The personal information that we collect, store and process includes:

• Contact details – name, address, phone number, email address   
• Payment details
• CCTV images captured on NPZ UK’s CCTV cameras around its business premises (see Use of CCTV below)

Why we collect and use your personal information

We need to collect your personal information for the following purposes:


    •    To supply and deliver produce to you
    •    To provide information about your order
    •    To arrange delivery of the order
    •    To answer any queries you may have in relation to the order
    •    To take payment for the order
    •    For the general administration of your records
    •    For the general maintenance of our database/records by us
    •    For the purposes of improving the services we provide to you
    •    To keep you informed about new products and services

Our lawful grounds for processing your personal information

Contract:  The processing is necessary for the performance of a contract or for the taking of steps in order to enter into a contract with you;



Legal Obligation: The processing is necessary for us to comply with a legal requirement;



Legitimate Interests:  The processing is necessary for our legitimate interests.  Where we rely on legitimate interests as a reason for processing data, we have considered whether or not those interests are overridden by the rights and freedoms of the clients and suppliers with whom we do business and we have concluded that they are not.



Consent:  Occasionally we may need to ask for your consent for the processing of your data.  For example, at some time in the future we may engage in some direct marketing activity using electronic delivery channels such as email. If we need to do so, we will ensure that you are informed about the nature of the intended processing and you will have the right to refuse or withdraw your consent at any time.

Cookies

Whilst NPZ UK collects website user traffic data (whereby no personal information is obtained or processed) we do not currently use cookies. A cookie is a small data file that is placed on your computer when you visit certain websites. They keep track of browsing patterns and help companies to build up a profile of how visitors use the relevant website.  If we decide to use cookies in the future, we will ensure that you are informed about the nature of the intended processing, we will ask for your consent and you will have the right to refuse the use of your data for such processing at any time.

Use of CCTV

NPZ UK operates CCTV cameras around certain areas of its business premises.  Details of where the cameras operate and further information such as, for example, who can view the images and how long the data is held for, can be obtained from the ‘Contact Us’ information below.  



Personally identifiable information includes data in the form of images and this data processing must therefore meet the same data protection requirements as required under the legislation, guidance and codes of practice to which we are subject, including codes of practice published by the Information Commissioner’s Office (the ICO – the data protection regulator in the UK).



NPZ UK is fully committed to the safety of its clients, suppliers, visitors and to the protection of its premises. CCTV is a key tool within this process.



The lawful basis upon which we process data through the use of CCTV is our legitimate interests: protecting any visitors to our business premises, reasons of security, for the prevention/detection of crime, ensuring that health and safety requirements are met and for the protection of our assets.

Who we share this information with

• We share this information with:


• Our German parent company NPZ-Lembke
• Legal advisors and consultants
• Seed production/distribution services
• Our external auditors
• Financial services providers
• Hauliers and other fulfilment services



We may be required to share personal information with statutory or regulatory authorities and organisations to comply with statutory obligations.  



We may also share personal information with our professional and legal advisors for the purposes of taking advice.



NPZ UK may need to share your information with third parties who supply services to us.  Such third parties will process personal information on our behalf as “data processors”.  They are therefore bound to only process your personal information under our instructions and to observe your confidentiality.



In the event that we do share personal information with external third parties, we will only share such personal information strictly required for the specific purposes and take reasonable steps to ensure that recipients shall only process the disclosed personal information in accordance with those purposes. NPZ UK does not sell personal data to any other business or organisation.   


How we protect your personal information

We take the security of your data seriously.  We have internal policies and controls in place to help ensure that your data is not lost, accidentally destroyed, misused or disclosed, and is not accessed or made available except to authorised personnel in the proper performance of their duties or to restricted third party organisations who process data on our behalf and who are contractually obliged to ensure the security of your data.  



Your personal information is stored on our CRM system and our servers based in the UK/EU for all clients, merchants, suppliers and is accessed by our employees for the purposes set out above. Where hard copies of documentation are retained in line with NPZ UK ’s data retention procedure and schedule, these will be stored securely.



We will not ordinarily transfer your data outside the EU. If this position changes and we need to transfer your data outside the EU, we will put appropriate safeguards in place to ensure that your personal information is protected, as required by law.

How long we keep your personal information


We will only keep your personal information for as long as necessary to comply with our legal obligations and to safeguard NPZ UK in the event of any claims, complaints, litigation or enquiries.  



We have a data retention procedure and schedule that set out the periods for retaining and reviewing all information that we hold about you.  This sets out different retention periods and you can request a copy by emailing us at info@npz-uk.com or writing to us at the address below. 


Contact Us

NPZ UK
North Barn, Manor Farm, 

Milton Road, 

Impington 

Cambridge CB24 9NG



Email:  info@npz-uk.com
 Phone: 01223 236808



Additionally, we have a Data Protection Officer who can be contacted via dpoaas@grcilaw.com. However, please contact us in the first instance.

Your rights as Data Subjects

Under data protection law you have certain rights in respect of your data, as you can see below.  If you would like to exercise any of these rights, please contact us using the details above.



1. The right to be informed – The information set out within this notice should inform you of why we process your personal data
2. The right of access – subject to limited exceptions, you can request us to send you copies of any data we process relating to you
3. The right to rectification – you can request we correct any data we process on you
4. The right to erasure – subject to some exceptions, you can request that we delete any data we process relating to you.  Please note that we may be required by certain legislation to retain data relating to you or we may otherwise need to hold certain data, for example for the defence of legal claims.
5. The right to restrict processing – subject to some exceptions, you can request we limit the processing of the data we hold in respect of you
6. The right to data portability – under certain circumstances you can request for your data to be exported from our systems to a readable format for you to take elsewhere
7. The right to object – you can ask us to stop processing your personal data – again, certain exceptions apply
8. Rights in relation to automated decision making and profiling – where a decision has been made by automated means you can ask for human intervention. Please note NPZ UK do not carry out any automated decision making or profiling at this time.


If you have a concern about the way we are collecting or using your personal data, we request that you raise your concern with us in the first instance. The following link, provided by the ICO provides further information on how to raise a concern with us:  https://ico.org.uk/your-data-matters/raising-concerns/

 UK