Mole Valley Mornings is a fresh produce doorstep delivery service operated as a sole trader business. For the purposes of UK data protection law, Mole Valley Mornings is the data controller — meaning we decide how and why your personal data is processed.

Business name: Mole Valley Mornings

Trading address: Ashtead, Surrey, KT21, England

Contact: hello@molevalleymornings.co.uk

WhatsApp and phone: 07721 208481

We are committed to protecting and respecting your privacy. This policy explains what personal data we collect from you, why we collect it, how we use it, who we may share it with and what your rights are under UK data protection law.

This policy applies to personal data collected when you visit our website at molevalleymornings.co.uk, place an order through our website, WhatsApp or Google Form, sign up for email updates, or contact us in any way.

We may collect, use, store and transfer the following categories of personal data about you:

CategoryWhat this includesIdentity dataYour full nameContact dataYour mobile telephone number, email addressAddress dataYour full delivery address including postcodeTransaction dataDetails of orders you have placed with us, amounts paid, payment method used, order datesCommunication dataMessages you send us via WhatsApp, email or our website contact form, including delivery instructionsTechnical dataIP address, browser type and version, time zone setting, browser plug-ins, operating system and platform (collected automatically by our website)Usage dataInformation about how you use our website, including pages visited and how long you spent on themMarketing preferencesYour preferences for receiving marketing communications from us

Special categories of data

We do not intentionally collect any special categories of personal data (such as data about your health, race, religion, sexual orientation or political views). If you inform us of a food allergy or dietary requirement, we will use this solely to ensure the safety and suitability of your delivery and will treat it with appropriate care.

Data about children

Our service is not directed at children under the age of 18 and we do not knowingly collect personal data from anyone under 18. If you are under 18, please do not place an order or provide us with your personal information.

We collect data in the following ways:

Directly from you

• When you place an order through our website, Google Form or WhatsApp
• When you contact us with a question, complaint or feedback
• When you sign up for our email newsletter
• When you fill in our order or contact forms
• When you provide delivery instructions or access information

Automatically

• When you browse our website — through cookies and similar technologies (see Section 9)
• Technical data such as your IP address and browser information may be collected automatically by our website platform (Shopify)

From third parties

• Payment processing data from Shopify Payments when you pay by card
• Google Form responses when you place an order via our Google Form

Under UK GDPR, we are required to have a lawful basis for processing your personal data. The table below sets out how and why we use your data.

PurposeType of dataLawful basisProcessing and fulfilling your ordersIdentity, Contact, Address, TransactionPerformance of a contractTaking and processing paymentTransaction, ContactPerformance of a contractSending delivery confirmation and notifications by WhatsAppContact, TransactionPerformance of a contractResponding to queries and complaintsIdentity, Contact, CommunicationPerformance of a contract; Legitimate interestsMaintaining our accounting and business recordsIdentity, Contact, TransactionLegal obligation (HMRC record-keeping)Sending you marketing emails about new products, offers and seasonal updates (where you have opted in)Identity, Contact, Marketing preferencesConsentImproving our website and serviceTechnical, UsageLegitimate interestsFraud prevention and securityAll categories as relevantLegitimate interests; Legal obligation

Marketing communications

We will only send you marketing emails if you have explicitly opted in — for example by signing up to our email newsletter. You can unsubscribe from marketing emails at any time by clicking the unsubscribe link in any email we send or by contacting us directly.

We will not share your data with any third party for their marketing purposes.

Legitimate interests

Where we rely on legitimate interests as the legal basis, we have carefully considered whether our interests override your rights and have determined that in each case they do, but that you have the right to object to this processing (see Your Rights, Section 8).

We retain personal data only for as long as necessary for the purposes it was collected, or as required by law.

Data typeRetention periodReasonOrder and transaction records7 yearsHMRC legal requirement for business financial recordsCustomer contact details (active customers)Duration of relationship + 2 yearsLegitimate business interest in maintaining recordsCustomer contact details (inactive customers)2 years from last orderDeleted or anonymised after this periodEmail marketing subscribersUntil you unsubscribeConsent-based — deleted promptly on requestWebsite technical data (analytics)26 monthsStandard analytics retention periodComplaint and complaint correspondence3 yearsLegitimate interests in defending legal claimsWhatsApp messagesAs per WhatsApp's own retention — we retain our side of conversations for up to 2 yearsOrder records and complaint resolution

When data is no longer needed, we will delete it securely or anonymise it so it can no longer be associated with you.

We do not sell your personal data to any third party. We do not share your data with advertisers. We share your data only in the following limited circumstances:

Service providers

We share data with third-party service providers who help us operate our business. These providers are bound by contractual obligations to keep your data confidential and to process it only on our instructions. These include:

• Shopify Inc. — our website and e-commerce platform processes your order and payment data
• Google LLC — Google Forms (for form-based ordering), Google Sheets (for order management), Google Analytics (for website analysis)
• Meta Platforms Ireland Ltd (WhatsApp) — for order confirmations, delivery notifications and customer communications
• Payment processors — Shopify Payments, Stripe or PayPal, depending on your chosen payment method. These are bound by their own privacy policies and PCI DSS compliance.

Legal requirements

We may disclose your data if required to do so by law, in response to a legal process or lawful request from public authorities, or where we believe disclosure is necessary to protect the rights, property or safety of Mole Valley Mornings, our customers or others.

Business transfer

If Mole Valley Mornings is sold or its assets are transferred to a third party, your personal data may form part of that transfer. You will be notified of any such change and your rights will be protected.

Some of our third-party providers process data outside the UK. We ensure that any such transfers are made with appropriate safeguards in place under UK GDPR, including the use of standard contractual clauses or adequacy decisions.

ServicePurposeData locationPrivacy policyShopifyWebsite, orders, paymentsUSA and Canada (adequacy/SCCs) shopify.com/legal/privacy Google (Forms, Sheets, Analytics)Order forms, data management, analyticsUSA and globally (adequacy/SCCs) policies.google.com/privacy WhatsApp (Meta)Order confirmations, customer communicationsUSA and globally (adequacy/SCCs) whatsapp.com/legal/privacy-policy Stripe / PayPalPayment processingUSA (adequacy/SCCs)See their respective websites

Under UK data protection law, you have a number of important rights in relation to your personal data. These are:

Right of access

You can request a copy of the personal data we hold about you (a "subject access request"). We will respond within one calendar month.

Right to rectification

You can ask us to correct inaccurate data we hold about you, or to complete incomplete data.

Right to erasure ("right to be forgotten")

You can ask us to delete your personal data in certain circumstances. This right may be limited where we are required by law to retain records.

Right to restrict processing

You can ask us to temporarily stop using your data in certain circumstances — for example, while you contest its accuracy.

Right to data portability

Where you provided data on the basis of consent or contract, you can ask us to provide it in a machine-readable format so you can transfer it to another service.

Right to object

You can object to us processing your data on the basis of legitimate interests or for direct marketing. We will stop unless we have compelling grounds.

Right to withdraw consent

Where we process data on the basis of consent (such as email marketing), you can withdraw your consent at any time. This does not affect the lawfulness of processing before withdrawal.

Rights related to automated decisions

We do not make automated decisions that significantly affect you using your personal data.

How to exercise your rights

To exercise any of the above rights, please contact us at:

• Email: hello@molevalleymornings.co.uk
• WhatsApp: 07721 208481

We will respond to all requests within one calendar month. We will not charge a fee for exercising your rights in most circumstances. If a request is clearly unfounded or excessive, we may charge a reasonable fee or refuse to comply, and we will explain why.

We may need to verify your identity before processing a request.

Our website at molevalleymornings.co.uk is built on Shopify and uses cookies. Cookies are small text files placed on your device when you visit a website. They allow the site to remember your preferences and improve your experience.

Types of cookies we use

• Essential cookies: Required for the website to function — including your shopping cart, login session and security tokens. These cannot be disabled.
• Analytics cookies: Used to understand how visitors use our site (page views, traffic sources). We use Google Analytics for this purpose. These cookies are anonymous and do not identify you personally.
• Preference cookies: Store your preferences such as language and currency settings.

When you first visit our website, you will be shown a cookie consent banner. You can manage non-essential cookies through this banner or through your browser settings at any time. Disabling certain cookies may affect the functionality of the website.

For full details of the cookies used by Shopify, please visit shopify.com/legal/cookies.

We take the security of your personal data seriously and implement appropriate technical and organisational measures to protect it against unauthorised access, loss, destruction or alteration.

These measures include:

• Secure, encrypted connections (HTTPS) on our website
• Shopify's industry-standard security infrastructure for payment card processing (PCI DSS compliant)
• Limiting access to your personal data to those who have a business need to know
• Secure storage of any data held on our own devices

Despite these measures, no method of transmission over the internet or method of electronic storage is 100% secure. While we strive to protect your personal data, we cannot guarantee absolute security.

If we become aware of a personal data breach that is likely to result in a risk to your rights and freedoms, we will notify the Information Commissioner's Office (ICO) within 72 hours as required by law, and we will notify you directly if the risk is deemed high.

Our service is intended for use by adults aged 18 and over. We do not knowingly collect personal data from anyone under the age of 18. If you are a parent or guardian and believe that your child has provided us with personal data without your consent, please contact us immediately at hello@molevalleymornings.co.uk and we will take steps to delete that information promptly

We may update this privacy policy from time to time to reflect changes in our data practices, technology, legal requirements or our service.

When we make significant changes, we will notify you by email (where you have provided one) or by a prominent notice on our website. We will also update the "last updated" date at the top of this page.

We encourage you to review this policy periodically. Your continued use of our service after any changes means you accept the updated policy.

If you have any questions, concerns or requests relating to this privacy policy or how we handle your personal data, please contact us:

• Email: hello@molevalleymornings.co.uk
• WhatsApp: 07721 208481
• Website: molevalleymornings.co.uk/pages/contact

We will aim to respond to all privacy-related enquiries within five working days.

Your right to complain to the ICO:You have the right to make a complaint at any time to the Information Commissioner's Office (ICO), the UK supervisory authority for data protection issues. You can contact the ICO atico.org.ukor by calling 0303 123 1113. We would, however, appreciate the opportunity to address your concerns before you approach the ICO, so please contact us first.