BACKGROUND:

1. Information About Us

This privacy notice covers Thatchers Cider Company Limited, Thatchers Holdings Limited, Thatchers (Myrtle Farm) Limited, John Thatcher Farming Limited, Thatchers Foundation, Thatchers Railway Inn Limited (referred to as the Thatchers Companies or We). We are committed to protecting and respecting your data protection rights. This privacy notice provides information about how the Thatchers Companies use your personal data.

The person with lead responsibility for data protection at the Thatchers Companies is can be contacted using the following contact details: csr@thatcherscider.co.uk; Head of IT, Thatchers Cider Company Limited, Myrtle Farm, Sandford, Somerset BS25 5RA; or 01934 822862.

2. What Does This Notice Cover?

This privacy notice explains how the Thatchers Companies use your personal data: how it is collected, how it is held, and how it is processed. It also explains your rights under data protection law.

3. What is Personal Data?

Personal data is any information relating to a living person who can be directly or indirectly identified from it.The personal data that Thatchers Companies may use about you is set out in Part 5.

4. What Are My Rights?

Under data protection law, you have the following rights:

• The right to be informed about our collection and use of your personal data (this privacy notice should tell you everything you need to know, but you can always contact us to find out more or to ask any questions using the details in Part 11).
• The right to access the personal data the Thatchers Companies hold about you.
• The right to have your personal data rectified if any of your personal data held by the Thatchers Companies is inaccurate or incomplete.
• The right to be forgotten, i.e. the right to ask us to delete or otherwise dispose of any of your personal data that the Thatchers Companies have.
• The right to restrict (i.e. prevent) the processing of your personal data.
• The right to object to us using your personal data for a particular purpose or purposes.
• The right to data portability – this means that, if you have provided personal data to us directly, we are using it with your consent or for the performance of a contract, and that data is processed using electronic means, you can ask us for a copy of that personal data to re-use with another service or business in many cases.
• Rights relating to automated decision-making and profiling. Part 6 explains more about how we use your personal data, including automated decision-making.
• For more information about our use of your personal data or exercising your rights, please contact us using the details provided in Part 11.

Further information about your rights can also be obtained from the Information Commissioner’s Office or your local Citizens Advice Bureau.

If you have any cause for complaint about our use of your personal data, you have the right to lodge a complaint with the Information Commissioner’s Office https://ico.org.uk/. We encourage you to contact us first if you have a complaint as often we can resolve it more quickly than if you complain to the ICO.

5. What Personal Data Do You Collect?

The Thatchers Companies may collect some or all of the following personal data (this will vary according to your relationship with us):

• Identity information: name; date of birth; sex; gender; nationality; racial / ethnic background; passport or national identity card details; driving licence details
• Employment information: organisation name; job title; profession; right to work / work permit status; trade union membership
  Contact information: postal addresses, email addresses, and telephone numbers
• Demographic information: such as post code, preferences, and interests
• IT information: IP address and geo location
• Family details: such as next of kin, spouse, dependents
• Health details: such as allergies, health conditions, disabilities
• Financial details: such as account number, National Insurance number, tax code, NI Category
• Criminal conviction data

For our employees we may also collect additional kinds of special category data, including biometric data (e.g. photographs and fingerprint scans for security and access control purposes).

We normally collect your personal data directly from you. If you are introduced to us by another organisation (e.g. a sales agent) we will obtain some personal information about you from them.

In addition, we may also obtain personal information about you from the following sources or in the following ways:

• Credit reference agencies
• Fraud prevention agencies
• Government and law enforcement agencies
• Agents working on our behalf
• Public information sources (e.g. HM Land Registry, Companies House)
• Information collected when you are using our website
• Publicly available information (e.g. Google, Facebook, social media)

6. How Do You Use My Personal Data?

The Thatchers Companies must always have a lawful basis for using your personal data. This may be because the data is necessary for our performance of a contract with you, because you have consented to our use of your personal data, or because it is in our legitimate business interests to use it. Your personal data may be used for one of the purposes shown in the data processing table in Annex 1, which also gives the corresponding lawful basis for processing.

We do not make automated decisions using your personal data. We do use automated systems to obtain or verify information. This may include things like checking your age, residency or nationality, and credit checking, to confirm that you meet ‘right to work’ conditions under employment law. This helps us to make sure our decisions are consistent, fair, quick and efficient.

7. How Long Will You Keep My Personal Data?

The Thatchers Companies will not keep your personal data for any longer than is necessary for the purposes for which it was first collected. Your personal data will therefore be kept for the periods stated in the data processing table in Annex 1 (or, where there is no fixed period, the factors stated will be used to determine how long it is kept).

8. Where Do You Store or Transfer My Personal Data?

The Thatchers Companies will store or transfer your personal data in the UK and/or European Economic Area (the EEA consists of all EU member states, plus Norway, Iceland, and Liechtenstein).

We may store or transfer some or all of your personal data in countries that are not part of the EEA. These are known as “third countries” and may not have data protection laws that are as strong as those in the UK and/or the EEA. This means that we will take additional steps in order to ensure that your personal data is treated just as safely and securely as it would be within the UK and/or EEA. Either the transfer will be to a country that the UK or European Commission has determined has adequate data protection standards, or the transfer will be according to specific contractual terms specified by the UK or European Commission for use in transfers.

Please contact us using the details below in Part 11 for further information about the particular data protection mechanism used by us when transferring your personal data to a third country.

9. Do You Share My Personal Data?

The Thatchers Companies may sometimes share your personal data between themselves or with the following categories of third parties:

• with auditors, lawyers, HR advisers, pensions administrators, payroll processing, and similar business administration support providers;
• to supply products and / or services to you on our behalf (e.g. logistics or other delivery fulfilment companies;
• with printers, outbound mail fulfilment providers, customer communication providers, customer feedback providers, and
• similar organisations to support us in delivering communications (including marketing you have agreed to receive);

with credit reference agencies, anti-fraud databases, anti-money laundering check providers, sanctions information providers, and similar organisations;

• when required by law or regulation, or to assist in identifying and preventing crime, with regulatory bodies, fraud prevention agencies, local or national government bodies, and law enforcement agencies;
• with other companies and their advisers where we choose to sell, transfer, or merge all or parts of our business, or our assets;

If we provide any of your personal data to a third party we will take steps to ensure that your personal data is handled safely, securely, and in accordance with your rights, our obligations, and the third party’s obligations under the law.

10. How Can I Access My Personal Data?

If you want to know what personal data we have about you, you can ask us for details of that personal data and for a copy of it (where any such personal data is held). This is known as a “subject access request”.

Subject access requests can be made in writing and sent to our email or postal address. Alternatively you can contact us on our office phone number. All contact details are given in Part 11.

There is not normally any charge for a subject access request. However, if your request is ‘manifestly unfounded or excessive’ (for example, if you make unjustified repetitive requests) a fee may be charged to cover our administrative costs in responding.

We will respond to your subject access request at the earliest opportunity and in any case within one month of receiving it. Normally, we aim to provide a complete response, including a copy of your personal data within that time. In some cases, however, particularly if your request is more complex, more time may be required up to a maximum of three months from the date we receive your request. You will be kept fully informed of our progress.

11. How Do I Contact You?

To contact us about anything to do with your personal data and data protection, including to make a subject access request, please use the following details (for the attention of Data Protection Lead, Thatchers Cider):

Email address: csr@thatcherscider.co.uk

Telephone number: 01934 822862

Postal Address: Thatchers Cider Company Ltd, Myrtle Farm, Sandford, Somerset, BS25 5RA

12. Changes to this Privacy Notice

We may change this Privacy Notice from time to time. This may be necessary, for example, if the law changes, or if we change our business in a way that affects how we use personal data.

Any changes will be notified to affected data subjects through our website (we will revise the “Last updated” date at the bottom of this privacy notice) and our internal communications channels with employees. If we think that the changes are fundamental in nature we will make a copy of our updated privacy notice available to you using an appropriate direct contact channel we have with you.

Last Updated 30 March 2022

Last Updated 30 March 2022