Last updated: 8 November 2026

This policy explains how Heathylee House Farm (Roy Critchlow, trading as Heathylee House Farm) collects and uses your personal information when you visit heathylee.co.uk, buy from our shop or get in touch. We follow the UK General Data Protection Regulation (UK GDPR), the Data Protection Act 2018 and the Privacy and Electronic Communications Regulations (PECR).

Who we are

Roy Critchlow, trading as Heathylee House Farm, is the data controller for your information. You can contact us about anything in this policy by emailing karen@heathylee.co.uk, phoning 01298 83659 or writing to Heathylee House Farm, Hollinsclough, Buxton SK17 0RD.

What we collect and why

When you place an order

Your name, delivery and billing address, email address, phone number (if you give it), what you ordered and any order notes. We use this to process, deliver and support your order, and to keep the records we need for tax and accounting. Lawful basis: to perform our contract with you, and to meet our legal obligations.

Payments

Card, Apple Pay, Google Pay and Link payments are handled securely by Stripe. Your full card details go directly to Stripe and are never seen or stored by us. We receive confirmation of payment and limited details such as the card type and last four digits. Stripe also uses information about your device to help prevent fraud. Lawful basis: contract and our legitimate interest in preventing fraud.

If you create an account

If you choose to create an account, we store your login details, saved addresses and order history so you can track orders and check out faster. You can ask us to delete your account at any time.

When you contact us

If you use our contact form or email us, we receive your name, email address, phone number (if given), the topic and your message. We use this only to reply and deal with your enquiry. Lawful basis: our legitimate interest in answering your questions, or taking steps at your request before an order.

When you browse the site

Like most websites, our hosting provider records technical information such as your IP address, browser type and the pages you visit, to keep the site secure and working. Our shop also records how you arrived at the site (for example, from a search engine or another website) so we can understand which links bring customers to us. Lawful basis: our legitimate interests in running a secure website and understanding our customers.

We do not sell your information, use it for automated decision-making or send you marketing emails unless you have asked us to.

Who we share it with

We only share your information with trusted companies that help us run the farm shop, and only as much as they need:

Stripe – payment processing and fraud prevention.
Delivery services such as Royal Mail – your name and address so they can deliver your order.
Our website and email hosting provider – which stores the website and our emails on servers in the UK.
Google – our pages use Google Fonts, and the map on our Contact page is provided by Google Maps. When these load, Google receives your IP address.
Our accountant and HMRC – where needed for tax and legal purposes.

Some of these providers (such as Stripe and Google) may process information outside the UK. Where they do, they use legal safeguards approved under UK law, such as UK adequacy regulations or the International Data Transfer Agreement.

How long we keep it

Order and payment records: 6 years after the end of the financial year, as required by HMRC.
Contact form messages and emails: up to 2 years, unless they relate to an order.
Customer accounts: until you ask us to delete your account.
Server logs: kept by our host for a short period for security purposes.

Cookies

Cookies are small files stored on your device. We use:

Essential shop cookies (WooCommerce, for example woocommerce_cart_hash, woocommerce_items_in_cart and wp_woocommerce_session_) – remember what is in your basket and keep checkout working. These are strictly necessary.
Payment security cookies (Stripe, __stripe_mid and __stripe_sid) – help prevent fraud during payment.
Order source cookies (WooCommerce order attribution, names starting sbjs_) – record how you found our site so this can be attached to an order.
Google Maps – the embedded map on our Contact page may set Google cookies.

We do not use advertising cookies. You can block or delete cookies in your browser settings, but the basket and checkout will not work without the essential ones.

Your rights

Under UK data protection law you have the right to:

ask for a copy of the personal information we hold about you;
ask us to correct information that is wrong or incomplete;
ask us to delete your information (we may need to keep order records for legal reasons);
ask us to restrict or stop using your information, or object to how we use it;
ask for your information in a portable format;
withdraw your consent at any time, where we rely on consent.

To use any of these rights, email karen@heathylee.co.uk. There is no charge, and we will respond within one month.

Making a complaint

If you are unhappy with how we have handled your information, please contact us first so we can put it right. You also have the right to complain to the Information Commissioner’s Office (ICO), the UK data protection regulator: ico.org.uk/make-a-complaint or 0303 123 1113.

Changes to this policy

We may update this policy from time to time. The date at the top shows when it was last changed.

Privacy Policy