Sutton Fresh

Privacy Policy

Privacy Policy

Last updated: 24/08/2026

1. Who we are

This website is operated by G J Sutton, a partnership trading as Sutton Fresh (“we”, “us”, “our”), based at Bent Farm, Astbury, Cheshire, CW12 4RW.

We are the data controller for the personal information described in this policy. That means we decide why and how your personal information is used.

How to contact us about privacy:

  • Email: carrie@suttonfeeds.co.uk
  • Post: Bent Farm, Astbury, Cheshire, CW12 4RW

2. What this policy covers

This policy explains what personal information we collect, why we collect it, what we do with it, how long we keep it, and what rights you have. It covers two things: the suttonfresh.co.uk website, and the CCTV system at Bent Farm, which is described in Section 7.

If you follow a link from our site to another organisation’s website, that organisation will have its own privacy policy and we are not responsible for it.

3. The information we collect

We collect three categories of information.

a) Information you give us directly through the contact form

When you use our contact form we ask for:

  • your name
  • your email address
  • the message you choose to write to us

You are not under any legal or contractual obligation to give us this information. It is entirely your choice whether to contact us. The practical consequence of not providing it is simply that we will not be able to reply to you.

We do not ask for any other information, and we ask that you do not include sensitive information in your message. Sensitive information means details about health, race or ethnic origin, religious or philosophical beliefs, political opinions, trade union membership, genetic or biometric data, sex life or sexual orientation, or criminal offences. We do not need any of that in order to answer an enquiry.

b) Information collected automatically when you browse

If you accept analytics cookies, we collect information about how the site is used, including pages viewed, approximate location at city or region level, the type of device and browser you are using, how you arrived at the site, and how long you spend on a page. This is collected through Google Analytics 4 and is described further in Sections 5 and 6.

We do not collect analytics information about you unless you accept analytics cookies through our cookie banner.

We also automatically record a small amount of technical information as part of running the website securely, including your IP address in our web server and security logs. This happens for every visitor and is necessary for the site to function and to be protected against abuse.

c) CCTV images, if you visit the farm

We operate CCTV in the milk vending area at Bent Farm. If you come to the farm to buy milk, you will be recorded. This is set out in full in Section 7.

4. Why we use your information, and our legal basis for doing so

Under UK data protection law we must have a lawful basis for using your personal information. Ours are set out below.

What we do

Information used

Lawful basis

Read and reply to your enquiry, and hold a record of the correspondence

Name, email address, message content

Legitimate interests: responding to a person who has deliberately contacted us. Where your enquiry concerns a possible order or booking, the basis is also taking steps at your request before entering into a contract.

Prevent spam and abusive submissions of the contact form

Message content, IP address, submission timing

Legitimate interests: protecting our website and our staff from spam, fraud and abuse.

Measure how the website is used so we can improve it

Analytics information described in Section 3(b)

Consent, given through our cookie banner. You can withdraw it at any time.

Record whether you accepted or rejected cookies

Consent record and identifier stored by our consent tool

Legal obligation: we are required to be able to demonstrate that consent was given.

Keep the website secure and available

Server and security log data

Legitimate interests: operating a secure website.

Record the milk vending area on CCTV

CCTV images of anyone in the vending area

Legitimate interests: preventing and detecting crime, and protecting our property, our stock and the people using the vending area.

Receive, investigate and respond to a data protection complaint

Your contact details and the details of your complaint

Legal obligation under section 164A of the Data Protection Act 2018.

Where we rely on legitimate interests, we have carried out a balancing exercise and concluded that our interest is not overridden by your rights and freedoms, because the information involved is limited, you have chosen to contact us, and we do not use it for anything you would not reasonably expect. You can ask us for more detail about that assessment, and you have the right to object to processing based on legitimate interests. See Section 11.

We do not use your information for marketing. We will not add you to a mailing list, send you newsletters, or send you promotional messages as a result of using the contact form. If that changes in future, we will ask for your consent separately and update this policy before we do so.

5. Who we share your information with

We do not sell your personal information, and we do not share it for anyone else’s marketing purposes.

We use a small number of service providers who process personal information on our behalf, under written contract and on our instructions:

Provider

What they do

Where they process data

DreamHost (New Dream Network, LLC)

Hosts the website, and sends the enquiry emails generated by the contact form

Amsterdam, the Netherlands. DreamHost is a United States company and its staff may access data from there for support purposes

Microsoft Ireland Operations Limited (Microsoft 365)

Provides the mailbox that receives and stores your enquiry

Microsoft data centres. Where personal information is stored or accessed outside the UK, Microsoft applies standard contractual clauses and the UK International Data Transfer Addendum

Google Ireland Limited (Google Analytics 4 and Google Tag Manager)

Website analytics and tag management

UK and EU collection servers, with onward processing by Google LLC in the United States

CookieYes Limited, a UK company based in Milton Keynes

Cookie consent banner, and the record of the choice you made, which includes a shortened form of your IP address and your country

United Kingdom, with the application itself running on Amazon Web Services infrastructure

We may also disclose information where we are legally required to do so, for example in response to a valid request from a regulator, a court, or law enforcement, or where necessary to establish, exercise or defend legal claims.

6. Cookies and similar technologies

A cookie is a small file stored on your device by a website. The same rules apply to similar technologies such as pixels, tracking scripts and device fingerprinting. Some are needed for the site to work. Others are optional.

When you first visit the site you will see a cookie banner offering you the choice to accept all cookies, reject all optional cookies, or choose by category. Optional cookies, including all analytics cookies, are blocked until you accept them. You can change your choice at any time, and as easily as you made it, by using the cookie settings link in the footer of every page.

Strictly necessary cookies. These are needed for the website to function and to remember your cookie choice. They are set without consent because the site cannot work properly without them. This includes the CookieYes consent cookie, which stores the choice you made so we do not ask you again on every page, and, if you log in to the site, the standard WordPress session cookies.

Analytics cookies. These are set by Google Analytics 4 and only after you accept them. They give us statistics about how the site is used. The main cookies are _ga and _ga_BE4QNLPW3R, which expire after 400 days, a little over thirteen months, and which are removed if you withdraw consent.

UK law was amended in February 2026 to allow certain low risk, purely statistical analytics to run without consent. That exception does not apply to our use of Google Analytics, because the exception is only available where the analytics provider does not use the information for its own purposes, and Google does. We therefore continue to ask for your consent before any analytics cookie is set, and nothing is set if you decline.

The full, current list of cookies used on this site, with names, purposes and expiry periods, is shown in the cookie preferences panel accessible from the footer of every page.

A note on Google Analytics. Google does not log or store the IP addresses of visitors from the UK, the EU or Switzerland. IP data is used only to work out a coarse location, at city level or broader, and is then immediately discarded. Google Signals and advertising personalisation features are disabled on our property. We do not use the analytics data to identify you personally, and we do not combine it with the information you send us through the contact form. Google acts as our processor for this data. Google’s own privacy information is available at https://policies.google.com/privacy.

Do Not Track. Browsers vary in how they signal a tracking preference and there is no agreed standard, so we rely on our cookie banner rather than browser signals. Rejecting analytics cookies in our banner is the reliable way to opt out.

7. CCTV at Bent Farm

We operate CCTV covering the milk vending area at Bent Farm. If you visit to buy milk, you will be recorded. Signs are displayed at the vending area so you know before you enter.

Why we do it. To prevent and detect crime, and to protect our property, our stock and the people using the vending area, which is not staffed. Our lawful basis is legitimate interests. We have weighed that against the privacy of the people recorded, and have kept the cameras pointed only at the vending area rather than at anywhere people would expect to be unobserved.

What is recorded. Images of the vending area only. The system does not record sound. We do not use facial recognition, and we do not use the footage to identify or track individual customers.

Where the footage is held and who can see it. Footage is recorded onto a server in the farm office here at Bent Farm. It is not uploaded to any cloud service and no outside company has access to it. Access is limited to the partners in the business and anyone they specifically authorise. We share footage outside the business only where there is a proper reason to, for example with the police in connection with an investigation, or with our insurers in support of a claim.

How long we keep it. Fourteen days, after which the footage is automatically overwritten. If we need to keep a particular recording for an investigation or a claim, we keep only that recording, and only for as long as it is needed.

Your rights. You can ask for a copy of footage of yourself. Please tell us the date, the approximate time, and what you were wearing, so we can find it. We may need to obscure other people who appear in the same footage before we can release it. See Section 11.

A fuller CCTV policy is available on request using the contact details in Section 1.

8. Where your information is stored, and transfers outside the UK

Enquiries submitted through the contact form are sent to us by email. They are not stored in the website database, so the only copy is the one in our Microsoft 365 mailbox.

CCTV footage never leaves the farm. It is held on a server in the farm office and is not transferred anywhere.

Our website is hosted by DreamHost in a data centre in Amsterdam, in the Netherlands. The Netherlands is covered by the UK’s adequacy regulations for the European Economic Area, which means personal information can be sent there from the UK without additional safeguards. DreamHost is a United States company, and its staff may access data from the United States in order to support the service. For that access, DreamHost applies standard contractual clauses and the UK International Data Transfer Addendum.

Google Analytics collects data from UK visitors through UK and EU based servers, but some data is subsequently processed by Google in the United States. Where personal information is transferred outside the UK, we rely on the UK adequacy regulations for the United States, known as the UK Extension to the EU-US Data Privacy Framework, under which Google LLC is certified, and on the International Data Transfer Addendum to the European Commission’s standard contractual clauses where that framework does not cover a particular transfer. You can ask us for further information about these safeguards using the contact details in Section 1.

9. Security

We take appropriate technical and organisational measures to protect your information. These include serving the entire website over an encrypted HTTPS connection, keeping the website software and its components up to date, restricting access to enquiry data to those who need it, protecting the contact form against automated abuse.

No method of transmission over the internet is completely secure. Please do not send us confidential or sensitive information through the contact form.

10. How long we keep your information

Information

Retention period

Contact form enquiries and our replies

24 months from the date of our last correspondence with you, after which they are deleted, unless the enquiry led to a contract or an order, in which case we keep the relevant records for 6 years to meet accounting and legal obligations

Analytics data in Google Analytics 4

14 months from your last activity, after which Google deletes the user level and event level data. Aggregated reporting totals are retained

Cookie consent records

12 months, after which you will be asked for your cookie preferences again

Web server and security logs

7 days. Our host rotates these logs daily and deletes them after seven days

CCTV footage of the milk vending area

14 days, after which it is automatically overwritten, unless a particular recording is needed for an investigation or an insurance claim

Data protection complaints and our investigation records

3 years from the date the complaint is closed

11. Your rights

Under UK data protection law you have the right to:

  • be informed about how we use your information, which is what this policy is for
  • access a copy of the personal information we hold about you
  • rectification of information that is inaccurate or incomplete
  • erasure of your information in certain circumstances, sometimes called the right to be forgotten
  • restrict processing of your information in certain circumstances
  • object to processing that we carry out on the basis of legitimate interests
  • data portability in certain circumstances
  • withdraw consent at any time where we rely on consent, which for this website means analytics cookies. Withdrawing consent does not affect anything done before you withdrew it

To exercise any of these rights, contact us using the details in Section 1. There is no charge.

We will respond within one month. If we reasonably need you to confirm your identity, or to tell us more about what your request covers, we will ask, and the one month period pauses while we wait for your reply. When you ask for a copy of your information, we will carry out a search that is reasonable and proportionate in the circumstances.

12. How to complain

If you are unhappy with how we have handled your personal information, please tell us first. We would rather put it right ourselves.

How to complain to us: email us at carrie@suttonfeeds.co.uk, or write to us at the address in Section 1. You do not need to use any particular wording or format, and we will treat any expression of dissatisfaction about how we have handled your personal information as a complaint however it reaches us.

What we will do: we will acknowledge your complaint within 30 days of receiving it. We will then look into it without undue delay, keep you updated on progress, and tell you the outcome with an explanation of how we reached it and what, if anything, we have done as a result.

If you are still unhappy: you have the right to complain to the Information Commissioner’s Office, the UK regulator for data protection. You can do that at any time, though the ICO will normally expect you to have raised the matter with us first.

Information Commissioner’s Office

Wycliffe House, Water Lane, Wilmslow, Cheshire SK9 5AF

Helpline: 0303 123 1113

Website: https://ico.org.uk/make-a-complaint/

13. Children

This website is intended for adults. We do not knowingly collect personal information from children under 13 through the website. If you believe a child has provided us with personal information through the contact form, please contact us and we will delete it.

Our CCTV records everyone who enters the milk vending area, including children who visit with a parent or carer. We do not treat that footage any differently from anyone else’s, we do not use it to identify individual children, and it is overwritten after fourteen days like all other footage.

14. Automated decision making

We do not use your personal information to make automated decisions about you, and we do not carry out profiling.

15. Changes to this policy

We may update this policy from time to time, for example if we add a new feature to the website or start using a new service provider. The current version is always available on this page and the date at the top shows when it was last changed. If we make a significant change, such as introducing marketing communications, we will make that clear on the site and, where the law requires it, ask for your consent before the change takes effect.