Privacy

Privacy Policy:

This Privacy Policy sets out how we, Eurocarb Limited, collect, store and use information about you when you use or interact with our website, www.dellorto.co.uk, and where we otherwise obtain or collect information about you. The substantive Privacy Policy was effective from 24th May 2018. This updated privacy policy (with specific updates around marketing communications and the use of third-party data holder Brevo) is effective from 15/04/26.

Contents

  • Summary
  • Our details
  • Information we collect when you visit our website
  • Information we collect when you contact us
  • Information we collect when you interact with our website
  • Information we collect when you place an order and on our website
  • How we collect or obtain information about you from third parties
  • Disclosure and additional uses of your information
  • How long we retain your information
  • How we secure your information
  • Transfers of your information outside the United Kingdom or the European Economic Area
  • Your rights in relation to your information
  • Your right to object to the processing of your information for certain purposes
  • Sensitive Personal Information
  • Marketing and communications
  • Changes to our Privacy Policy
  • Children’s Privacy
  • California Do Not Track Disclosures
  • Copyright, credit and logo

Summary

This summary explains how we collect, use, store, and protect your personal information. It is a high-level overview only and should be read together with the full Privacy Policy.

Who we are

Data controller: Eurocarb Limited (contact: Matt Cooper)

How we collect information

We collect information when you provide it to us (for example, when you contact us or place an order) and automatically through your use of our website, including via cookies.

What information we collect

This may include your name and contact details, payment information, company details (where applicable), IP address, device and browser information, location data derived from your IP address, and information about how you use our website.

How we use your information

We use your information to operate and improve our business, process orders, communicate with you, meet our contractual and legal obligations, analyse website usage, and send marketing communications where you have opted in.

Sharing your information

We only share your information where necessary to run our business, including with service providers, to fulfil contracts with you, to comply with the law, or to enforce our legal rights. We do not sell your personal information.

Data retention

We keep your information only for as long as necessary, taking into account legal requirements and the purpose for which it was collected. Further details are set out in the section “How long we retain your information”.

Security

We protect your information using appropriate technical and organisational measures, including secure servers, SSL encryption for payments, and restricted access.

Cookies

We use cookies and similar technologies. More information is available in our Cookies Policy: https://www.dellorto.co.uk/cookies/

International transfers

If you opt in to marketing communications, your information may be transferred outside the UK and EEA, including to the United States and India, via our email provider Brevo. If you do not opt in, your information is stored in the UK unless a transfer is required by law. Marketing communications are only sent where you have opted in, and you can unsubscribe at any time.

As we sometimes work with service providers located outside of the UK, your data may be transferred internationally.

To ensure your information remains secure, we only perform these transfers using UK-approved safeguards. This includes transferring data to countries with official UK Adequacy Decisions, utilising the UK-US Data Bridge for US-based partners, or implementing Standard Contractual Clauses (such as the IDTA) alongside thorough Transfer Risk Assessments.

For full details on these safeguards, please refer to the ” Transfers of your information outside the United Kingdom or the European Economic Area” section of our Policy.

Automated decision-making

We do not use automated decision-making or profiling.

Your rights

You have rights in relation to your personal information, including the right to access, correct, delete, restrict or object to its use, withdraw consent, request data portability, and complain to a supervisory authority.

Sensitive personal information

We do not knowingly collect sensitive personal information. Please do not provide such information to us. Our website is not intended for children under 18 and we do not knowingly collect their personal information.

Our details

Data controller: Eurocarb Limited (company number 04112897), Unit 2, Horseshoe Park, Pangbourne, RG8 7JW, United Kingdom.

You can contact the data controller by post at this address or by email at [email protected] with any questions about this Privacy Policy.

Information we collect when you visit our website

We collect and use information from visitors to our website in accordance with this Privacy Policy, including the section entitled Disclosure and additional uses of your information.

Web server log information

Our website is hosted by a third-party provider, The Communications Group (privacy policy: www.thecommunicationsgroup.com/privacy-policy/). When you visit our website, the server automatically records technical information including:

  • Your IP address
  • The pages accessed
  • The date and time of requests
  • The referring source
  • Your browser and operating system

Use of server log information

Server logs are collected and stored by our hosting provider for network and IT security purposes, including:

  • Detecting and preventing unauthorised access
  • Malicious code distribution
  • Denial-of-service or other cyber-attacks

We do not access these logs or attempt to identify you from them unless investigating suspected or potential criminal activity.

We also use aggregated server log information to analyse how our website is used (such as visit numbers, timing, location, and device information) in order to improve our website’s content, structure, and functionality.

Cookies and similar technologies

We use cookies and similar technology, including essential, functional cookies only and analytical cookies if you consented.

Types of Cookies We Use

  • Strictly Necessary Cookies: These are essential for the operation of our website. They include, for example, cookies that enable you to log into secure areas of our site, use a shopping cart, or make use of billing services. To proceed, you need to have consented to the use of your information.
  • Analytical/Performance Cookies: These allow us to recognise and count the number of visitors and to see how visitors move around our website when they are using it. This helps us to improve the way our website works, for example, by ensuring that users are finding what they are looking for easily. We only use these with your consent.
  • Functionality Cookies: These are used to recognise you when you return to our website. This enables us to personalise our content for you, greet you by name, and remember your preferences (for example, your choice of language or region). We only use these with your consent.
  • Targeting/Marketing Cookies: These cookies record your visit to our website, the pages you have visited, and the links you have followed. We use this information to make our website and the advertising displayed on it more relevant to your interests. We only use these with your consent.

You can find further information about our use of cookies, including how to manage your preferences, in our Cookies Policy at https://www.dellorto.co.uk/cookies/.

You can also control cookies through your browser settings, and the cookie management tool, although disabling cookies may affect website functionality.

Legal bases for processing

  • Compliance with a legal obligation to implement appropriate technical and organisational security measures (Article 6(1)(c) UK GDPR).
  • Our legitimate interests, and those of our hosting provider, in ensuring network and information security and improving our website for users (Article 6(1)(f) UK GDPR).
  • Consent (Article 6(1)(a) UK GDPR).

Information we collect when you contact us

We collect and use information from individuals who contact us in accordance with this Privacy Policy, including the section entitled Disclosure and additional uses of your information.

Contact methods and information collected

When you contact us by email, contact form, phone, or post, we collect the information you provide to us, which may include your name, contact details, and the content of your enquiry. We do not record phone calls.

We cannot be responsible for any costs, expenses, loss of profits, harm to reputation, damages, liabilities or any other form of loss or damage suffered by you as a result of your decision to transmit information to us by such means.

Purposes and legal bases for processing

We use this information to respond to enquiries, keep records of correspondence, and, where relevant, to take steps at your request or perform a contract in relation to goods or services you have requested.

The legal bases for this processing are:

  • our legitimate interests in responding to enquiries and managing our communications; and
  • where applicable, the performance of a contract or taking steps at your request prior to entering into a contract
    (Article 6(1)(f) and Article 6(1)(b) UK GDPR).

Storage and third-party providers

Emails you send us are stored by our third-party email provider, GoDaddy, whose servers are located in the United Kingdom (privacy policy: https://uk.godaddy.com/agreements/showdoc.aspx?pageid=PRIVACY&isc=gcouuk53).
Information relating to phone calls (such as your phone number and the date and time of the call) is processed by our telephone service provider, TalkTalk (privacy policy: http://www.talktalk.co.uk/legal/privacy-policy/?from_footer_nav).

If you have opted in to receive marketing communications, we may also use a third-party email marketing provider, Brevo. Brevo is headquartered in France and may store some information on servers in the United States and India. Their Privacy Policy is here https://www.brevo.com/legal/privacypolicy/. Further details are set out in the section entitled Transfers of your information outside the United Kingdom or the European Economic Area.

Security of communications

While we take appropriate measures to protect personal information, transmission of information over the internet (including by email) is not completely secure, and any such transmission is at your own risk.

Information we collect when you interact with our website

We collect and use information from individuals who interact with features of our website in accordance with this Privacy Policy, including the section entitled Disclosure and additional uses of your information.

Registering for an account

When you create an account on our website, we collect information such as your name, address, email address, phone number, and any other details you provide through the registration form. If you do not provide the required information, you will not be able to register or access services that require an account.

This processing is necessary to perform a contract, as creating an account allows you to access goods and services you have purchased (Article 6(1)(b) UK GDPR).

Information submitted during registration is stored in the United Kingdom on our servers and those of our website hosting provider, The Communications Group (privacy policy: www.thecommunicationsgroup.com/privacy-policy/).

Information we collect when you place an order and on our website

We collect and use information from individuals who place an order on our website in accordance with this Privacy Policy, including the section entitled Disclosure and additional uses of your information.

Information collected

When you place an order for goods or services, we collect the information necessary to process and fulfil your order. This includes your name, email address, billing and shipping addresses, and, where applicable, your company name and VAT number. If this information is not provided, we will be unable to enter into or perform a contract with you.

Purposes and legal bases for processing

We process order information:

  • to perform our contract with you, including confirming orders and issuing receipts (Article 6(1)(b) UK GDPR); and
  • to comply with legal obligations, including issuing VAT invoices and maintaining accounting records (Article 6(1)(c) UK GDPR).

Payment processing

Payments made through our website, by email, or over the phone are processed by a third-party payment provider, Elavon, via a secure payment gateway. Elavon processes this information in accordance with its own privacy policy (https://www.elavon.co.uk/privacy-policy.html).

We also accept payments via PayPal. PayPal processes payment information in accordance with its own privacy policy (https://www.paypal.com/myaccount/privacy/privacyhub).

Payments made in person using our card machine terminal are processed by Allied Irish Banks (AIB). AIB processes this information in accordance with its own privacy policy (https://aib.ie/dataprotection).

We also accept payments via bank transfer. When you make a payment to us by bank transfer, we may receive certain information from our bank relating to the transaction, such as the name on the bank account, payment reference, payment amount and transaction date. We use this information solely to process and reconcile payments and to maintain our financial records.

We do not store full payment card details on our systems.

The processing of payment information is necessary to fulfil your contractual obligation to pay for goods or services ordered from us (Article 6(1)(b) of the UK GDPR).

Storage of payment information

Information relating to payment processing is stored on Elavon’s servers in Ireland, the European Economic Area, the United Kingdom. Elavon is a subsidiary of U.S. Bank (U.S. Bancorp), some data is transferred to and stored in the United States for specific purposes, such as:

  • Global fraud monitoring and risk management.
  • Centralised customer support systems.
  • Technical maintenance of their global payment gateway.

This processing is necessary to fulfil your contractual obligation to pay for the goods or services you have ordered (Article 6(1)(b) UK GDPR).

How we collect or obtain information about you from third parties

We may receive personal information about you from third parties, although this is not common. In most cases, such information will consist of your name and contact details, together with any additional information the third party chooses to provide.

Sources of third-party information

Information may be provided to us by:

  • third parties with whom we have an existing relationship (for example, where we act as a subcontractor);
  • third parties at your request;
  • publicly available sources (UK, EU and non-EU), such as Companies House, the electoral register, business directories, media publications, social media, and websites (including your own); and
  • private sources, where lawful.

Purposes and legal bases for processing

We process information received from third parties for the following purposes and on the following legal bases:

  • Performance of a contract or steps at your request (Article 6(1)(b) UK GDPR):
    where information is shared to enable us to provide services to you, verify or complete information we require, or understand your business in order to perform or enter into a contract.
  • Consent (Article 6(1)(a) UK GDPR):
    where you have asked a third party (including data brokers) to share your information with us and the processing is not otherwise related to a contract.
  • Legitimate interests (Article 6(1)(f) UK GDPR):
    where information is shared to enable us to perform obligations under a subcontract with the third party, where the third party has the main contract with you, investigate or pursue suspected infringements of our legal rights, or analyse the effectiveness and engagement levels of our marketing communications.

Information received in error

If we receive personal information from a third party in error, or where we do not have a valid legal basis for processing it, we will delete that information.

Disclosure and additional uses of your information

This section explains when we may disclose your personal information to third parties and the additional purposes for which we may use it.

Disclosure to service providers

We use third-party service providers to operate and manage our business. These providers process personal information on our behalf where necessary and include:

All service providers are located in the United Kingdom, except Brevo, which may process some information in France, the United States, and India.

We share personal information with these providers only where necessary to:

  • operate and secure our website;
  • provide goods or services; or
  • send marketing communications where you have opted in.

The legal basis for this processing are:

  • performance of a contract or steps at your request (Article 6(1)(b) UK GDPR); and
  • our legitimate interests to perform our obligations under that contract, or to take steps you have requested before we enter into a contract, in operating and managing our business efficiently (Article 6(1)(f) UK GDPR).

Analytics and website usage

We use Google Analytics to analyse website usage. Google collects information such as IP addresses and cookie data and processes it in aggregated and anonymised form in accordance with its own privacy policies:
https://www.google.com/policies/privacy/partners/

Information collected via Google Analytics is stored on Google’s servers in the United States. Further information about safeguards for international transfers is set out in the section entitled Transfers of your information outside the United Kingdom and the European Economic Area.

The legal basis for this processing is your consent (Article 6(1)(a) UK GDPR), which you provide via our cookie consent mechanism. You can opt out of Google Analytics using this tool: https://tools.google.com/dlpage/gaoptout

Disclosure to professional and commercial third parties

Where necessary for business operations, we may share your information with:

This sharing is based on our legitimate interests in running and managing our business, including tax compliance, insurance, and delivery of goods (Article 6(1)(f) UK GDPR).

Business transactions

We may disclose your information to a prospective or actual purchaser or seller in the event of a business or asset sale, merger, or similar transaction.

The legal basis for this processing is our legitimate interests in enabling such transactions to take place (Article 6(1)(f) UK GDPR).

Legal and regulatory disclosures

We may use or disclose your information where necessary:

  • to prevent, detect, or investigate suspected criminal activity (including fraud or cybercrime);
  • to enforce or defend our legal rights, including debt recovery;
  • in connection with disputes, mediation, arbitration, or court proceedings; or
  • to comply with legal and regulatory obligations, including court orders or disclosures to law enforcement or regulatory authorities.

The legal bases for this processing are:

  • our legitimate interests in preventing crime, enforcing rights, and resolving disputes (Article 6(1)(f) UK GDPR); and
  • compliance with legal obligations under UK law (Article 6(1)(c) UK GDPR).
    Where an obligation arises under non-UK law, we rely on our legitimate interests in complying with that obligation.

How long we retain your information

This section sets out how long we will retain your information. We have set out specific retention periods where possible. Where that has not been possible, we have set out the criteria we use to determine the retention period.

Retention periods

We retain information as follows:

  • Technical and Security Logs. To ensure the security, integrity and performance of our services, we maintain various server and application logs:
    • Standard Access and System Logs: Technical logs (including IP addresses) are retained for 30 days.
    • System Backups: Full encrypted backups of the website and database are retained for a period of 90 days for disaster recovery purposes.
  • Order information: when you place an order for goods and services, we retain that information for six years following the end of the financial year in which you place your order, in accordance with our legal obligation to keep records for tax purposes.
  • Correspondence and enquiries: when you make an enquiry or correspond with us for any reason, whether by email or via our contact form, we will retain your information for as long as it takes to respond to and resolve your enquiry, and for 6 further years, after which point we will delete your information.

Criteria for determining retention periods

In any other circumstances, we will retain your information for no longer than necessary, taking into account the following:

  • the purpose(s) and use of your information both now and in the future (such as whether it is necessary to continue to store that information in order to continue to perform our obligations under a contract with you or to contact you in the future);
  • whether we have any legal obligation to continue to process your information (such as any record-keeping obligations imposed by relevant law or regulation);
  • whether we have any legal basis to continue to process your information (such as your consent);
  • how valuable your information is (both now and in the future);
  • any relevant agreed industry practices on how long information should be retained;
  • the levels of risk, cost and liability involved with us continuing to hold the information;
  • how hard it is to ensure that the information can be kept up to date and accurate; and
  • any relevant surrounding circumstances (such as the nature and status of our relationship with you).

How we secure your information

We take appropriate technical and organisational measures to secure your information and to protect it against unauthorised or unlawful use and accidental loss or destruction, including:

  • only sharing and providing access to your information to the minimum extent necessary, subject to confidentiality restrictions where appropriate, and on an anonymised basis wherever possible;
  • verifying the identity of any individual who requests access to information prior to granting them access to information.

Transfers of your information outside the United Kingdom or the European Economic Area

All of your information is stored in the United Kingdom. If you have opted in to receive marketing communications, your information may also be stored outside of the United Kingdom and European Economic Area by third-party email provider Brevo (namely the United States, and India). You can find Brevo’s privacy policy here: https://www.brevo.com/legal/privacypolicy/.

Other than to comply with any legal obligations to which we are subject (compliance with a court order, for example), or for the purpose of sending marketing emails from our third-party email provider Brevo (only if you have opted in), we do not intend to transfer your information outside the United Kingdom or to an international organisation. In the unlikely event that we are required to transfer your information outside the United Kingdom or the European Economic Area (or to an international organisation) for such a purpose, we will ensure appropriate safeguards and protections are in place.

Should we transfer your personal data to countries outside of the United Kingdom (UK). When we do so, we ensure it receives a similar degree of protection by ensuring at least one of the following safeguards is implemented:

  • Adequacy Decisions: We transfer data to countries that have been deemed to provide an adequate level of protection for personal data by the UK Government. This includes countries in the European Economic Area (EEA) and the EU.
  • UK-US Data Bridge: For transfers to the USA, we may rely on the UK Extension to the EU-US Data Privacy Framework (the “Data Bridge”), provided the recipient organisation is active on the approved Data Privacy Framework List.
  • Standard Contractual Clauses: Where we use certain service providers, we may use specific contracts approved for use in the UK, such as the International Data Transfer Agreement (IDTA) or the UK Addendum to the EU Standard Contractual Clauses, which give personal data the same protection it has in the UK.
  • Risk Assessments: For transfers not covered by an adequacy decision, we conduct a Transfer Risk Assessment (TRA) to ensure the standard of protection is not materially lower than in the UK.

Your rights in relation to your information

Subject to certain limitations, you have the following rights in relation to your information. You may exercise these rights by writing to Unit 2, Horseshoe Park, Pangbourne, RG8 7JW or by emailing [email protected] :

  • to request access to your information and details of how we use and process it;
  • to request correction or deletion of your information;
  • to request restriction of our use of your information;
  • to receive information you have provided to us in a structured, commonly used and machine-readable format (such as CSV) and to have that information transferred to another data controller;
  • to object to certain uses of your information (see Your right to object below);
  • to withdraw your consent at any time where processing is based on consent (this will not affect the lawfulness of our use and processing of your information carried out before consent is withdrawn); and
  • the right not to be subject to a decision based solely on automated processing, including profiling, which produces legal or similarly significant effects.

Complaints to a supervisory authority

In accordance with Article 77 of the UK GDPR, you have the right to lodge a complaint with a supervisory authority. In the UK, this is the Information Commissioner’s Office (ICO). Their contact details are available here:
https://ico.org.uk/global/contact-us/

Further information about your rights, including applicable limitations, is available on the ICO’s website:

You may also refer to Articles 12–22 and 34 of the UK GDPR:
http://ec.europa.eu/justice/data-protection/reform/files/regulation_oj_en.pdf

Verifying your identity

Where you request access to your information, we are required to take reasonable steps to verify your identity. We will attempt to do this using information already held. If this is not possible, we may request original or certified copies of documentation. We will confirm what is required in your specific circumstances.

Your right to object to the processing of your information for certain purposes

You have the right to object to our processing of your information where it is based on legitimate interests or carried out in the public interest, including profiling, and to object at any time to processing for direct marketing purposes.

You can exercise this right by writing to Unit 2, Horseshoe Park, Pangbourne, RG8 7JW, emailing [email protected], or, for marketing communications, by:

  • using the unsubscribe link in any marketing email; or
  • emailing [email protected] with “OPT OUT” in the message.

For information about objecting to cookie-based processing, please see our cookies policy: https://www.dellorto.co.uk/cookies/

Sensitive personal information

“Sensitive personal information” includes information revealing racial or ethnic origin, political opinions, religious or philosophical beliefs, trade union membership, genetic or biometric data used to identify an individual, health information, or information relating to a person’s sex life or sexual orientation.

We do not knowingly or intentionally collect sensitive personal information, and you must not provide it to us.

If you nevertheless transmit sensitive personal information to us, you will be deemed to have given explicit consent to our processing of that information under Article 9(2)(a) of the UK GDPR. Any such information will be processed solely for the purpose of deleting it.

Marketing and communications

When submitting your details, you may opt in to receive marketing communications from us by clicking “subscribe” or ticking an opt-in box. When you do so, we collect your name and email address.

We will send you marketing communications only where you have opted in.

Legal basis for processing: consent (Article 6(1)(a) UK GDPR).
Consent: you provide consent by actively subscribing in the manner described above.

You may withdraw your consent at any time by:

Withdrawal of consent does not affect the lawfulness of processing carried out before withdrawal.

Transfer and storage of marketing information

We use a third-party provider, Brevo, to send marketing emails and manage our mailing list. Brevo is headquartered in France and operates servers in the United States and India. Their privacy policy is available here:
https://www.brevo.com/legal/privacypolicy/

if you opt in to receive marketing communications, your information may be stored outside the United Kingdom and the European Economic Area, including in the United States and India.

Some of these countries may not provide an adequate level of data protection and may not be subject to an adequacy decision by the European Commission. By opting in to receive marketing communications, you acknowledge this transfer, storage and processing of your information.

For further information about safeguards applied to international transfers, please see the section of this privacy policy entitled Transfers of your information outside the United Kingdom and the European Economic Area.

Changes to our Privacy Policy

We may update this Privacy Policy from time to time.

Minor changes

Where we make minor changes, we will update the effective date at the beginning of the Privacy Policy. From that date onwards, your information will be processed in accordance with the updated version.

Major changes or new processing purposes

Where we make significant changes or intend to use your information for a new or different purpose from that for which it was originally collected, we will notify you by email (where possible) or by placing a notice on our website.

We will provide details of the change, the new purpose and any other relevant information before processing your information for that purpose. Where required by law, we will obtain your prior consent before using your information for a new purpose.

Children’s privacy

We do not knowingly contact or collect information from persons under the age of 18, and our website is not intended for individuals under 18.

If we become aware that we have received information relating to a person under 18 (for example, due to fraud or deception by a third party), we will, where required by law, obtain appropriate parental consent or delete the information from our servers if such consent cannot be obtained.

If you believe we have received information relating to a person under 18, please contact us at [email protected].

California Do Not Track Disclosures

“Do Not Track” (DNT) is a browser setting that allows users to request that websites do not track their online activity. For more information about Do Not Track, please visit: www.allaboutdnt.org.

At this time, we do not respond to Do Not Track browser signals or settings.

Copyright, credit and logo

This Privacy Policy is based on a General Data Protection Regulation (Regulation (EU) 2016/679) compliant template provided by GDPR Privacy Policy. Further information is available at: https://gdprprivacypolicy.org.

Copyright in this Privacy Policy is owned by or licensed to us and is protected by applicable copyright laws. All intellectual property rights in this document are reserved.

Where the GDPR Privacy Policy logo is displayed on our website, it indicates that we have used a template provided by GDPR Privacy Policy as the basis for this Privacy Policy.

Your acceptance

By submitting your personal data, you’re agreeing to the above detailed transfers, storing, or processing of your information.