Privacy & Cookie policy
This privacy & cookie policy sets out the data processing practices of Heritage Fine Food Company Ltd and the following trading names/product/service websites: 5adaybox
Our UK registered office is at Lowerfields Farm, Coate, Devizes, SN10 3LQ
Please note that all personal data collected by Heritage Fine Foods Ltd will be processed and held in accordance with the UK General Data Protection Regulation (UK GDPR) and the Data Protection Act 2018.
This Privacy Notice explains:
• Who Heritage Fine Foods Ltd is and what we do.
• How to contact us regarding our use of your personal data.
• Why we process personal data and the legal bases for doing so.
• How we use personal data for marketing purposes.
• The third parties who may process personal data on our behalf.
• How long we retain personal data.
• Your rights under data protection legislation.
• Our use of cookies and similar technologies.
• Links to third-party websites.
• How we protect the personal data we hold.
• Updates to this Privacy Notice.
Who we are
Heritage Fine Foods Ltd is a SALSA-certified fruit and vegetable food service supplier based in the heart of Wiltshire.
We supply both food service and retail customers throughout the region.
How to contact Heritage about your personal data or make a complaint
If you have any questions about this Privacy Notice, wish to exercise your data protection rights, or would like further information about how we process your personal data, please contact our Data Protection Officer (DPO):
Telephone: +44 (0)1380 860968
Email: [email protected]
Post: Data Protection Officer, Heritage Fine Foods Ltd, Lowerfields Farm, Coate, Devizes, Wiltshire, SN10 3LQ
Throughout this Privacy Notice, "DPO" refers to the Data Protection Officer.
Why Heritage processes personal data
Heritage Fine Foods Ltd collects and processes personal data in order to provide its products and services to wholesale food service customers and retail home delivery customers.
We collect personal data directly from individuals through our website, online forms, telephone conversations, email correspondence, written applications and in-person interactions.
The table below outlines the categories of personal data we process, the purpose for which it is used and the legal basis for processing.
|
Type of Personal Data |
Purpose of Processing |
Legal Basis |
|
Customer contact details (name, address, telephone number, email address) |
To process and fulfil orders, manage customer accounts and provide customer service |
Contract |
|
Delivery information |
To arrange and complete deliveries of products and services |
Contract |
|
Payment and transaction information |
To process payments and maintain accounting records |
Contract and Legal Obligation |
|
Marketing preferences |
To manage communication preferences and marketing consent records |
Consent and Legitimate Interests |
|
Website enquiry forms and correspondence |
To respond to enquiries and provide information about products and services |
Legitimate Interests |
|
Website usage data, analytics and cookies |
To improve website performance, user experience and marketing effectiveness |
Consent and Legitimate Interests |
|
Recruitment information (where applicable) |
To assess applications and manage recruitment processes |
Legitimate Interests and Contract |
|
Legal, regulatory and compliance records |
To comply with legal obligations and protect the business from fraud or misuse |
Legal Obligation and Legitimate Interests |
The legal basis on which Heritage processes personal data
Heritage relies upon different legal bases for processing personal data according to the relationship and purpose for which it is collected, as explained below.
Contractual
We need to process personal data about individuals, and those enquiring about our work, in order to deliver and administer the services that we provide.
Individuals can update their preferences or unsubscribe from emails by clicking on the link at the bottom of newsletter mailings received.
The contract with customers includes using personal data for the booking of an order with us. We may also send previous customers information about products and services that we think will be of interest to them. Customers can opt out of any of these communications at any time.
Legitimate interest
Heritage keeps regular customers informed of its activities and new services/products via updates on the basis of legitimate interest. It is in both the interest of Heritage and the customer that they are aware of the offers that they can benefit from. This kind of information is also a legitimate part of what a customer might reasonably expect to receive. These updates take place periodically via email or telephone calls.
Individuals can update their preferences or unsubscribe from emails by clicking on the link at the bottom of newsletter mailings received.
Consent
Heritage seeks consent from individuals, subscribers and customers and anyone who enquires about Heritage products and services to send them marketing information. Consent is sought for:
Marketing information about Heritage’s products and services.
Marketing information about any promotions, events, networking and events attending or running by Heritage.
For each of these areas of activity, marketing consent is sought by channel for email, telephone and post. Some additional optional information can be provided so that the information that we deliver can be more tailored and relevant to your stated interests.
Compliance with a legal obligation
In the event that Heritage is contacted directly by a prospective employer or client to verify the status of an individual, Heritage will seek the consent of the individual concerned before releasing any information. We may be required in some cases by law to disclose details without your consent e.g. on a request from the police.
How Heritage uses data for marketing purposes
Heritage may communicate with existing customers regarding products, services and offers that are similar to those they have previously purchased or enquired about where permitted under applicable law and our legitimate interests.
Where required by law, we will seek your consent before sending marketing communications. Consent may be obtained:
• Online through a self-registration process.
• In person at an event.
In accordance with UK GDPR and the Data Protection Act 2018, Heritage requires marketing consent to be freely given, specific, informed and capable of being withdrawn at any time. Heritage maintains a record of marketing preferences and consent within its systems, including when consent is given or withdrawn.
If you opt into marketing communications, Heritage will use your personal information to send information about products, services, promotions and events that may be relevant to you. We will never sell your personal data or pass it to third parties for their own marketing purposes.
You may unsubscribe from marketing communications at any time by using the unsubscribe link included in our emails or by contacting us directly at [email protected].
Recipients of personal data for processing on Heritage’s behalf
Heritage uses carefully selected third-party service providers to support the operation of our business. These may include providers of website hosting, payment processing, customer relationship management systems, email marketing platforms, website analytics, advertising services, cloud storage and IT support services. Examples may include Magento, Klaviyo, Stripe, Worldpay, Google Analytics and Meta (Facebook).
All third-party processors are required to process personal data securely, only for authorised purposes and in accordance with applicable data protection legislation.
Retention periods
Heritage retains personal data only for as long as necessary to fulfil the purposes for which it was collected and to comply with legal, regulatory and contractual obligations.
Typical retention periods include:
• Customer account information – up to 6 years after the last transaction.
• Financial and accounting records – 6 years.
• Marketing preferences and consent records – until consent is withdrawn or for up to 2 years after the last meaningful interaction.
• Website enquiries and contact forms – up to 2 years.
• Recruitment information – up to 12 months following completion of the recruitment process.
We may retain information for longer where required by law or where necessary to establish, exercise or defend legal claims.
Data subject’s rights
You have the following rights in respect of your personal data. In order for you to exercise these rights at Heritage we will need to confirm your identity. This may be by you providing your customer number or a form of ID such as a passport or driving licence so that we can verify that you are the data subject before releasing information to you.
The right to be informed – you have the right to be told about the collection and use of the personal data you provide. This privacy notice sets out the purpose for which we process your personal data, how long we will keep your data and with whom we will share your data. If you have any questions on how and why we process your data, please contact the DPO. If you want to know more about this right, the ICO has more guidance on their website: https://ico.org.uk/for-organisations/guide-to-the-general-data-protection-regulation-gdpr/individual-rights/right-to-be-informed/
Right of access – you have the right to know whether we are processing your personal data, and to a copy of that data. We would need as much information as possible to enable us to locate your data. We will respond to your request within one calendar month of receipt of your request. If you want to exercise this right, please contact the DPO at the contact details above. If you want to know more about this right, the ICO has more guidance on their website
Right to rectification – you have the right to have any incorrect personal data corrected or completed if it is incomplete. You can make this request verbally or in writing. We will need as much information as possible to enable us to locate your data. We will look at any request and inform you of our decision within one calendar month of receiving the request. If you want to exercise this right, please contact the DPO at the contact details above. If you want to know more about this right, the ICO has more guidance on their website
Right to erasure – this right, often referred to as the right to be forgotten, allows you to ask us to erase personal data where there is no valid reason for us to keep it. We will look at any request and inform you of our decision within one calendar month of receiving the request. If you want to exercise this right, please contact the DPO at the contact details above. If you want to know more about this right, the ICO has more guidance on their website
Right to restrict processing – you have the right to ask us to restrict processing of your data. We will look at any request and inform you of our decision within one calendar month of receiving the request. If you want to exercise this right, please contact the DPO at the contact details above. If you want to know more about this right, the ICO has more guidance on their website
Right to data portability – you have the right to move, copy or transfer your personal data from one IT environment to another. This right applies to data that you have provided to us and that we are processing on the legal basis of consent or in the performance of a contract and where that processing is by automated means. We will respond to your request within one calendar month of receipt of your request. If you want to exercise this right, please contact the DPO at the contact details above. If you want to know more about this right, the ICO has more guidance on their website
Right to object – you have the right to object to our processing of your personal data based on (i) legitimate interests, or for the performance of a task in the public interests/exercise of official authority (including profiling); (ii) direct marketing (including profiling); and (iii) for purposes of scientific/historical research and statistics.
Legitimate interests/legal task – your objection should be based on your particular situation. We can continue to process the data if we can demonstrate compelling legitimate grounds which override your interests.
Direct marketing – you have an absolute right to ask us to stop processing for the purposes of direct marketing. We will action your request as soon as possible.
Scientific/historical research and statistics – your objection should be based on your particular situation. If we are conducting research where the processing is necessary for the performance of a public task, we can refuse to comply with your objection.
If you want to exercise this right, please contact the DPO at the contact details above. If you want to know more about this right, the ICO has more guidance on their website
Rights relating to automated decision making including profiling – you have rights in respect of automated decision making, including profiling. Where we carry out solely automated decision making, including profiling, which has legal or similarly significant effects on you, we can only do this if it is in connection with a contract with you, we have a right under law or you have provided your explicit consent. We will tell you if this happens and tell you how you can request human intervention or challenge the decision. If you want to exercise this right, please contact the DPO at the contact details above. If you want to know more about this right, the ICO has more guidance on their website
Processing based on consent
Where Heritage processes your personal data based on your consent you have the right to withdraw that consent at any time without reason. You can opt-out by using the unsubscribe option in any marketing that we send you via the link at the bottom of the email received.
The right to lodge a complaint to a supervisory authority
If you are unhappy with any aspect of our handling of your personal data, please contact Heritage in the first instance at [email protected] and we will endeavour to resolve your concerns.
You also have the right to lodge a complaint with the Information Commissioner's Office (ICO):
Information Commissioner's Office
Wycliffe House
Water Lane
Wilmslow
Cheshire
SK9 5AF
Telephone: 0303 123 1113
Website: https://ico.org.uk
Cookies and Tracking
This website uses cookies in compliance with the Privacy and Electronic Communications Regulations (PECR). Customers will be notified and required to accept cookie use where applicable.
In addition to essential website cookies, we may use analytics and marketing cookies provided by third parties such as Google Analytics, Meta (Facebook) and Klaviyo. These cookies help us understand how visitors use our website, measure the effectiveness of marketing campaigns and provide a more relevant browsing experience.
Where required, these cookies will only be placed on your device after you have provided your consent through our cookie preference banner.
How we use cookies
A cookie is a small file which asks permission to be placed on your computer's hard drive. Once you agree, the file is added and the cookie helps analyse web traffic or lets you know when you visit a particular site. Cookies allow web applications to respond to you as an individual. The web application can tailor its operations to your needs, likes and dislikes by gathering and remembering information about your preferences.
We use traffic log cookies to identify which pages are being used. This helps us analyse data about web page traffic and improve our website in order to tailor it to customer needs. We only use this information for statistical analysis purposes and then the data is removed from the system.
Overall, cookies help us provide you with a better website, by enabling us to monitor which pages you find useful and which you do not. A cookie in no way gives us access to your computer or any information about you, other than the data you choose to share with us. You can choose to accept or decline cookies. Most web browsers automatically accept cookies, but you can usually modify your browser setting to decline cookies if you prefer. This may prevent you from taking full advantage of the website.
Links to other websites
Our website may contain links to other websites of interest. However, once you have used these links to leave our site, you should note that we do not have any control over that other website. Therefore, we cannot be responsible for the protection and privacy of any information which you provide whilst visiting such sites and such sites are not governed by this privacy statement. You should exercise caution and look at the privacy statement applicable to the website in question.
Controlling your personal information
You may choose to restrict the collection or use of your personal information in the following ways:
whenever you are asked to fill in a form on the website, look for the box that you can click to indicate that you do not want the information to be used by anybody for direct marketing purposes
if you have previously agreed to us using your personal information for direct marketing purposes, you may change your mind at any time by letting us know using our Contact Us information
We will not sell, distribute or lease your personal information to third parties unless we have your permission or are required by law to do so. We may use your personal information to send you promotional information about third parties which we think you may find interesting if you tell us that you wish this to happen.
You may request details of the personal information we hold about you. Requests will normally be provided free of charge in accordance with UK GDPR. We reserve the right to charge a reasonable fee where a request is manifestly unfounded, excessive or repetitive. If you would like a copy of the information held about you, please email your request to [email protected].
If you believe that any information we are holding on you is incorrect or incomplete, please write to or email us as soon as possible, at the above address. We will promptly correct any information found to be incorrect.
List of cookies we collect
The table below lists the cookies we collect and what information they store.
Cookie Name / Cookie Description
FORM_KEY
Stores randomly generated key used to prevent forged requests.
PHPSESSID
Your session ID on the server.
GUEST-VIEW
Allows guests to view and edit their orders.
PERSISTENT_SHOPPING_CART
A link to information about your cart and viewing history, if you have asked for this.
STF
Information on products you have emailed to friends.
STORE
The store view or language you have selected.
USER_ALLOWED_SAVE_COOKIE
Indicates whether a customer allowed to use cookies.
MAGE-CACHE-SESSID
Facilitates caching of content on the browser to make pages load faster.
MAGE-CACHE-STORAGE
Facilitates caching of content on the browser to make pages load faster.
MAGE-CACHE-STORAGE-SECTION-INVALIDATION
Facilitates caching of content on the browser to make pages load faster.
MAGE-CACHE-TIMEOUT
Facilitates caching of content on the browser to make pages load faster.
SECTION-DATA-IDS
Facilitates caching of content on the browser to make pages load faster.
PRIVATE_CONTENT_VERSION
Facilitates caching of content on the browser to make pages load faster.
X-MAGENTO-VARY
Facilitates caching of content on the server to make pages load faster.
MAGE-TRANSLATION-FILE-VERSION
Facilitates translation of content to other languages.
MAGE-TRANSLATION-STORAGE
Facilitates translation of content to other languages.
Third party websites
Our website may contain links to other websites that are outside our control and are not covered by this privacy notice. If you access other sites using the links provided, the operators of these sites may collect information from you that will be used by them in accordance with their privacy policy, which may differ from ours
The security of the personal data that Heritage processes
Heritage protects the personal data that it holds with technical and organisational security measures. Our cyber security arrangements and framework of data protection policies, procedures and training are kept under regular review to ensure that we keep the data we hold secure.
Changes to the privacy notice
This privacy notice was reviewed and updated on 8 June 2026 and is reviewed regularly to ensure it remains accurate and compliant with applicable data protection legislation.
Queries
If you have any queries about the policy and how it affects you, please contact the Data Protection Officer via [email protected] or in writing to Lowerfields Farm, Coate, Devizes, SN10 3LQ