Grosvenor Food & AgTech (formerly Wheatsheaf Group Limited) respects your privacy and is committed to protecting your personal data. This Confidentiality and Data Protection Policy (also referred to in this document as our “privacy policy”) will inform you as to how we look after your personal data that you or a third party have provided to us including, when you visit our website (regardless of where you visit it from) and tell you about your privacy rights and how the law protects you. This privacy policy does not create any contractual rights and obligations and it may be amended by us at any time. There may also be circumstances where we provide you from time to time with a separate privacy notice or other communication applicable to you which may clarify, update, add to or change the information set out in this policy. For example, where you are an employee of ours, you should also refer to separate information provided to you which will set out the processing we undertake in relation to your employment.
Wheatsheaf Group Limited is a data controller for the purposes of the Data Protection Act 1998 and the EU General Data Protection Regulation. In this privacy policy references to “we, “our” and “us” refer to Wheatsheaf Group Limited. In this privacy policy we explain how we collect and use your personal information.
Details of how to contact us if you have any questions about privacy or data protection can be found below in the Contact Details section, below.
We must have a lawful basis to process your personal data, and this policy explains what our lawful basis is in respect of each purpose for which we keep and use information about you. Generally, we are allowed to process your personal data where it is necessary in connection with a contract between us (such as a contract for you to supply us with products or services), where it is necessary in order for us to comply with our legal obligations, or where we have a legitimate interest to do so (but we will always consider whether your right to privacy overrides our interest).
Please note that links from our website may take you to external websites which are not covered by this policy. We recommend that you check their privacy policies before submitting any personal information to such sites. We will not be responsible for the content, function or information collection policies of these external websites.
We process your data when you visit our website. We will only use your data for the purposes outlined below.
We may require you to provide certain personal information to us where necessary. If you fail to provide certain information when requested, we may not be able to offer you a specific service or perform the contract with you.
We may receive personal information about you whenever you contact us. For example, by doing the following:
• enquiring about our businesses, services, activities or events;
• signing up for the provision by us of any information;
• using and browsing our website;
• telephoning, texting, writing by post or emailing us;
• enquiring about, or applying for, job vacancies;
• providing us with information relating to an investment opportunity or potential business opportunity.
We may collect additional personal information as required.
Information you provide to us
We may collect and use the following information about you:
• normal identification information, such as your full name, date of birth, age, gender;
• contact information, such as your postal address, email address and telephone number;
• information about your employment, including your employment status, salary, job title, the organisation for whom you work;
• a copy of your identification documents (driving licence or passport for example)
• additional information relevant to your use of our site and services, such as your marketing preferences, survey responses and feedback;
• records of your interactions with us such as telephone conversations, emails and other correspondence and your instructions to us;
• financial information, such as your bank account details;
• records of your attendance at any events hosted by us;
• images in video and/or photographic form and voice recordings;
• information relating to investment or business opportunities;
• in respect of job applications, your CV including details of your education and employment history (and any other information which you may choose to provide to us with your CV and any accompanying letter).
Information we collect about you on our website
You are not required (by law or by any contract with us) to provide personal information to us via this website. We will only require you to provide personal information to us where it is necessary for us to provide you with a service at your request.
We collect information using cookies and other similar technologies to help distinguish you from other users of our website. These can streamline your online experience by saving you from re-inputting some information and also allow us to make improvements to our website. For more information about how and why we use cookies, please take a look at the relevant information on our website.
When you visit our website we may collect the following information:
• which pages you view and which links you follow;
• your IP address and general location;
• details of the hardware and software that you are using to access the site;
• a device identifier (cookie or IP address) for fraud prevention;
• details of your visits to our website and the resources that you access, including, but not limited to, traffic data, location data, weblogs and other communication data.
Information we collect about you from other sources
We may collect information about you from other sources. This may include the following:
• publicly available information, from sources such as Companies House and the Electoral Roll;
• information you have shared publicly, including on social media (particularly in respect of job applications);
• Security activities, including CCTV and automatic number plate recognition;
• if you apply for a job, work experience or an internship, we may collect information about your criminal record by obtaining a DBS check through an approved agency;
• information to determine whether you are VAT registered;
• information from third party databases or data suppliers, such as credit reference agencies, including details about your home.
This list is not exhaustive and, in specific instances, we may need to collect additional data for the purposes set out in this policy.
Information we receive about you from other sources
Sometimes you will have given your consent for other websites, services or third parties to provide information to us.
This could include information we receive about you if you use any of the other websites that we operate or the other services that we provide, in which case we will have informed you when we collected that data if we intend to share that data internally and combine it with data collected on this site. We will also have told you for what purpose we will share and combine your data.
It could also include information from third parties that we work with to provide our services, such as payment processors, external advisors, technical support companies and advertising companies. Whenever we receive information about you from these third parties, we will let you know what information we have received and how and why we intend to use it.
We take data protection law seriously, so below we have set out exactly how and why we use your information, and what our legal basis is to be able to use your information in each way.
Supplying services
It is necessary for us to use personal information about you to enter into and perform any contracts that we make with you. Using your information in this context is necessary so that we can:
• provide you with information relevant to the contract (if any) or any potential contract;
• undertake due diligence to facilitate the making of any investment decisions;
• to contact you for the purpose of potential investments;
• to carry out our obligations arising from any contract that we have with you;
• provide you with information about our services, businesses, activities and events;
• to enable you to provide goods and or services to us;
• verify your identity;
• deal with any complaints you may have;
• comply with our health and safety obligations;
• contact you about any changes that we make to our business, services, activities, events or organisation;
• administer our website, including responding to troubleshooting problems, analysing statistics, conducting research and tests and keeping the site secure;
• to determine whether you are to be offered a job and/or to determine if there is a suitable job for you to apply for.
Telling you about services that we think may be of interest to you
We may use your information to identify and tell you about events and our businesses, activities or services that we think may be of interest to you. We will only do this where you have informed us that you would like to receive marketing communications.
Whether you choose to receive marketing communications is entirely up to you. You can choose not to receive them.
Telling you about our services, activities and events
If you have already contacted us about any of our services or attending or participating in a Wheatsheaf event, we may contact you with some information about services and events that are similar.
You can choose not to receive these messages at any time. Simply follow the instructions in the message, or get in touch using our website.
Making our organisation better
Sometimes we may use your information to find ways that we can improve what we do.
In this context, we will only use your information where it is necessary so that we can:
• review and improve our existing services and businesses;
• review and improve the performance of our systems, processes and staff (including training);
• improve our site to ensure that content is presented in the most effective manner for you and for your computer;
• measure and understand the effectiveness of any information or advertising we may present to you and others, and to deliver relevant information or advertising to you.
Contacting you
We want to stay in touch with you. Sometimes we may need to use the information that we have about you in order to respond to your questions or let you know about important changes.
We will only use your information in this respect where it is necessary so that we can:
• interact and respond to any communications you send us, including where you use the Contact Us section, and any social media posts that you tag us in;
• let you know about any important changes to our business or policies.
Verifying your identity
We may use your information where it is necessary for us to do so in order to meet our legal obligations or to detect and prevent fraud, money-laundering and other crimes.
Protecting you and others from harm
We may use your information where it is necessary to protect your interests, or the interests of others. This may include in the event of criminality such as identity theft, piracy or fraud.
We need all the categories of information listed above to allow us:
(i) to provide our services to you or perform a contract with you (if any);
(ii) to enable us to comply with legal obligations; and
(iii) to pursue legitimate interests of our own or those of third parties (provided your interests and fundamental rights do not override those interests).
The situations in which we will process your personal data are listed set out in the table below and indicate the purpose or purposes for which we are processing or will process your personal information.
| Perform Our Contract With You (if any) | Comply With Legal Obligations | Pursue Legitimate Interests |
Verifying your identity | x | x | x |
Making a decision to supply any services | x |
| x |
Administering the contract we have entered into with you | x |
|
|
Dealing with any complaints you may have | x |
| x |
Logistics management and planning, including accounting and auditing |
| x | x |
Making arrangements for the termination of any contract | x |
| x |
Security activities to prevent unauthorised access to our premises including CCTV and automatic number plate recognition |
|
| x |
Making alterations and improvements to any services supplied | x | x | x |
Dealing with legal disputes involving you |
| x | x |
Complying with health and safety obligations including CCTV and automatic number plate recognition | x | x | x |
To detect and prevent fraud, money-laundering and other crimes |
| x | x |
To review and improve the performance of our systems, processes and staff (including training) |
|
| x |
To interact and respond to any communications you send us, including social media posts that you tag us in |
|
| x |
To let you know about any important changes to our business or policies |
|
| x |
To ensure that the information that we hold about you is accurate and up to date |
| x | x |
To protect your interests, or the interests of others (such as in the event of criminality such as identity theft, piracy or fraud) |
| x | x |
Change of purpose
We will only use your personal information for the purposes for which we collected it, unless we reasonably consider that we need to use it for another reason and that reason is compatible with the original purpose. If we need to use your personal information for an unrelated purpose we will notify you and we will explain the legal basis which allows us to do so.
Please note that we may process your personal information without your knowledge or consent, in compliance with the above rules, where this is required or permitted by law.
Sharing your information within Wheatsheaf
We share the information that you provide to us with our staff so that we can provide any relevant services to you, including responding to any enquiries you may have raised.
We may share the information that you provide to us with other organisations related to Wheatsheaf in the Grosvenor Estate. These include any shareholder in or subsidiary company of Wheatsheaf Group Limited which we may consult, for example in relation to the consideration of a potential business opportunity.
Sharing your information with third parties
We may share your data with selected third parties. For example, we may share your information with:
• internet hosting providers to host the website, related infrastructure, services and applications;
• relevant companies outside the Wheatsheaf Group of companies where a relevant business opportunity is being considered;
• providers to manage accounting, operation, payroll and payments, or to record your performance or store your medical information;
• providers to manage our CCTV and automatic number plate recognition equipment.
There are certain exceptional circumstances in which we may disclose your information to third parties. This would be where we believe that the disclosure is:
• required by the law, or in order to comply with judicial proceedings, court orders or legal or regulatory proceedings;
• necessary to protect the safety of our employees, our property or the public;
• necessary for the prevention or detection of crime, including exchanging information with other companies or organisations for the purposes of fraud protection and credit risk reduction;
• proportionate as part of a merger, business or asset sale or investment, or potential merger, business or asset sale or investment, in the event that this happens we will share your information with the seller, buyer or investor or prospective seller, buyer or investor.
Your details may be held in our accounting systems provided by Xero (UK) Limited, Ocrex Limited and/or ApprovalMax. We may allow our providers to access your personal information where it is necessary in order for them to provide us a service. This may include processing invoices, resolving technical problems and dealing with support issues.
Your details may be held in a customer relationship management system, operated by Salesforce held in both the European Union (EU) and the USA. Some information will therefore be transferred outside the European Economic Area (EEA). The sharing of this information is necessary in order for us to provide our services to you or perform a contract with you. The European Commission has decided that the USA ensures an adequate level of protection of personal information as a result of the EU-U.S. Privacy Shield. For more information on the EU-U.S. Privacy Shield, please see the guidance issued by the European Commission.
We require all third parties to respect the security of your personal data and to treat it in accordance with the law. We do not allow our third-party service providers to use your personal data for their own purposes and only permit them to process your personal data for specified purposes and in accordance with our instructions.
We will only store your personal information for as long as we need it for the purposes for which it was collected. Where we provide you with any service, we will retain any information you provide to us at least for as long as we continue to provide that service to you.
If you apply for a job vacancy (or otherwise send us your CV) and your application does not result in your taking employment with us we will retain your CV (and any publicly available information, for example from social media) for a period of 6 months unless we notify you to the contrary by way of separate communication. If we are considering you for a particular role, we may retain this information for longer than that period.
In other circumstances, we will keep all physical and electronic records of your information for a period of 6 years after your last contact with us.
Exceptions to this rule are:
• Where you receive or have received a separate privacy notice or other communication from us which gives any contrary indication.
• Information that may be relevant to personal injury claims, or discrimination claims may be retained until the limitation period for those types of claims has expired. For personal injury or discrimination claims this can be an extended period as the limitation period might not start to run until a long time after you have worked for us.
• We may keep certain limited information about you for our historical records, on the basis that there is a public interest in doing so.
We will take all steps reasonably necessary to ensure that your data (whether electronic or paper copy) is treated securely and in accordance with this policy.
We try to ensure that all information you provide to us via our website is transferred securely. Unfortunately, the transmission of information via the internet is not completely secure. Although we will do our best to protect your personal data, we cannot guarantee the security of your data transmitted to our site; any transmission is at your own risk. Once we have received your information, we will use strict procedures and security features to try to prevent unauthorised access.
All information you provide to us is stored securely in a physically secure environment, on our secure servers, and/or on third party secure servers in relation to our customer relationship management system.
You have the right to be informed
We have a legal obligation to provide you with concise, transparent, intelligible and easily accessible information about your personal information and our use of it. We have written this policy to do just that, but if you have any questions or require more specific information, you can get in touch using Contact Us section of the website.
You have the right to access your personal data
You have the right to ask us to confirm whether or not we hold any of your personal information. If we do, you have the right to have a copy of your information and to be informed of the following:
• why we have been using your information;
• what categories of information we were using;
• who we have shared the information with;
• how long we envisage holding your information.
In order to maintain the security of your information, we will have to verify your identity before we provide you with a copy of the information we hold.
The first copy of your information that you request from us will be provided free of charge, if you require further copies we may charge an administrative fee to cover our costs.
You have the right to correct any inaccurate or incomplete personal data
Where you have requested a copy of the information we hold about you, you may notice that there are inaccuracies in the records, or that certain parts are incomplete. If this is the case you can contact us so that we can correct our records.
You have the right to be forgotten
There may be times where it is no longer necessary for us to hold personal information about you. This could be if:
• the information is no longer needed for the original purpose that we collected it for;
• you withdraw your consent for us to use the information (and we have no other legal reason to keep using it);
• you object to us using your information and we have no overriding reason to keep using it;
• we have used your information unlawfully;
• we are subject to a legal requirement to delete your information.
In those situations you have the right to have your personal data deleted. If you believe one of these situations applies to you, please get in touch using our website.
You have the right in certain circumstances to have a copy of your data transferred to you or a third party in a compatible format
Also known as data portability, you have the right to obtain a copy of your personal data for your own purposes. This right allows you to move, copy or transfer your personal data more easily from one IT system to another, in a safe and secure way.
If you would like us to transfer a copy of your data to you or another organisation in a structured, commonly use and machine-readable format, please contact us. There is no charge for you exercising this right.
You have the right to object to direct marketing
You can tell us at any time that you would prefer that we do not use your information for direct marketing purposes. If you would not like to receive any direct marketing from us, please contact us or use the links provided in any of our marketing communications, and we will stop sending direct marketing immediately.
You have the right to object to us using your information in certain circumstances
Sometimes, we use your personal information to pursue our own legitimate interests, or those of third parties. Examples may include:
• when we tell you about services, businesses, activities or events that are similar to ones that you have already engaged with or attended;
• when we use your information to help us make our business better;
• when we contact you to interact, communicate or let you know about changes we are making.
We aim to always ensure that your rights and information are properly protected. Where we say we are using your data to pursue our own legitimate interests or those of third parties, or for the performance of the task carried out in the public interest and you believe that such use is not justified due to its impact on you or your rights, you have the right to object. Unless we have a compelling reason to continue, we must stop using your personal data for these purposes.
In order to exercise your right to object to our use of your data for the purposes above, please contact us.
You have the right in certain circumstances to restrict how we use your personal data
You have the right to ask us to stop using your personal data in any way other than simply keeping a copy of it.
This right is available where:
• you have informed us that the information we hold about you is inaccurate, and we have not yet been able to verify this;
• you have objected to us using your information for our own legitimate interests or for those of third parties, or for the performance of a task carried out in the public interest and we are in the process of considering your objection;
• we have used your information in an unlawful way, but you do not want us to delete your data;
• we no longer need to use the information, but you need it for a legal claim.
If you believe any of these situations apply, please contact us.
You have rights related to automated-decision making and profiling
Any automated decision-making or profiling we undertake is solely for the purpose of tailoring the information which we provide to you. We will not use automated decision-making or profiling to make any decisions which will have a legal effect upon you or otherwise significantly affect you, and you have the right not to be subject to such decisions. If you have any concerns or questions about this right, please contact us.
Any changes we make to our privacy policy in the future will be posted on this page and, where appropriate, notified to you by email. Please check back frequently to see any updates or changes to our Privacy Policy. This privacy policy was last updated on 24 May 2018. Historic versions can be obtained by contacting us.
If you wish to make a complaint about our collection or use of your personal data, please contact us in the first instance so that we may seek to resolve your complaint.
You have the right to lodge a complaint with the Information Commissioner’s Office (ICO), the statutory body which oversees data protection law in the UK. Please visit the ICO website if you wish to lodge a complaint with the ICO.
Our Data Protection Co-ordinator can be contacted using the details below.
In the event of any query or complaint in connection with the information we hold about you, please email data.protectionWGL@Grosvenor.com or write to our Data Protection Co-ordinator at Wheatsheaf Group Limited, The Quarry Hill Road, Eccleston, Chester, United Kingdom, CH4 9HQ.