Privacy Notice

Here at Graham’s The Family Dairy, we believe in quality and high standards in everything we do. When you share your personal data with us, we are equally committed to making sure high standards of privacy and security are met.

This privacy statement explains why and how we collect, store and process your personal data. This relates to personal data you share directly with Graham’s The Family Dairy as our customers, our farmers, our suppliers, subcontractors and our partners. It also relates to personal data which may be shared with us by a third party on your behalf. Where a third party has shared your data with us, we expect that they have informed you about the processing and sharing of your data. Where you are applying for employment with us, please refer to our Recruitment Privacy Notice.

For the purpose of the Data Protection Legislation and this notice, we are the ‘data controller’. This means that we are responsible for deciding how we hold and use personal data about you.

Personal data is defined as any information relating to an identified or identifiable natural living person – a ‘data subject’. This privacy notice also provides information about your rights as a ‘data subject’

We will always be transparent with you and make sure this privacy notice is available to you on our website or in paper format where required, prior to Graham’s The Family Dairy collecting and processing your personal data.

Who are we?

When we say ‘we’ or ‘us’ or ‘our’, we are generally referring to Graham’s The Family Dairy Group Limited and the separate legal entities that make up our group businesses. Graham’s The Family Dairy Group Limited is a company registered in Scotland. Company No. 317473 (Scotland). Registered Office: Airthrey Kerse Farm, Henderson Street, Bridge of Allan, FK9 4RW.

We operate in the UK as a manufacturer and supplier of dairy products in the agriculture and food processing sectors and have over 600 employees.

How do we collect and store your personal data?

Graham’s The Family Dairy collects your personal data through a number of sources, such as:

• When you contact us by email, telephone, post or social media to enquire about our products
• When you enter competitions on our website
• When you subscribe to receive our monthly newsletter
• When you make any complaints regarding our products or the service you have received
• When we call or visit you to progress any agreements or contracts to supply us with goods or services
• When you arrange a contract or agree to purchase our products
• In the administration of our relationship with you
• Through the fulfilment of our contractual obligations
• Through CCTV Visual Imaging in areas within our processing, production, transport and distribution areas

We are committed to ensuring that the information we collect, use and store, is appropriate, is not excessive, is accurate and up to date, is not retained for longer than required and does not constitute an invasion of your privacy.

We may process your personal data for the performance of any contract or agreement we have in place with you and for our own legitimate interests, provided that those interests do not override any of your own interests, rights and freedoms which require the protection of personal data. This includes processing for marketing, business development, statistical and management purposes.

We may process your personal data for certain additional purposes with your consent, such as the provision of our monthly Graham’s Grazette Newsletter. In these circumstances, where your consent is required for the processing of your personal data, you also have the right to withdraw your consent to processing your personal data. We will record the withdrawal of your consent and no further marketing will be sent to you.

What Personal Data do we collect and process?

The data we hold and process at Graham’s The Family Dairy will depend on our relationship with you, along with the services or products we are providing to each other.

Typically, we may hold:

• Names, Addresses – personal or business
• Email address and telephone contact numbers – personal or business
• Farm name, company name and nature of business
• Bank Account details
• Details of the services and products you currently or have previously provided to us
• Details of products or services you currently or have previously bought or requested from us
• Records of correspondence and communications with you
• Records and detail regarding any complaints or enquiries you make to us
• Your requests and preferences regarding marketing information and how you would wish to receive this information
• Information from other sources, such as publically available information, industry networking information and national industry portals and records
• Visual Imaging where you visit or access our processing and production areas, our transport and distribution areas and when you access our premises

How do we use the personal data we hold about you?

Graham’s The Family Dairy may collect and store personal data for a number of reasons:

• To understand your needs and how they may be met
• To fulfil our contractual obligations – including online competitions that we run – and to meet agreements we have put in place with you
• To manage our relationship with you
• To maintain customer and administration records
• To verify identification where required
• To communicate with you by post, email or phone
• To deliver products, orders and prizes
• To manage our distribution and deliveries
• To process financial transactions, invoicing and applications for credit
• To investigate and respond to any complaints you may make
• To respond to your feedback and ideas
• To prevent and detect crime, fraud or corruption
• To meet legal, regulatory and ethical responsibilities
• To visually monitor the safety and security of data subjects and the quality of our manufacturing process

How long will we keep your personal data?

At Graham’s The Family Dairy, we will only keep your personal data for as long as is necessary to fulfil the purposes for which it was collected.

When we assess the appropriate retention period for your personal data, we will consideration the following:

• The requirements of our business and the products and services you provide to us and we supply and distribute to you
• Any statutory or legal obligations
• The purposes for which we originally collected the personal data
• The lawful grounds on which we based our processing
• The types of personal data we have collected
• The amount and categories of your personal data

• If the purpose of processing your personal data could be reasonably fulfilled by any other means

Who will we share your personal data with? 

Graham’s The Family Dairy may share your personal data with third parties or with other organisations and individuals where:

• There is a legal obligation to do so
• Where it is requested by a public or regulatory authority – such as police of HMRC
• Where we are bound by any code of practice
• With our suppliers or distributers in the event of a complaint from you
• Where it is a requirement in administrating our relationship with you
• Where we have a legitimate interest to doing so

We may require the services of third party service providers – such as specialist consultants, auditors and accountants, banking services, administration or HR services, I.T systems maintenance. We may be required to share your data with them in order for them to fulfil the contracts we have in place with them.

We will also share your personal data within the Graham’s The Family Dairy Group where it is in our legitimate interests to do so and for the fulfilment of our contract or agreement with you.

International transfers 

If we intend to transfer your personal data to a third country or share with an international organisation, we will put measures in place to do so securely. Some countries which meet a minimum standard of data protection have been approved by the EU for sending personal data to. We will also protect the transfer of your data through alternative safeguards, such as, Binding Corporate Rules, Model Contracts and Clauses approved by the EU.

Data Security 

At Graham’s The Family Dairy, we are serious about taking the appropriate measures to protect your personal data.

We limit access to our buildings to those who require access – using passes and other technology. We also have a risk framework in place including the appropriate policies and procedures required to keep your data secure. We apply controls and access restrictions across all of our technology platforms and review and test these at regular intervals.

Where passwords are required by you to access secure platforms as part of the service we provide, it is your responsibility to keep these passwords secure.

Through the contracts and security measures we put in place, any third parties that we may share your data with are obliged to keep your details secure and to use this data only to fulfil the service they provide to you on our behalf. When they no longer need your data to fulfil this service, they will dispose of the details in line with our procedures. If we wish to pass your sensitive personal data onto a third party we will only do so once we have obtained your explicit consent or for the fulfilment of a contract we hold with you, unless we are legally required to do otherwise.

Your rights as a ‘data subject’ 

At Graham’s The Family Dairy, while we are processing your personal data, as a ‘data subject’, you have the following rights:

• Right to be informed: Before we start to collect and process your personal data, you have the right to be informed about our Privacy Notice and Data Protection Policy
• Right of Access: By submitting a ‘Subject Access Request’, you have the right to request access to the personal data held by us as a Data Controller.
• Right of Rectification: Where you feel that the information we hold about you is inaccurate or incomplete, you have the right to request that we correct your personal data
• Right to be forgotten: When you feel we no longer need your personal data for the purpose it was obtained for or where you have withdrawn your consent to us processing your data, you have the right to ask us to delete and erase your personal data
• Right to restrict processing: Where you feel the personal data we are processing is inaccurate or where you feel your personal data is no longer needed but you want us to retain it for any  possible future reference, you have the right to restrict our processing of your personal data
• Right to data portability: Where we hold data electronically about you, in certain circumstances, you have the right to ask us to transfer this data to another organisation
• Right to object: You have the right to object to certain types of processing of personal data, such as direct marketing

·       Rights related to automated decision making and profiling:  When we use your personal data to make decisions on an automated basis and where this has a legal or significant impact on you, you have the right to have access to an individual who can review and reconsider the decision. This right applies where you have given us your explicit consent and where it is necessary for the entry into or performance of a contract with you.

Can I find out what personal data Graham’s The Family Dairy group holds about me?

If you submit a Subject Access Request, the Graham’s The Family Dairy Group, can confirm the information held about you and how we process it. If we process your personal data, you can request the following information from us:

• Who is the person or organisation that decided how and why to process your data
• Where applicable, the contact details of their Data Protection Coordinator
• The legal basis for processing and the purpose of the data processing
• Where personal data is being processed based on our legitimate interests or the legitimate interests of a third party, we need to be able to confirm what these interests are
• Which categories of personal data are collected, stored and processed
• Who we share your data with or disclose your data to
• If we intend to transfer the personal data to a third country or share with an international organisation, we will confirm how we put measures in place to do so securely. Some countries which meet a minimum standard of data protection have been approved by the EU for sending personal data to. Where this approval is not in place, we will ensure that processing your data is protected by safeguards put in place by law and protected by model clauses and contracts approved by the ICO
• How long we will store your data
• Confirmation of your Data Subject Rights to ask us to correct, erase, restrict or object to processing your personal data
• Details regarding your right to withdraw your consent at any time
• The process to lodge a complaint with the ICO as the UK’s data protection supervisory authority
• We will clarify if the provision of your personal data is due to a statutory or a contractual requirement, if it is required to enter into a contract between us, if you are obliged to provide the personal data and any consequences possible if you fail to provide the personal data required
• Where your personal data was sourced from if it wasn’t collected directly from you
• If your personal data was used in any automated profiling or decision making, confirmation of the processing and logic which was used in this, along with any outcome or consequences of the processing

We will normally respond to your request within one month from the date it is received. However, in some cases, we may need to extend this to three months. We will always write to you within one month of receiving your original request to tell you if this is the case.

A copy of your personal data is usually provided free of charge. However, we can charge a ‘reasonable fee’ where we find that the data requested is excessive or unfounded and in particular if the request is a repetitive one.

Contacting Us and Your Right to Making a Complaint

If you wish to speak to us or question anything in this notice relating to how we collect, store or process your personal data, please email us at privacy@grahamsfamilydairy.comor write to our Data Protection Coordinator at Graham’s The Family Dairy, Airthrey Kerse Farm, Henderson Street, Bridge of Allan, FK9 4RW

At Graham’s The Family Dairy, we hope you don’t need to make a complaint about how we process your personal data or how a complaint has been handled. If you feel you do wish to complain, you have the right to complain through our Data Protection Coordinator as detailed above and the supervisory authority at the contact details below:

UK Data Protection Regulator, The Information Commissioner’s Office (‘ICO’), Wycliffe House, Water Lane, Wilmslow, Cheshire, SK9 5AF or email https://ico.org.uk/concerns/

Policy Change

This policy was last updated on 3^rdMay 2018

Cookies

Is a small file which asks permission to be placed on your computer’s hard drive. Once you agree, the file is added and the cookie helps analyse web traffic or lets you know when you visit a particular site. Cookies allow web applications to respond to you as an individual. The web application can tailor its operations to your needs, likes and dislikes by gathering and remembering information about your preferences. We use traffic log cookies to identify which pages are being used. This helps us analyse data about web page traffic and improve our website in order to tailor it to customer needs. We only use this information for statistical analysis purposes and then the data is removed from the system.

Cookies in use:

• _ga – Google Analytics cookie used to identify unique visitors.
• _gid – Used to gauge how people interact with the site.
• _gat – Utilised to collect information about visitors to the site and to throttle request rate back to Google.

Overall, cookies help us provide you with a better website, by enabling us to monitor which pages you find useful and which you do not. A cookie in no way gives us access to your computer or any information about you, other than the data you choose to share with us. You can choose to accept or decline cookies. Most web browsers automatically accept cookies, but you can usually modify your browser setting to decline cookies if you prefer. This may prevent you from taking full advantage of the website.

Links to other websites

Our website may contain links to enable you to visit other websites of interest easily. However, once you have used these links to leave our site, you should note that we do not have any control over that other website. Therefore, we cannot be responsible for the protection and privacy of any information which you provide whilst visiting such sites and such sites are not governed by this privacy statement. You should exercise caution and look at the privacy statement applicable to the website in question.

Job applicant Privacy Notice

 

Data controller: Graham’s The Family Dairy

Data protection Co-Ordinator: Graham Downie privacy@grahamsfamilydairy.com

As part of any recruitment process, Graham’s The Family Dairy collects and processes personal data relating to job applicants. Graham’s The Family Dairy is committed to being transparent about how it collects and uses that data and to meeting its data protection obligations.

What information does Graham’s The Family Dairy collect?

Graham’s The Family Dairy collects a range of information about you. This includes:

• your name, address and contact details, including email address and telephone number;
• details of your qualifications, skills, experience and employment history;
• information about your current level of remuneration, including benefit entitlements;
• whether or not you have a disability for which Graham’s The Family Dairy needs to make reasonable adjustments during the recruitment process;
• information about your entitlement to work in the UK; and
• equal opportunities monitoring information, including information about your ethnic origin, sexual orientation, health and religion or belief.

Graham’s The Family Dairy may collect this information in a variety of ways. For example, data might be contained in application forms, CVs or resumes, obtained from your passport or other identity documents, or collected through interviews or other forms of assessment.

Graham’s The Family Dairy may also collect personal data about you from third parties, such as references supplied by former employers, information from employment background check providers and information from criminal records checks. Graham’s The Family Dairy will seek information from third parties only once a job offer to you has been made and will inform you that it is doing so.

Data will be stored in a range of different places, including on your application record, in HR management systems and on other IT systems (including email).

Why does Graham’s The Family Dairy process personal data?

Graham’s The Family Dairy needs to process data to take steps at your request prior to entering into a contract with you. It may also need to process your data to enter into a contract with you.

In some cases, Graham’s The Family Dairy needs to process data to ensure that it is complying with its legal obligations. For example, it is required to check a successful applicant’s eligibility to work in the UK before employment starts.

Graham’s The Family Dairy has a legitimate interest in processing personal data during the recruitment process and for keeping records of the process. Processing data from job applicants allows Graham’s The Family Dairy to manage the recruitment process, assess and confirm a candidate’s suitability for employment and decide to whom to offer a job. Graham’s The Family Dairy may also need to process data from job applicants to respond to and defend against legal claims.

Graham’s The Family Dairy may process information about whether or not applicants are disabled to make reasonable adjustments for candidates who have a disability. This is to carry out its obligations and exercise specific rights in relation to employment.

For some roles, Graham’s The Family Dairy is obliged to seek information about criminal convictions and offences. Where Graham’s The Family Dairy seeks this information, it does so because it is necessary for it to carry out its obligations and exercise specific rights in relation to employment.

If your application is unsuccessful, Graham’s The Family Dairy may keep your personal data on file in case there are future employment opportunities for which you may be suited. Graham’s The Family Dairy will ask for your consent before it keeps your data for this purpose and you are free to withdraw your consent at any time.

Who has access to data?

Your information may be shared internally for the purposes of the recruitment exercise. This includes members of the HR and recruitment team, interviewers involved in the recruitment process, managers in the business area with a vacancy and IT staff if access to the data is necessary for the performance of their roles.

Graham’s The Family Dairy will not share your data with third parties, unless your application for employment is successful and it makes you an offer of employment. Graham’s The Family Dairy will then share your data with former employers to obtain references for you, employment background check providers to obtain necessary background checks and the Disclosure Scotland Service to obtain necessary criminal records checks.

How does Graham’s The Family Dairy protect data?

Graham’s The Family Dairy takes the security of your data seriously. It has internal policies and controls in place to ensure that your data is not lost, accidentally destroyed, misused or disclosed, and is not accessed except by our employees in the proper performance of their duties.

For how long does Graham’s The Family Dairy keep data?

If your application for employment is unsuccessful, Graham’s The Family Dairy will hold your data on file for 12 months after the end of the relevant recruitment process. At the end of that period or once you withdraw your consent, your data is deleted or destroyed.

If your application for employment is successful, personal data gathered during the recruitment process will be transferred to your personnel file and retained during your employment. The periods for which your data will be held will be provided to you in a new privacy notice.

Your rights

As a data subject, you have a number of rights. You can:

• access and obtain a copy of your data on request;
• require Graham’s The Family Dairy to change incorrect or incomplete data;
• require Graham’s The Family Dairy to delete or stop processing your data, for example where the data is no longer necessary for the purposes of processing; and
• object to the processing of your data where Graham’s The Family Dairy is relying on its legitimate interests as the legal ground for processing.

If you would like to exercise any of these rights, please contact Graham Downie, privacy@grahamsfamilydairy.com

If you believe that Graham’s The Family Dairy has not complied with your data protection rights, you can complain to the Information Commissioner.

What if you do not provide personal data?

You are under no statutory or contractual obligation to provide data to Graham’s The Family Dairy during the recruitment process. However, if you do not provide the information, Graham’s The Family Dairy may not be able to process your application properly or at all.

Automated decision-making

Recruitment processes are not based solely on automated decision-making.