Last updated: December 2024
This Privacy Policy explains how Mashua Brecon Beacons collects, uses, and protects your personal information when you visit our website or purchase from us.
Who We Are
Our website address is: http://mountain-mashua.local (development site – live domain to be confirmed)
We are a small-scale grower of climate-adapted perennial crops based in the Brecon Beacons, Wales, UK. We sell mashua tubers and related products through this website.
What Personal Data We Collect and Why
Information You Provide to Us
When you place an order or contact us, we collect:
- Contact information: Name, email address, postal address, phone number
- Order information: Products purchased, order history, payment details
- Communication: Messages you send via contact forms or email
Why we collect this data:
- To process and fulfill your orders
- To communicate about your order status, shipping, and delivery
- To respond to your questions and provide customer support
- To send you important updates about your order
- To comply with legal obligations (tax, accounting)
Contact Forms
When you submit a contact form on our site, we collect the information you provide (name, email, subject, message). This data is used solely to respond to your inquiry.
Data retention: Contact form submissions are retained for up to 2 years for customer service purposes, then deleted.
Cookies
Our website uses cookies to improve your browsing experience and enable shopping cart functionality.
Essential cookies we use:
- Shopping cart cookies: Remember items you’ve added to your cart
- Session cookies: Keep you logged in during your visit
- Security cookies: Protect against fraudulent activity
These cookies are necessary for the website to function properly and cannot be disabled.
Optional cookies:
- Analytics cookies: If enabled, help us understand how visitors use our site (e.g., Google Analytics)
You can control cookie settings through your browser preferences.
Embedded Content from Other Websites
Pages on this site may include embedded content (e.g., videos, images, articles). Embedded content from other websites behaves as if you visited that website directly.
These websites may collect data about you, use cookies, embed additional third-party tracking, and monitor your interaction with embedded content.
How We Use Your Data
We use your personal data for the following purposes:
- Order fulfillment: Processing payments, packing, and shipping your orders
- Communication: Sending order confirmations, shipping updates, and responding to inquiries
- Customer service: Addressing questions, concerns, or issues with your order
- Legal compliance: Maintaining records for tax and accounting purposes as required by UK law
- Improvement: Understanding how our website is used to improve user experience
Who We Share Your Data With
We share your personal data only when necessary to fulfill orders or comply with legal requirements:
- Payment processors: We use trusted payment providers (Stripe, PayPal) to process payments securely. They handle your payment information according to their own privacy policies.
- Shipping carriers: We share your name and delivery address with Royal Mail or other carriers to deliver your orders.
- Email services: We use email service providers to send order confirmations and communications.
- Legal authorities: We may disclose information if required by law or to protect our legal rights.
We do not:
- Sell your personal data to third parties
- Share your data for marketing purposes without your consent
- Transfer data outside the UK/EU without appropriate safeguards
How Long We Retain Your Data
We retain your personal data for as long as necessary to fulfill the purposes outlined in this policy:
- Order data: Retained for 7 years to comply with UK tax and accounting requirements
- Contact form submissions: Retained for 2 years for customer service purposes
- Marketing communications: Retained until you unsubscribe or request deletion
- Website cookies: Most expire after your session ends or within 1 year
Your Data Protection Rights (GDPR)
Under UK GDPR, you have the following rights regarding your personal data:
- Right to access: Request a copy of the personal data we hold about you
- Right to rectification: Request correction of inaccurate or incomplete data
- Right to erasure: Request deletion of your personal data (subject to legal obligations)
- Right to restrict processing: Request that we limit how we use your data
- Right to data portability: Request your data in a portable format
- Right to object: Object to processing of your data for certain purposes
- Right to withdraw consent: Withdraw consent for data processing at any time
To exercise these rights, contact us at: [Your email address]
We will respond to your request within one month.
Data Security
We take reasonable measures to protect your personal data from unauthorized access, disclosure, alteration, or destruction:
- SSL encryption for all data transmitted through our website
- Secure payment processing through PCI-compliant payment providers
- Limited access to personal data (only authorized personnel)
- Regular security updates and monitoring
However, no method of transmission over the internet is 100% secure. While we strive to protect your data, we cannot guarantee absolute security.
Third-Party Links
Our website may contain links to external websites (e.g., Permaculture Association UK). We are not responsible for the privacy practices of these third-party sites. Please review their privacy policies separately.
Children’s Privacy
Our website and services are not directed at children under 16. We do not knowingly collect personal data from children. If you believe we have inadvertently collected data from a child, please contact us immediately.
Newsletter and Marketing Communications
If you sign up for our newsletter, we will use your email address to send:
- Seasonal tuber availability updates
- Growing tips and permaculture insights
- Recipe ideas and preservation techniques
- Occasional special offers
Your consent: By signing up, you consent to receive these communications.
Unsubscribe: You can unsubscribe at any time using the link in every email or by contacting us directly.
Frequency: We send emails infrequently (typically 3-6 times per year). We respect your inbox.
Changes to This Privacy Policy
We may update this Privacy Policy from time to time to reflect changes in our practices or legal requirements. The “Last updated” date at the top will indicate when changes were made.
Significant changes will be communicated via email to registered customers.
Contact Us
If you have questions about this Privacy Policy or how we handle your personal data, please contact us:
Email: [Your email address]
Contact form: mountain-mashua.local/contact
Postal address: [Your business address]
For data protection concerns, you also have the right to lodge a complaint with the UK Information Commissioner’s Office (ICO): www.ico.org.uk