1. Who We Are
This policy explains how Oakleys Farm Ltd collects, uses and looks after your personal information when you use any of our websites, book tickets, place an order, contact us or sign up to hear from us.
Oakleys Farm Ltd is the controller of your information, which means we decide how it is used and are responsible for keeping it safe. We are a company registered in England and Wales (company number 12595919), with our registered office at Little Blakeley Lane Farm, Dilhorne, Stoke-on-Trent, Staffordshire ST10 2PT.
Our websites, including oakleysfarm.co.uk and staffordshiregardensupplies.co.uk, are part of the Oakleys Farm Group. They share one basket, one checkout and one customer system, so this one policy covers all of them. Each website also has its own cookie information, which lists exactly what that site stores on your device.
If you have any questions about this policy or your information, please contact the business you dealt with:
- Oakleys Farm, including events and tickets: by phone on 01782 550824 or by email at enquiries@oakleysfarm.co.uk.
- Staffordshire Garden Supplies: by phone on 01782 901058 or by email at enquiries@staffordshiregardensupplies.co.uk.
If you are not sure which to contact, use the Oakleys Farm details and we will pass your message on.
2. The Information We Collect
We only collect the information we need, and most of it comes from you directly.
- Contact details: your name, email address, phone number and, for deliveries, your delivery address and any access notes you give us.
- Orders and bookings: what you bought or booked, when and how much you paid, the event, date and session for any tickets, and the version of our terms you accepted at checkout.
- Free event registrations: your name, email address and the number of people in your party.
- Your account: if you create one, your login email, a securely scrambled version of your password that we can never read, your phone number, postcode and saved addresses.
- Payments: a record that you paid, how much and when. Your card details go straight to our payment provider, Stripe, and we never see or store them.
- Messages: anything you send us through a contact, enquiry or brochure form, by email or by phone, and our replies.
- Newsletter sign-ups: your email address and, if you choose to give them, your name, postcode, date of birth, interests and mobile number for text messages, together with your consent and when you gave it. We ask for your date of birth to check you are 16 or over and to send you a birthday treat.
- Phone orders: if you order by phone, the details we need to fulfil it, such as your name, contact details, delivery address and order.
- Ticket scans: when your ticket is scanned on arrival, so it can't be used twice.
- Anything else you choose to tell us: we don't ask for health information, but if you tell us about an allergy or dietary need, for example when booking an event, we use it only to look after you.
- Technical information: your IP address, which our websites pass to our systems when you send a form or use the basket, so we can stop spam and misuse; the IP address and browser used when you sign in to your account, to keep it secure; and standard information that our hosting providers record when you visit (see section 6).
- Website use: which pages are visited, counted without cookies, and more detailed statistics from Google Analytics if you allow them (see section 9).
3. How We Use Your Information
We use your information for the following purposes, each with a legal basis under UK data protection law.
- To take and deliver your order or booking, including sending your confirmation and tickets, arranging delivery and contacting you about it. The legal basis is our contract with you.
- To run your account, so you can sign in, see your orders and manage your details. The legal basis is our contract with you.
- To contact you on the day if something changes, which is why we ask for a phone number with every ticket booking. The legal basis is our contract with you.
- To answer your enquiries and deal with any complaints. The legal basis is our legitimate interest in helping our customers.
- To send you news and offers by email or, in future, text message, only if you have agreed. The legal basis is your consent, which you can withdraw at any time.
- To keep our records and accounts, including for tax and VAT. The legal basis is our legal obligation.
- To stop spam, fraud and misuse of our websites and checkout, including by checking how many requests come from one IP address. The legal basis is our legitimate interest in protecting our business and customers.
- To understand how our websites are used and improve them. Our own page counts use no cookies and are based on our legitimate interest; Google Analytics is used only if you accept it, and the legal basis for that is your consent.
- To deal with any complaint or legal claim, which is why we keep records for the periods in section 10. The legal basis is our legitimate interest in protecting our business.
We don't make decisions about you by automated means alone, and we don't build profiles of you.
4. On the Farm
When you visit an event, we scan your ticket at the entrance to check it is valid. We don't collect any other personal information about you on the day unless you give it to us, for example if you need help or want to tell us something.
Some events on our websites are run or ticketed by other organisations. If you book through another company's ticketing website, that company's privacy policy applies to your booking.
We use CCTV on parts of the farm to keep visitors, staff and animals safe and to prevent crime. Footage is kept only for as long as it is needed for those purposes, unless it is needed to investigate an incident.
5. One Customer Record Across Our Websites
Because our websites share one basket and one checkout, we keep a single customer record for each email address across the whole Oakleys Farm Group. This means your orders and bookings from different sites appear together, and our team can help you whichever site you used.
You sign in to each website separately, and we only use your information for the purposes set out in this policy.
6. Who We Share It With
We never sell your information. We only share it with trusted companies that help us run our business, and only what they need to do their job. Each of them must keep it safe and may not use it for anything else.
- Payments: Stripe, which takes your card payment securely and runs its own fraud checks.
- Delivery: anyone delivering an order on our behalf receives your name, delivery address, phone number and access notes, so they can deliver it and call you beforehand.
- Email: Resend, which sends our confirmations, tickets, account emails and, if you have agreed, our newsletters, and delivers copies of website enquiries to our team's inboxes.
- Hosting and security: Sevalla, which hosts our websites and operations system, and Cloudflare, which protects and speeds up our websites. Both handle your IP address and the pages you request, and keep standard technical logs.
- Analytics: Google Analytics, only if you accept it. We have switched off all of Google's advertising features, so it is never used for adverts or remarketing.
- Maps and videos: some pages show a Google map or a video from YouTube or Vimeo. When these load, those companies receive your IP address and may set their own cookies.
- Professional advisers: such as our accountants, where they need it to do their work.
We may also share information if the law requires it, for example with HMRC or the police.
7. Information Sent Outside the UK
Some of the companies we use, such as Stripe, Google, Resend and Cloudflare, may handle your information outside the UK, including in the United States. Where that happens, we make sure it is protected to UK standards, through the UK's data bridge with the United States or contracts approved by the UK government.
8. Marketing
We will only send you news and offers if you have agreed, for example by signing up on one of our websites or ticking the box at checkout. We keep a record of when and how you agreed.
You can stop at any time by clicking unsubscribe in any email, replying STOP to a text message, or contacting us. Stopping marketing does not affect messages about your orders or bookings, which we still need to send.
9. Cookies and Similar Technology
Cookies are small files saved on your device when you visit a website. Each of our websites lists its own cookies on its cookie information page; this section explains how they work across the group.
- Essential cookies keep your basket and keep you signed in to your account. They are only set when you use those features, are never used for tracking or advertising, and don't need your consent. Our shared checkout and Stripe use their own essential cookies to take your payment securely and prevent fraud.
- Analytics cookies from Google Analytics help us see which pages are read. They are the only optional cookies on our websites. Nothing from Google Analytics loads until you press "Accept analytics", and if you choose "No thanks" the website works exactly the same.
- Your choice is saved on your device for 12 months, after which we ask again. You can change it at any time from "Cookie preferences" at the foot of every page. If you withdraw consent, analytics stops from that point; cookies already set stay on your device until they expire or you clear them in your browser settings.
- Page counts: our websites count page visits without any cookies or identifiers, so we only ever see how many times each page was viewed on each day.
- Your device only: some choices, such as your favourite products, are saved on your own device and never sent to us.
Google maps and videos from YouTube or Vimeo can set their own cookies when they load (see section 6). You can also block or delete cookies in your browser settings, although parts of the websites may not work properly without the essential ones.
10. How Long We Keep It
We keep your information only for as long as we need it.
- Orders, bookings and payments, including the terms you accepted: six years after the end of the tax year they relate to, because the law requires us to keep financial records.
- Your account: for as long as you have it. If you ask us to close it, we delete your account details but keep the order records above.
- Enquiries and brochure requests: six years from our last contact with you, so we have a record if any question about them comes up later. Copies held on our website servers as a backup are deleted after 90 days. You can ask us to delete an enquiry sooner.
- Marketing consent: until you unsubscribe, after which we keep only enough to make sure we don't contact you again.
- Baskets: deleted when they have not been used for 30 days, unless they became an order.
- Sign-ins: you stay signed in for up to 30 days, and the record of each sign-in is deleted 30 days after it ends.
- IP addresses we keep to stop spam and misuse, or with a sign-in, are deleted within 90 days. Our hosting providers keep their technical logs for their own standard periods.
11. How We Keep It Safe
Your information is held on secure servers, sent over encrypted connections, and only available to staff who need it for their work, each with their own login. Passwords are scrambled so that nobody, including us, can read them, and card details are handled only by Stripe.
12. Children
Our tickets and products are bought by adults, and you must be 16 or over to sign up to our newsletter. Tickets for children are booked by the adult bringing them, and we don't ask for children's names.
13. Your Rights
Under UK data protection law, you have the right to:
- ask for a copy of the information we hold about you;
- ask us to correct anything that is wrong or incomplete;
- ask us to delete your information, where we don't need to keep it;
- ask us to limit how we use it, or object to us using it for our legitimate interests;
- ask us to send your information to you or another company in a common format;
- withdraw your consent to marketing or analytics cookies at any time.
To use any of these rights, contact the business you dealt with, using the details in section 1. We will reply within one month, and there is normally no charge.
14. Complaints
If you are unhappy with how we have handled your information, please contact us first so we can try to put it right. You also have the right to complain to the Information Commissioner's Office, the UK's data protection regulator, at ico.org.uk or on 0303 123 1113.
15. Changes to This Policy
We may update this policy from time to time, for example when we add a new service. The latest version is always on our websites, with the date it was last updated, and we will tell you about any important changes.
The policy above is Oakley's Farm Group's, and it covers Staffordshire Garden Supplies: our contact details, what we collect when you contact us, sign up, create an account or order, how long it's kept, and your rights. This part covers only what the Staffordshire Garden Supplies website itself does.
You can browse the whole site without telling us who you are. Like almost every website, the servers that host it keep standard logs of each request (your IP address, the page asked for, your browser type and the time) for security and to keep the site running. Product photos are delivered from the group's own systems, so your browser fetches them from there and those servers see the same kind of request information. We rely on our legitimate interest in running and protecting the website.
How cookies work, and your choices about them, are explained in the group policy above. These are the cookies this website sets, and what it saves in your browser.
Analytics is off until you accept it on the cookie banner, and you can change your choice at any time with the Cookie preferences button at the foot of every page.
When you check out, you move to our secure shared checkout on oakleysfarm.co.uk, which uses its own essential cookies to take your payment.
Some of these providers process information outside the UK. Where they do, it's protected by the safeguards UK data protection law requires, such as adequacy regulations or approved contract terms.
We'll update this part when the website starts collecting or sharing anything new; the date at the top of this part shows when it was last revised. The group policy above updates whenever the group changes it in its own system, and shows its own date.
