Privacy & Data Protection Policy

1. Introduction & Statutory Scope

Yorkshire Mushroom Company Ltd ("we", "us", or "our") operates the online dispensary located at https://www.yorkshiremushroomcompany.co.uk. We are fully dedicated to protecting the privacy, security, and confidentiality of our customers, website visitors, and dispensary clients in strict compliance with the UK General Data Protection Regulation (UK GDPR) and the Data Protection Act 2018 (DPA 2018).

This Privacy Policy details how we collect, process, store, and safeguard your personal information when you browse our catalog, purchase our small-batch mushroom tinctures, interact with our apothecary dispatches, or contact our customer care team.

2. Lawful Bases for Processing

Under Article 6 of the UK GDPR, we only collect and process personal information where a recognized lawful basis applies:

• Contractual Necessity (Article 6(1)(b)): Processing your name, postal delivery address, payment confirmation, and contact information to fulfill dispensary orders, process transactions, and arrange courier dispatch.
• Legal Obligation (Article 6(1)(c)): Retaining invoice records, transaction histories, and batch traceability logs to satisfy statutory accounting, tax (HMRC), and food safety requirements.
• Legitimate Interests (Article 6(1)(f)): Monitoring server security, preventing e-commerce fraud, and improving dispensary website functionality, provided your fundamental rights do not override these interests.
• Consent (Article 6(1)(a)): Delivering our email newsletter (Apothecary Dispatches) and deploying non-essential analytical cookies when you opt in via our Cookie Consent Banner.

3. Personal Information We Collect

Depending on your interaction with our dispensary, we may collect the following categories of data:

• Identity & Contact Data: Full name, delivery address, billing address, email address, and contact telephone number.
• Financial & Transaction Data: Transaction amount, purchased products, batch identifiers, order timestamp, and payment status. Note: Payment card details are processed directly and securely by PCI-DSS Level 1 payment providers (Stripe, Apple Pay, Google Pay); we never store raw credit/debit card numbers.
• Technical & Usage Data: Anonymized IP address, browser type and version, operating system, time zone setting, and aggregated page navigation metrics.

4. Google Analytics & Google Site Kit Integration

We deploy Google Analytics 4 (GA4) via the Google Site Kit framework to measure visitor interaction, identify high-traffic monograph articles, and optimize dispensary user experience.

• IP Anonymization: IP addresses are automatically truncated and anonymized by Google Analytics at the earliest ingestion point.
• Cookie Duration: GA4 analytical cookies (e.g., _ga, _ga_*) persist for up to 24 months unless cleared earlier.
• Granular Consent & Opt-Out: Google Analytics is subject to your choice on our bottom Cookie Consent Banner. Selecting "Essential Only" disables analytical storage (analytics_storage: 'denied'). You may also install the Google Analytics Opt-Out Browser Add-on.
• No Cross-Site Tracking: We strictly prohibit the sharing or sale of customer browsing data with third-party data brokers or advertising networks.

5. Courier Fulfilment & Third-Party Processors

To safely deliver your handcrafted black-dipped amber bottles, we share relevant postal details with vetted third-party service providers:

• Royal Mail: Name, delivery address, email, and telephone are transmitted via secure API for Royal Mail Tracked 24/48 parcel dispatch and real-time delivery SMS/email tracking updates.
• Payment Processors (Stripe, PayPal, Apple Pay, Google Pay): Secure end-to-end TLS 1.3 encrypted tokenization for payment processing.
• Cloud Hosting & Infrastructure: Encrypted UK/EU-based dedicated servers maintained under rigorous ISO 27001 physical and digital security standards.

6. Data Retention Protocols

We retain order transaction records for a period of six (6) years following the conclusion of the financial year in which the order occurred, in compliance with UK HMRC statutory accounting standards. Newsletter contact data is retained until you unsubscribe via the one-click link at the foot of any email.

7. Your Statutory Data Protection Rights

Under the UK GDPR and DPA 2018, you possess comprehensive statutory rights regarding your personal data:

• Right of Access (Subject Access Request): You have the right to request a copy of the personal data we hold about you.
• Right to Rectification: You may request immediate correction of inaccurate or incomplete personal records.
• Right to Erasure ("Right to be Forgotten"): You may request deletion of personal data where retention is no longer legally necessary.
• Right to Restrict Processing & Data Portability: You may request suspension of processing or receipt of your data in a structured, machine-readable format.
• Right to Object & Withdraw Consent: You may revoke consent for marketing communications or analytical cookies at any time.

To exercise any of these rights, please contact our Data Protection Officer at info@yorkshiremushroomcompany.co.uk or write to our registered office in Knaresborough.

8. Supervisory Authority & Complaints

If you have concerns regarding our data handling, we encourage you to contact us directly to resolve the matter promptly. You also retain the statutory right to lodge a formal complaint with the UK supervisory authority:

Information Commissioner's Office (ICO)
Wycliffe House, Water Lane, Wilmslow, Cheshire, SK9 5AF
Telephone: 0303 123 1113 · Website: ico.org.uk