🌿 Privacy Policy

The data controller for Farm Shop Finder is:

• Controller: [TO BE COMPLETED: controller / trading name — e.g. “Andrew Parker, trading as Farm Shop Finder” or the registered company name]
• Contact address: [TO BE COMPLETED: postal address for data requests]
• Email: [TO BE COMPLETED: privacy mailbox — e.g. privacy@farmshopfinder.uk; set it up and make sure it is monitored]
• ICO registration number: [TO BE COMPLETED: ICO registration number — register and pay the data-protection fee at ico.org.uk before publishing]

“We”, “us” and “our” in this policy mean the controller above.

Our directory shows farm-shop listings: the shop's name, address, postcode, county, category, opening hours, phone number and website where these are known. Much of this is ordinary business information about a shop. However, where a farm shop is run by a sole trader or a family partnership, some of this — for example a proprietor's name or a phone number that is also a personal number — can be personal data about an identifiable person.

• What: shop/business name, address, postcode, county, category, opening hours, contact phone, website, and (where an owner has added it) a contact name.
• Why: to provide a useful, comprehensive, discoverable directory that helps the public find local farm shops and helps producers get found.
• Lawful basis: Legitimate interests (UK GDPR Article 6(1)(f)) — running a public directory of UK farm shops. We have carried out a Legitimate Interests Assessment (LIA) that weighs this against the rights of individuals. Because a farm is often also someone's home, we keep what we publish to the minimum needed (name, location and business contact details), we do not publish anything more sensitive, and we offer a free, no-account-required way to have a listing removed (see section 6). If you are a sole trader and you object to your listing, we will remove it.

Separately from the farm-shop directory, we operate a larger UK Farm Directory (farms.farmshopfinder.uk) compiled from public sources such as food-hygiene and regulatory registers, Companies House and agricultural datasets. Some of these records relate to sole traders and partnerships and therefore contain personal data.

This directory is currently not indexed by search engines while we complete our data-protection groundwork. We publish only limited information (name and general location), never subsidy amounts, director home addresses, or scraped personal email/phone numbers. Our lawful basis is legitimate interests, supported by a documented LIA, and the same free removal route in section 6 applies to it. If you appear in this directory and want to be removed, contact us and we will do so.

If you own a farm shop, you can claim your listing and manage it. To do this we collect:

• What:your email address (to sign you in via a “magic link”), an optional display name, and any edits you make to your own listing (name, contact details, hours, address, category, description).
• Why: to verify you, sign you in securely, and let you keep your listing accurate.
• How sign-in works: we email you a one-time link that expires after 30 minutes and can be used once. We never store a password for owners. We store only a one-way cryptographic hash of the sign-in token, never the token itself.
• Lawful basis: Performance of a contract (Article 6(1)(b)) — providing the listing-management service you asked for — and legitimate interests in keeping the account secure.

When you submit a claim or send us a message through a form, we collect:

• What: your name, email address, phone number (if you provide one), and the content of your message.
• Why: to verify a claim over the right listing and to reply to you.
• Lawful basis: Legitimate interests (Article 6(1)(f)) — responding to your enquiry and verifying claims — and, where the message is a step toward taking out a paid listing, taking steps to enter into a contract (Article 6(1)(b)).
• Marketing (optional, separate): the claim form includes an untickedcheckbox asking whether you'd like occasional updates from us. We only send marketing if you actively tick it, and our lawful basis for that is your consent (Article 6(1)(a)). You can withdraw consent at any time — every marketing email will include an unsubscribe link, or you can email us.

Farm-shop owners can subscribe a listing to a paid tier for extra features.

• What we handle: the fact you hold a subscription, which tier, its status and renewal date, and identifiers linking you to our payment processor (Stripe).
• What we do NOT handle: your card details never touch our systems. Payment is taken on Stripe's own secure checkout page. We never see, store or process your card number.
• Why:to give you the features you've paid for and manage your subscription.
• Lawful basis: Performance of a contract (Article 6(1)(b)), and legal obligation (Article 6(1)(c)) for keeping the financial records that UK tax law requires.

To show shop owners how many people are finding them, we count things like listing views and taps on “get directions”, “call” and “website” links.

• What: counts of these events, tied to a listing (not to you). We do not set an analytics cookie, we do not log your IP address, and we do not create a visitor ID. These records are aggregate and cannot identify you as an individual — we can tell a shop “you had 200 views last month”, never “this person visited”.
• Why: to give owners honest engagement figures and to understand which parts of the site are useful.
• Lawful basis: Legitimate interests (Article 6(1)(f)) in understanding and improving the service. Because we set no non-essential cookies and collect no personal identifiers, this analytics does not require a consent banner under PECR. (If we ever add cookie-based or visitor-level analytics, we will add a consent banner first.)

We send transactional emails (for example your sign-in link) through our email provider, Resend. Resend processes your email address to deliver the message and keeps delivery logs on its own platform.

We also keep our own internal audit log of the system emails we send (such as sign-in links and other service notifications). For each message this records the recipient email address, the subject, the email type, a timestamp, and the delivery status. We use it only to support and troubleshoot email delivery and to keep a record of the service communications we've sent. It is not used for marketing or profiling. We keep this log for the retention period set out in the table below.

• Lawful basis: Performance of a contract / legitimate interests for transactional emails you've asked for and for keeping a minimal audit trail of them; consent for any marketing emails (section 2.4).

Our site runs on Cloudflare's infrastructure. Like any web host, Cloudflare processes technical request data (such as IP addresses) at the network layer to serve pages and to protect the site against attacks and abuse.

• Lawful basis: Legitimate interests (Article 6(1)(f)) — keeping the service secure, available and free from abuse.

We don't sell your data. We use a small number of trusted service providers (“processors”) who handle data only on our instructions:

• Cloudflare — hosting, content delivery, database and security. (Processes technical/request data.)
• Stripe — payment processing for subscriptions. (Stripe is the controller of your card data; see stripe.com/privacy.)
• Resend — sending our transactional emails. (Processes your email address to deliver messages.)

Each of these providers offers appropriate safeguards for any data transferred outside the UK. Where a provider processes data outside the UK/EEA, that transfer relies on an adequacy decision or the UK International Data Transfer Agreement / Addendum. We will also disclose data if the law requires us to.

Under UK GDPR you have the right to:

• Be informed — which is what this policy is for.
• Access a copy of the personal data we hold about you.
• Rectify inaccurate data (owners can do much of this by signing in and editing their listing).
• Erasure— ask us to delete your data (“right to be forgotten”).
• Object to our processing based on legitimate interests — including having your directory listing removed. For a directory listing, if you object, we will remove it.
• Restrict processing while a query is resolved.
• Data portability for data you gave us that we process by consent or contract.
• Withdraw consent at any time (for marketing) without affecting anything we did before you withdrew.

You can exercise any of these without creating an account. We aim to respond within one month. There's no charge unless a request is clearly unfounded or excessive. We may ask you to confirm your identity so we don't disclose your data to the wrong person.

If you're unhappy with how we've handled your data, you can complain to the UK regulator, the Information Commissioner's Office (ICO) — ico.org.uk, helpline 0303 123 1113 — though we'd appreciate the chance to put things right first.

If you're a farm-shop owner or a sole trader and you want your listing taken down, you do not need an account and you do not need to explain why. Choose either:

• Email [TO BE COMPLETED: removals mailbox — e.g. removals@farmshopfinder.uk; set it up and monitor it] with the shop/farm name and its town or postcode, or
• Use the “Remove this listing” link on the listing's page, or the contact form.

We will remove or suppress the listing, normally within a few days and always within one month. If we hold any related contact details, we'll delete those too unless we're required to keep a minimal record of the request itself.