosted outside of the UK.
Where this is the case, we will take steps to ensure that those providers use the necessary level of protection for your information and abide by strict agreements and measures set out by us to protect your data and comply with the relevant data protection laws.
8. CONSEQUENCES OF NOT PROVIDING YOUR DATA
You are not obligated to provide your personal information to us however, as this information is required for us to provide you with our services and or deliver your products, we will not be able to offer some/all our services without it.
9. CONTACT US & LODGING A COMPLAINT
We only process your personal information in compliance with this privacy notice and in accordance with the relevant data protection laws. If, however you wish to raise a complaint regarding the processing of your personal data or are unhappy with how we have handled your information, you have the right to lodge a complaint with the ICO, however in the first instance we would always prefer to help you directly and resolve any issues you may have.
Data Protection Officer, Lottie Shaw's, The Riverside Building, Livingstone Road, Hessle, East Yorkshire, HU13 0DZ, United Kingdom
The Information Commissioner’s Office Wycliffe House, Water Lane, Wilmslow, Cheshire SK9 5AF
Organisation Name:L ottie Shaw's Limited Reference number: ZB332609
Tier: Tier 2
Start date: 12 May 2022
End date: 11 May 2025
Telephone: 0303 123 1113 https://ico.org.uk/global/contact-us
