Privacy Policy

Contents

• Introduction
• What information do we collect?
• How do we collect your personal data?
• How do we use personal information?
• What legal basis do we have for processing your personal data?
• Profiling and automated decision making
• When do we share personal data?
• How do we secure personal data?
• How long do we keep your personal data for?
• Your rights in relation to personal data
• How to contact us?

Introduction

CCF is a farmer owned co-operative trading across Wales and borders, providing a substantial range of farming products. Our organisation operates in line with co-operative values, which include operating in an open and responsible way when it comes to protecting the privacy and security of your personal data.

This privacy notice describes current policies and procedures with regards to the personal data that we process and explains how and why we use your personal data. This notice does not form part of any contract with you, and we may update this notice at any time.

CCF is a data controller which means we process your personal data and are responsible for deciding how we hold and use this data.

Personal Data is any information relating to an identified or identifiable living person. Personal data does not include data where anything to indicate someone’s identity has been removed (anonymous data) or data relating solely to an organisation/corporate body.

What information do we collect?

CCF collects data from you, through our interactions with you and through our products. The data we collect depends on the context of your interactions with CCF and the choices that you make, including your privacy settings and the products and features that you use. You have choices when it comes to the products you use and the data you share. When we ask you to provide personal data, you can decline. Many of our products require some personal data to provide you with a service. If you choose not to provide data necessary to provide you with a product or feature, you cannot use that product or feature. Likewise, where we need to collect personal data by law or to enter into or carry out a contract with you and you do not provide the data, we will not be able to enter into the contract; or if this relates to an existing product you’re using, we may have to suspend or cancel it. We will notify you if this is the case at the time.

We may collect, use, store and transfer different kinds of personal data about you which we have grouped together as follows:

• Identity data includes first name, surname, username or similar identifier, title, organisations (farms) you are employed by or affiliated to, job title and date of birth (if we are completing a credit check).
• Contact data includes billing address, delivery address, email address and telephone numbers.
• Financial data includes bank account and payment card details.
• Transaction data includes details about payments to and from you and other details of products and services you have purchased from us.
• Technical data includes your online account management login data, browser type and version, time zone setting and location, browser plug-in types and versions, operating system and platform, and other technology on the devices you use to access our website.
• Profile data includes your username and password, purchases or orders made by you, preferences, feedback and survey responses.
• Usage data includes information about how you use our website, products and services.
• Marketing and communications data includes your preferences in receiving marketing from us and our third parties and your communication preferences.

We also collect, use and share aggregated data such as statistical or demographic data for any purpose. Aggregated data could be derived from your personal data but is not considered personal data in law as this data will not directly or indirectly reveal your identity.

How do we collect your personal data?

Almost all the personal data we collect will be though direct interactions with you.

For example, you may give us your identity, contact and financial data by filling in forms or by corresponding with us by post, phone, email or otherwise. This includes personal data you provide when you buy our products, create a customer account, subscribe to receive our communications or request marketing is sent to you, give us feedback or contact us.

As you interact with our website, we will automatically collect technical data about your equipment, browsing actions and patterns. We collect this personal data by using cookies, server logs and other similar technologies.

How do we use personal information?

CCF uses the data we collect to provide you with high quality goods and services in line with contracts we have with you and for:

• Delivering marketing and events communication
• Carrying out polls and surveys
• Internal research and development purposes
• Legal obligations
• Meeting internal audit requirements

We also use the data to operate our business, which includes analysing our performance, meeting our legal obligations, developing our workforce and doing research.

What legal basis do we have for processing your personal data?

We rely on the following legal bases to use your personal data:

Where it is required for the performance of a contract, such as:

• Assessing an application for a product or service you hold with us, including considering whether to offer you the product, the price, the payment methods available and the conditions to attach.
• Managing products and services you hold with us, or an application for one.
• Updating your records, contacting you about your account and doing this for recovering debt (where appropriate).
• All stages and activities relevant to managing the product or service including enquiry, application, administration and management of accounts, illustrations, requests for transfers of equity, setting up/changing/removing guarantors.

Where it is in our legitimate interests to do so, such as:

• To follow guidance and recommended best practice of government and regulatory bodies.
• For management and audit of our business operations including accounting.
• To carry out searches at Credit Reference Agencies pre-application, at the application stage, and periodically after that. Where you have been introduced to us by a broker or other intermediary they may do these searches on our behalf.
• To carry out monitoring and to keep records of our communications with you and our staff.
• For market research and analysis and developing statistics.
• Subject to the appropriate controls, to provide insight and analysis of our customers to business partners either as part of providing products or services, helping us improve products or services, or to assess or to improve the operating of our businesses.
• Where we need to share your personal information with people or organisations in order to run our business or comply with any legal and/or regulatory obligations.

Where we have your consent:

• For direct marketing communications and related profiling to help us to offer you relevant products and services. We may send marketing to you by SMS, email, phone, post or social media and digital channels (for example, Facebook, Twitter etc.).
• For some of our offers and promotions.
• For some of our local events and newsletters.

Where we have a legal obligation:

• Where we need to share your personal information with people or organisations in order to run our business or comply with any legal and/or regulatory obligations.
• Providing HMRC with wages or salary information for tax purposes

Where we’re relying upon your consent to process personal data, you can withdraw this at any time by contacting us using the details below. Withdrawal of your consent will not affect the lawfulness of the processing before consent was withdrawn.

We will only use your personal information for the purposes for which we collected it, unless we reasonably consider that we need to use it for another reason and that reason is compatible with the original purpose. If we need to use your personal information for an unrelated purpose, we will notify you and we will explain the legal basis which allows us to do so.

Please note that we may process your personal information without your knowledge or consent, in compliance with the above rules, where this is required or permitted by law.

Profiling and automated decision making

Automated individual decision-making is a decision made by automated means without any human involvement. We may use profiling or automated decision making to decide your eligibility for our products and services based on your credit history. You have the right to object to our use of automated decision making in some circumstances. Please remember, however, that if you object to certain types of automated decision making, it may affect our ability to provide you with the optimum level of customer service and our ability to provide you with certain products, financing and services.

When do we share personal data?

CCF will always treat your personal data with the utmost respect. We may share information with the following third parties for the purposes listed below:

• Business partners (for example, financial services institutions, insurers), account beneficiaries, or others who are a part of providing your products and services or operating our business.
• Governmental and regulatory bodies such as HMRC, the Financial Conduct Authority, the Prudential Regulation Authority, the Ombudsman, the Information Commissioner’s Office and under the Financial Services Compensation Scheme.
• Other organisations and businesses who provide services to us such as debt recovery agencies, back up and server hosting providers, payroll processors, IT software and maintenance providers, document storage providers and suppliers of other back-office functions.
• Credit Reference and Fraud Prevention Agencies.
• Market research organisations who help us to develop and improve our products and services.

We require third parties to respect the security of your data and to treat it in accordance with the law. We will not share your data outside of the UK. All our third‑party service providers are required to take appropriate security measures to protect your personal information in line with our policies. We do not allow our third-party service providers to use your personal data for their own purposes. We only permit them to process your personal data for specified purposes and in accordance with our instructions

How do we secure personal data?

We have put in place appropriate security measures to prevent your personal information from being accidentally lost, used or accessed in an unauthorised way, altered or disclosed. In addition, we limit access to your personal information to those employees, agents, contractors and other third parties who have a business need to know it. They will only process your personal information on our instructions, and they are subject to a duty of confidentiality.

We have put in place procedures to deal with any suspected personal data breach and will notify you and any applicable regulator of a suspected breach where we are legally required to do so.

How long do we keep your personal data for?

Unless we explain otherwise to you, we’ll hold your personal information based on the following criteria:

• For as long as we have reasonable business need, such as managing our relationship with you and managing our operations.
• For as long as we provide goods and/or services to you and then for as long as someone could bring a claim against us or for the purposes of satisfying any legal, accounting, or reporting requirements.

Should we no longer need your personal data, all information will be disposed of securely. We have a data retention policy in place and you can request to see this policy. To determine the appropriate retention period for personal data, we consider the applicable legal requirements, the amount, nature, and sensitivity of the personal data, the potential risk of harm from unauthorised use or disclosure of your personal data, the purposes for which we process your personal data and whether we can achieve those purposes through other means.

In some circumstances, we may anonymise your personal information so that it can no longer be associated with you, in which case we may use such information without further notice to you.

Please remember that you have a right to request to have your personal information deleted at any time.

Your rights in relation to personal data

It is important that the personal information we hold about you is accurate and current. Please keep us informed if your personal information changes during your working relationship with us. Under certain circumstances, by law you have the right to:

• be informed about the processing of your personal information
• have your personal information corrected if it is inaccurate and to have incomplete personal information completed
• object to processing of your personal information
• restrict processing of your personal information
• have your personal information erased (the “right to be forgotten”)
•  request access to your personal information and to obtain information about how we process it
• move, copy or transfer your personal information (“data portability”)
•  object to automated decision making which has a legal effect or otherwise significantly affects you

You have the right to complain to the Information Commissioner’s Office which enforces data protection laws. You can contact them using the following details:

The ICO’s address:

Information Commissioner’s Office

Wycliffe House

Water Lane

Wilmslow

Cheshire

SK9 5AF

Helpline number: 0303 123 1113

https://ico.org.uk/.

You have the right to object to certain purposes for processing, in particular to data processed for direct marketing purposes and to data processed for certain reasons based on our legitimate interests. You can contact us using the details below.

There may be some circumstances where your rights may be limited.