Privacy Policy

Who we are

This Privacy Policy explains how Fanfruit Ltd. ("Fanfruit", "we", "us") collects, uses and protects personal data when you use this website, our online order portal, or contact us. We are the data controller for that personal data.

Fanfruit Ltd., Charleville, Dunleer, Co. Louth, Ireland, A92 VA00.[Registered company name and CRO number to confirm]

For any privacy question or request, email info@fanfruit.ie, call +353 41 685 1757, or write to us at the address above.

We supply customers in both the Republic of Ireland and Northern Ireland, so we handle personal data in line with the EU General Data Protection Regulation (GDPR) and Irish data protection law, and with the UK GDPR, the UK Data Protection Act 2018 and the Privacy and Electronic Communications Regulations (PECR).

[UK representative (Article 27 UK GDPR) details to confirm, or confirm not required]

What we collect

• Website enquiries - your name, company, email address, phone number and message when you use our contact form. The form opens your own email app, so your enquiry reaches us as an email.
• Order portal accounts - your name, email address, phone number, business name, delivery addresses, sign-in details (your password is stored only in encrypted, hashed form by our authentication provider), and your order history, including recurring orders.
• Business correspondence - emails, calls and other contact with you as a customer or supplier contact, and the records needed to supply, invoice and account for orders.
• Cookie preferences - the choice you make in our cookie banner, stored in your browser.
• Usage data - only if you consent to analytics cookies, information about how you use the site, such as pages viewed, device and browser type, and approximate location derived from your IP address. No analytics or advertising tools collect data unless you have opted in.

Why we use it, and our lawful basis

• To run your order portal account and supply your orders - creating and managing your account, taking and delivering orders, and contacting you about them. Lawful basis: performance of a contract with you or your business, or steps you ask us to take before entering into one.
• To respond to enquiries and keep in touch with business customers - replying to your message, typically within 1 working day, and dealing with the business you represent. Lawful basis: our legitimate interests in running and growing a wholesale business and responding to people who contact us.
• To keep accounting and tax records - invoices, orders and related records. Lawful basis: legal obligation (Irish Revenue and, where relevant, UK HMRC requirements).
• Analytics and marketing cookies - to understand how the site is used and to measure our advertising. Lawful basis: your consent, which you can withdraw at any time.
• Necessary storage - remembering your cookie choice and keeping you signed in to the order portal. This is strictly necessary to provide the service you ask for, so it does not need consent.

We do not sell your personal data, and we do not share it with third parties for their own marketing. We do not make decisions about you based solely on automated processing.

Who we share it with

We use a small number of service providers (processors) who handle personal data on our behalf and only on our instructions:

• Supabase - database and sign-in (authentication) for the order portal.
• Vercel - hosting for this website, which involves processing technical data such as IP addresses in server logs.
• Google - only if you consent to analytics or marketing cookies, and only once those tools are installed on the site (for example Google Tag Manager, Google Analytics and Google Ads).
• Google reCAPTCHA - on the order portal sign-up and password reset forms, to check that a person (not an automated program) is using the form and to protect accounts from abuse. Google receives technical information such as your IP address and how you interact with the check. See Google's Privacy Policy and Terms of Service.
• Mailgun - sending order and account emails from the order portal.
• Our email and IT providers - to receive and store emails you send us.

We may also share data with our professional advisers (such as accountants), and with authorities where the law requires it.

International transfers

Some of our service providers may process personal data outside the UK and the European Economic Area (EEA). Where that happens, the transfer is covered by appropriate safeguards, such as an adequacy decision, the European Commission's Standard Contractual Clauses, or the UK International Data Transfer Agreement or Addendum. You can contact us for more information about these safeguards.

How long we keep it

• Orders, invoices and business records - generally around 6 years from the end of the relevant financial year, in line with Irish Revenue and UK HMRC record-keeping requirements.
• Order portal accounts - for as long as your account is open. If you delete your account, your personal details are removed, and order records are kept in anonymised form for the retention period above.
• Enquiries - for as long as reasonably needed to deal with your enquiry and any follow-up, and then deleted, unless you become a customer.
• Cookie preferences - for 12 months, after which we ask you again.

Cookies and similar storage

We only use non-essential cookies with your consent. You can accept, reject, or customise your choice, and change it at any time. Rejecting optional cookies is as easy as accepting them and does not affect your use of the site.

Google Analytics and Google Ads cookies are only set if you consent to that category, and only once those tools are installed on the site. Until you choose, Google tags (if installed) run in a restricted mode that does not set analytics or advertising cookies.

Your rights

Under the GDPR and the UK GDPR, you have the right to:

• Access the personal data we hold about you
• Ask us to correct inaccurate or incomplete data
• Ask us to erase your data, where applicable
• Ask us to restrict how we use your data
• Object to processing based on our legitimate interests, and to direct marketing at any time
• Receive a copy of data you gave us in a portable format, where applicable
• Withdraw consent at any time, for example through Cookie Settings, without affecting earlier processing

Order portal users can delete their own account at any time from the Account page in the portal. Order records are kept in anonymised form for the retention period described above.

To exercise any of these rights, contact us at info@fanfruit.ie. We will respond within one month, and may need to confirm your identity first.

Complaints

If you are unhappy with how we handle your data, please contact us first so we can try to put it right. You also have the right to complain to a supervisory authority:

• Republic of Ireland: the Data Protection Commission, dataprotection.ie
• United Kingdom, including Northern Ireland: the Information Commissioner's Office, ico.org.uk

Changes to this policy

We may update this policy from time to time. The date at the top of this page shows when it was last revised. If we make significant changes, for example to the cookies we use, we will ask for your cookie choice again.