Bressingham will only collect personal information when we need it. The type of information we need from you will relate purely to contact information allowing us to communicate with you. When we ask you for information, we will make it clear why we need it. We only collect personal information when you complete forms on this website, either when you wish to sign up to our newsletter, purchase anything from us or send us a comment.

Purchasing merchandise from us:

• we will need your name, email address and postal address and phone number
• it is in our legitimate interests for us to store and use this information as the basis of ongoing communication with you in order to arrange details of a proposed sale.

Sending us a comment:

• we will need your name and email address.
• we will use this information only if we need to reply to your comment.

Receive email updates / newsletters:

• we will need your name and email address.
• we need your consent to be added to our emailing lists.

we will use this information to provide you with emails and newsletters relevant to Bressingham and its shops and services

We never share personal information with any other organisation for third-party marketing purposes.

Sometimes we will need to share personal information we hold about you with other organisations that we work with or who provide services on our behalf. When sharing information we will comply with all aspects of current data protection law. All our data sharing relationships are governed by contracts which include strict data sharing and confidentiality protocols.

Where ‘sharing’ is in our ‘legitimate business interests’, we may share your information without seeking your consent first. This may be with:

• Police, HMRC and other relevant authorities.

We may also share information when required by law for example where ordered by the Court or to protect an individual from immediate harm.

We only hold records during the period of our relationship and for a set period afterwards to allow us to meet our legal obligations, including resolving any follow-up issues between us.

Please contact us if you would like any more information.

We will apply appropriate technical and organisational measures to ensure your personal information is secure.  For example, we have systems in place to ensure that access to personal information is restricted to authorised individuals on a strictly need-to-know basis.

To help us ensure confidentiality of your personal information we may ask you (and any of your representatives) security questions to confirm your identity when you call us and as may be necessary when we call you. We will not discuss your personal information with anyone other than you, unless you have given us prior written authorisation to do so or where we have received a clear verbal instruction from you (as a one-off circumstance).

We are committed to upholding your rights in respect of your personal data.

The right to be informed

Through the provision of this and other privacy notices on the website, we will be open and transparent about how and why we use your personal information.

The right of access

You have a right to ask us what personal information we hold about you and to request a copy of your information. This is known as a ‘subject access request’ (SAR).

SARs need to be made in writing and we ask that your written request is accompanied by proof of your address and identity.

If you are seeking to obtain specific information (e.g. about a particular matter or from a particular time period), it helps if you clarify the details of what you would like to receive in your written request.

If someone is requesting information on your behalf they will need written confirmation from you to evidence your consent for us to release this and proof of ID (both yours and theirs).

We have 30 calendar days within which to provide you with the information you’ve asked for (although we will try to provide this to you as promptly as possible).

The right to rectification

You can ask us to rectify your personal data if it is inaccurate or incomplete. Please help us to keep our records accurate by keeping us informed if your details change.

The right to erasure

The right to erasure is also known as ‘the right to be forgotten’. In some circumstances, you can ask us to delete or remove personal data where there is no compelling reason for its continued processing.  This is not an absolute right, and we will need to consider the circumstances of any such request and balance this against our need to continue processing the data.  Our response will also be guided by the provisions of our retention schedule.

The right to object

You can tell us you object to us processing your data to provide update emails.

You can specifically opt-out of update emails at any time by following the link at the bottom of each email.