Privacy Policy

White Oaks Honey is a trading name of White Oaks (Property Management) Limited, company number 17130905, registered office White Oaks, Cock Green, Felsted, Dunmow, Essex CM6 3NA.

We are the data controller for the personal information described in this policy. That means we decide how and why it is used, and we are responsible for looking after it.

This policy explains what we collect, why we collect it, who we share it with and what rights you have. It applies to the White Oaks Honey website and to orders placed through it.

You can read every page on this website without giving us any personal information at all.

We count page views so we can see which products people look at, using Vercel Web Analytics. It sets no cookies, stores nothing on your device, and cannot follow you to other websites — it records the page, the site that referred you, and a broad location such as the country. There is no advertising and no profile of you is built.

Our hosting provider keeps standard server logs when a page is requested, which include the IP address of the device making the request. These are generated automatically as part of serving and securing the website, and we do not use them to build any profile of you.

We do not set any cookies when you browse the shop. Our page-view counting is deliberately cookieless, so there is nothing stored on your device to ask permission for, and that is why you are not asked to accept a cookie banner.

If we later add anything that requires cookies beyond those strictly necessary to operate the site, we will ask for your consent first and update this policy.

Our staff administration area, which is not accessible to customers, uses a strictly necessary cookie to keep the signed-in session secure.

To sell and send you honey, we need to collect:

• Your name;
• Your email address;
• Your delivery address, where the order is being posted;
• Your billing address; and
• Details of what you ordered and what you paid.

Card details are entered directly with our payment provider and are never seen, handled or stored by us. We receive confirmation that a payment succeeded, along with the last four digits and card type for reconciliation.

If you choose to collect your order from the apiary rather than have it posted, we will not ask for a delivery address.

If you email or telephone us with a question, a complaint or a problem with an order, we keep that correspondence and the contact details you used, so that we can answer you and keep a record of what was agreed.

We only use personal information where the law allows us to. In practice that means one of the following:

• To fulfil your order, take payment, send it to you and deal with any problem — because it is necessary to perform our contract with you;
• To keep records of sales and payments — because we have a legal obligation to retain accounting records;
• To operate, secure and troubleshoot the website, and to prevent fraud — because we have a legitimate interest in the shop working properly and not being abused;
• To send you anything promotional — only if you have asked us to, and you can stop at any time.

We do not currently send marketing emails, and we do not sell, rent or trade personal information to anyone, ever.

We share personal information only with the suppliers who help us run the shop, and only with what they need to do their job:

• Our payment provider, which processes card payments and holds the card details we never see;
• Our hosting provider, which serves the website, generates the server logs described above, and provides the cookieless page-view counting;
• Our database provider, which stores product and order records;
• Royal Mail or another carrier, which receives the delivery address printed on your parcel.

Each of these acts on our instructions and is bound to keep the information secure. We may also disclose information where we are legally required to, for example to HMRC or in response to a lawful request.

Our database is hosted in the United Kingdom, in a London region, so order records stay in the UK.

Some of our suppliers are based outside the UK, which means limited personal information may be transferred abroad. Where that happens, we rely on the safeguards those providers have in place for international transfers, such as approved standard contractual clauses.

We keep personal information only as long as we actually need it:

• Order and payment records are kept for six years after the end of the relevant tax year, because HMRC requires businesses to retain accounting records;
• Correspondence about an order is kept while it is relevant and for a reasonable period afterwards, in case a question arises later;
• Server logs are kept for the short period our hosting provider retains them.

When we no longer need information, we delete it or render it anonymous.

The website is served over an encrypted connection, and access to order records is restricted to the people who run the business and protected by an individual sign-in.

No system can be guaranteed completely secure, but we take reasonable steps to protect your information and to limit who can reach it.

Under UK data protection law you have the right to:

• Ask for a copy of the personal information we hold about you;
• Ask us to correct anything that is wrong or incomplete;
• Ask us to delete information, where we no longer have a good reason to keep it;
• Ask us to restrict how we use it, or object to us using it;
• Ask us to transfer it to you or another provider in a portable format;
• Withdraw your consent at any time, where we relied on consent.

To exercise any of these, email or write to us using the details below. We will respond within one month. There is no charge, and we may need to confirm your identity before we act.

Some rights are not absolute. We may need to keep certain records even after a deletion request, for example where we are legally required to retain accounting records.

Please tell us first, and we will do our best to put it right.

You also have the right to complain to the Information Commissioner's Office, the UK regulator for data protection, at ico.org.uk or by calling 0303 123 1113. Complaining to us first is not a precondition.

If we change how we handle personal information, we will update this page and change the date at the top. Where a change is significant, we will make that clear rather than relying on you to notice.