Dunsters Farm Limited
Privacy Notice: Customers and Suppliers | Version 2.0 | Effective 21 April 2026

About this notice

This privacy notice explains how Dunsters Farm Limited collects, uses and protects personal data in connection with our customers, suppliers and their contacts. It is issued in accordance with Articles 13 and 14 of the UK General Data Protection Regulation (UK GDPR) and the Data Protection Act 2018.

1. Who we are

Dunsters Farm Limited (company number 00786115, registered office at Waterfold Business Park, Bury, Lancs, BL9 7BR) is a foodservice wholesaler supplying food, beverages, non-food consumables and equipment to trade customers across the United Kingdom.

For the purposes of the UK GDPR and the Data Protection Act 2018, Dunsters Farm Limited is the data controller in respect of all personal data processed under this notice. This means we are responsible for deciding how and why your personal data is used.

Our data protection contact details are at section 14 of this notice.

2. What personal data we collect

Because we operate as a business-to-business (B2B) wholesaler, most of the data we collect relates to organisations rather than individuals. Where we collect personal data, it is typically limited to the contact details of individuals acting in a business capacity.

Contact and account data

• Names, job titles and business contact details (telephone, email, postal address)

• Account login credentials for our online ordering platform

• Signatures on delivery documentation

Financial and transactional data

• Business bank account details (for payment or direct debit purposes where applicable)

• Purchase history, order records and invoice data

• Credit account information and payment records

Operational data

• Delivery instructions, access codes and site-specific requirements

• Customer service interactions, complaints and queries

• Survey responses, feedback and competition entries (where voluntarily provided)

Website and digital data

• Website usage data collected via cookies (see section 11)

• IP addresses and browser information

• Social media interaction data

Debt recovery data

• Where accounts become overdue, additional information may be collected from credit reference agencies and field tracing agents

We do not intentionally collect special category personal data (such as health, biometric or religious data) in the ordinary course of our business. If such data is voluntarily shared with us, we will treat it with the highest degree of care and use it only for the specific purpose for which it was shared.

3. How we use your personal data

We use personal data for the following purposes. The lawful basis for each is set out in section 4.

• Order fulfilment and account management: processing orders, arranging delivery, invoicing, managing credit accounts and providing customer service

• Supplier relationship management: placing and managing orders with suppliers and processing supplier payments

• Legal and regulatory compliance: tax, accounting, food safety and other legal obligations; maintaining required records

• Debt recovery: recovering overdue amounts via debt collection agencies, credit reference agencies, tracing agents and solicitors

• Marketing: newsletters, product updates and promotional offers (see section 5)

• Service improvement and personalisation: using ordering history and interaction data to make communications more relevant (see section 6)

• Fraud prevention and security: detecting and preventing fraud, unlawful activity and security threats

• Legal claims: establishing, exercising or defending legal rights

• Website operation: operating and improving our website and online ordering platform

4. Our lawful basis for processing

The UK GDPR requires us to have a lawful basis for each processing activity. The table below maps our processing purposes to the applicable lawful basis.

Where we rely on legitimate interests, we have carried out a balancing assessment confirming our interests are not overridden by your rights and interests. You can request a copy of our legitimate interests assessment by contacting us (see section 14).

5. Marketing communications

We send marketing communications including newsletters, new product announcements and promotional offers. We aim to ensure all communications are relevant and useful.

Business customers (existing relationships)

Where you are an existing business customer, we may send marketing emails under the soft opt-in exemption in the Privacy and Electronic Communications Regulations 2003 (PECR). You can opt out at any time.

New contacts and individual subscribers

Where you have not previously purchased from us, or are an individual rather than a business contact, we will only send marketing emails if you have given express consent.

How to opt out

• Click the unsubscribe link in any of our emails

• Email us at sales@dunstersfarm.com

• Call our Customer Care team on 0161 763 7900

Please allow up to 5 working days for your preference to take effect. Opting out of marketing does not affect transactional communications such as order confirmations or delivery updates.

6. Profiling and automated processing

We use your ordering history, geographic information and interaction data to build a profile of your preferences. We use this to decide which products and promotions to feature in our communications, and to personalise your online ordering experience. This profiling is based on our legitimate interests in making communications relevant.

This profiling does not produce legal or similarly significant effects on you. You have the right to object to this profiling at any time - see section 10.

We do not make decisions about you based solely on automated processing that produce legal or similarly significant effects without human review.

7. Who we share your data with

We do not sell your personal data. We do not share it with third parties for their own marketing purposes. We share data only in the following circumstances:

• Logistics and delivery providers: carriers and hauliers delivering Products on our behalf

• IT and software service providers: providers of our ERP, CRM, website hosting and email platform (acting as data processors under written contracts)

• Payment processors and financial institutions: banks and payment service providers

• Credit reference agencies: to assess creditworthiness and manage credit accounts

• Debt recovery agents and solicitors: where accounts become overdue

• Group companies: other entities within the Dunsters Farm group for internal administrative purposes

• Regulatory and law enforcement authorities: where required by law or court order

• Professional advisers: accountants, auditors, insurers and legal advisers under professional confidentiality

All third-party processors are required to process personal data under a written data processing agreement and only in accordance with our instructions.

8. International transfers

Some third-party service providers may store or process personal data outside the United Kingdom. Where this occurs we ensure appropriate safeguards are in place, including:

• UK adequacy regulations - where the destination country has been recognised as providing adequate protection

• UK International Data Transfer Agreements (IDTAs) - standard contractual clauses approved by the ICO

• UK addenda to EU Standard Contractual Clauses - for transfers to EU/EEA countries

You can request further information about international transfer safeguards by contacting us (see section 14).

9. How long we keep your data

We retain personal data only for as long as necessary for the purpose for which it was collected and in accordance with legal requirements.

When retention periods expire, personal data is securely deleted or anonymised.

10. Your rights

Under the UK GDPR and Data Protection Act 2018, you have the following rights. We will respond to all requests within one calendar month.

• Right of access: request a copy of the personal data we hold about you

• Right to rectification: ask us to correct or update inaccurate or incomplete data

• Right to erasure: ask us to delete your data where there is no longer a lawful basis to hold it

• Right to restrict processing: ask us to limit how we use your data in certain circumstances

• Right to data portability: where processing is based on contract or consent and carried out automatically, receive your data in a structured, machine-readable format

• Right to object: object to processing based on legitimate interests (including profiling) on grounds relating to your particular situation

• Right to withdraw consent: withdraw consent at any time where processing is consent-based, without affecting the lawfulness of prior processing

• Right to complain: lodge a complaint with the ICO if you are unhappy with how we have handled your data

To exercise any right, contact us using the details in section 14.

How we handle requests

We will respond within one calendar month of receiving your request and, where we ask for it, satisfactory proof of your identity. The clock does not start until we have both. For complex or multiple requests, we may take up to three months in total and will let you know within the first month if this applies.

We may charge a reasonable fee or decline to act on requests that are repetitive or excessive.

We will do our best to respond to all requests, but where data has already been deleted in line with our retention schedule (section 9), we may not be able to help. Requests relating to data older than three years may not be possible to fulfil.

Information Commissioner's Office (ICO)

• Website: ico.org.uk

• Telephone: 0303 123 1113

• Post: ICO, Wycliffe House, Water Lane, Wilmslow, Cheshire, SK9 5AF

11. Cookies

We use cookies and similar technologies on our website. Full details are in our Cookie Policy, available on our website. You can manage your cookie preferences at any time using the Cookie Preferences link in the footer of our website.

12. Children

Our products and services are directed exclusively at business customers and are not intended for individuals under the age of 18. We do not knowingly collect personal data relating to children. If you believe we have inadvertently collected such data, please contact us immediately and we will delete it promptly.

13. Changes to this notice

We may update this notice to reflect changes in our practices, legal requirements or business operations. We will notify existing customers of material changes by email and post the updated notice on our website with a revised effective date.

14. How to contact us

For any questions about this notice, to exercise your rights or to raise a concern, please contact our Data Protection team:

We aim to respond to all enquiries within 5 working days. For subject access requests we have up to one calendar month to respond.