Zebedees Privacy Notice
This Notice explains the ways in which we collect personal information about people who visit our website, or use our catering services. It includes information on how we use your data, the conditions under which we may disclose it to others, and how we keep it secure.
We regularly review this Notice and update it as necessary, so please check this page from time to time to ensure that you are aware of any changes that may affect you.
This privacy notice covers
Who we are
The type of information we collect and how obtain it
How we use your information
Sensitive data – special diets and allergens
Third party access to your information
Links to other websites
How we protect your information
Your rights and your personal data
Requests for data
How to update your information
Review of this notice
We’re Zebedee’s Lunch Box Limited, trading as Zebedees, the UK’s leading nursery meals provider. Zebedee’s Lunch Box Limited, is a private Limited Company registered in England and Wales (no. 08026117). The registered address is Unit 6 Stonecross Business Centre, Lewes Road, Laughton, East Sussex, BN8 6BN. Zebedee’s Lunch Box Limited comprises of Zebedees and its trading subsidiaries.
For the purposes of the General Data Protection Regulation, Zebedee’s Lunch Box Limited is the ‘data controller’, and decides the purposes for, and the way in which, any personal data is processed. Any questions regarding this Notice and our privacy practices should be sent by email to firstname.lastname@example.org or by writing to us at the address above.
We obtain information from you when you communicate with us for any reason. This could be by email, telephone, or post. We also collect information about you when you use our website. The personal information we collect might include your name, telephone number, email address, IP address, and information regarding pages visited and when.
This information may be collected directly from you, if you fill out one of the forms on our website, or indirectly through the use of ‘cookies’ and Google Analytics. More information… Cookies are text files put on your computer to collect standard internet log information and visitor behaviour information. This information is then used to track visitor use of the website and to create statistical reports on website activity.
We use Google Analytics to store information about how visitors use our website so that we may make improvements and give visitors a better user experience.
We use the information submitted by you via our website, so that we can process your enquiry and/or send you our regular newsletter, if you have requested this. If you are a childcare business or school, we may also use this information to send you details about our services, which we think may be of interest to you.
If, at any point, you decide that you do not wish to receive marketing communications from us, you can opt out by emailing us at email@example.com
If you are a Client of Zebedees, we may also use your information for the following purposes:
- process orders that you have submitted;
- process invoices for orders submitted;
- carry out our obligations arising from any contracts entered into by you and us;
- seek your views or comments on the services we provide;
- notify you of changes to our services;
- send you communications which you have requested;
- send you information regarding our services, which we think may be of interest to you.
Our lawful basis for processing personal details in the course of providing our services will be ‘legitimate interests’. We will only ever process your details for our legitimate business interests. These include, providing information requested, marketing, communicating with individuals as necessary in order to provide our service, credit control purposes and providing client support. We will only ever process personal information where doing so does not outweigh the rights and freedoms of the individual.
As part of our service we may provide cookery sessions or other similar educational events at the childcare settings and schools that we cater for. We may take photographs during these activities, as part of promoting the event and our business across our social media platforms. Some of these photographs may contain images of children who have taken part in the activity. We will always seek parental permission to the publication of such images, via the nursery or school. Such photographs may also be shared with the child’s nursery or school for their own promotional purposes.
This section relates to requests from nurseries or schools for the provision of special dietary meals (e.g. gluten free, dairy free etc.) for specific children. Wherever possible, and in most cases, we are able to provide dietary meals without the need to process any personal data relating to those children. However, in some cases, where the dietary needs are complex, it will be necessary for us hold further information on a child, such as their name, allergies to certain food items, and related health conditions e.g. asthma, eczema. When this type of information is collected, it is used only for the specific purpose of providing a suitable meal for that particular child, when at nursery or school. In these circumstances, we require explicit consent from a person with parental responsibility for the child, to us processing this data. If you have a child within your setting who requires a ‘named meal’, please email firstname.lastname@example.org, to request the relevant form.
We may pass your information to our third party service providers for purposes such as securely storing your information within our Customer Relationship and Account Management systems, or sending you email notifications directly from our business, relating only to our services. Our contracts with these third parties require them to maintain the confidentiality of the Personal Information we provide to them, only act on our behalf and under our instructions, and not use Personal Information for purposes other than the product or service they're providing to us or on our behalf.
We will not sell or rent your information to third parties, nor will we share your information with third parties for marketing purposes.
We may share your details where we are required to do so by law, or to defend our legal rights e.g.in connection with legal proceedings, fraud prevention, reducing credit risk etc.
We will always update our Privacy Notice if we need to add additional third party categories.
Our website may contain links to other websites run by other organisations. This privacy notice applies only to our website. We are not responsible for the privacy policies and practices of any other sites even if you access them using links from our website, or have accessed our website via a third party site.
We comply with our obligations under the GDPR in the following ways:
- By keeping personal data up to date;
- By storing and destroying personal data securely;
- By not collecting or retaining excessive amounts of data;
- By protecting personal data from loss, misuse, unauthorised access and disclosure and by ensuring that appropriate technical measures are in place to protect personal data;
We will only retain your information for as long as is necessary to carry out the relevant activity, or if you are a Client, for the duration of your contract. We may need to retain some records for longer to fulfil our obligations under other applicable legislation e.g. financial or taxation, in some cases for up to 6 years. Details we hold for marketing purposes are kept for one year from the last action. You can opt out from receiving marketing communications from us at any time, by emailing email@example.com
Any photographs containing images of children or nursery/school staff taken during an event or activity run by Zebedees, will be deleted from the device’s photo gallery immediately after upload to our social media sites. Any unused photos will also be deleted at this time.
You have the following rights with respect to your personal data:
- The right to request a copy of the personal data which we hold about you (Subject Access Request). If you would like to submit a Subject Access Request, please email us at firstname.lastname@example.org. We will respond to your request within one month of receipt.
- The right to request that we correct any personal data if it is found to be inaccurate or out of date;
- The right to request your personal data is erased where it is no longer necessary for us to retain such data;
- The right to withdraw your consent to the processing of your personal data for marketing purposes at any time;
- The right to receive the personal data that you have given to us, in a structured, commonly used and machine readable format for transmission to another data controller. This only applies if the processing is based on consent or a contract and the processing is carried out by automated means;
- The right to request a restriction on further processing, where there is a dispute in relation to the accuracy or processing of your personal data;
- Where the processing of your data is based on our legitimate interests or for the purposes of direct marketing, you have the right to object to the processing of your data. Depending on the circumstances, we may or may not be obliged to action this request;
- The right to lodge a complaint with the Information Commissioner’s Office, if you feel that we have processed your personal data in a way that does not meet the GDPR.
We will only ever request from you the data that we need in order to perform our contract with you, meet any requests you may have, protect our own legal rights or where we are required to do so by law. If you fail to provide that data when requested, we may not be able to perform our obligations under our contract with you, and as a result, may need to cancel our service with you. If this becomes necessary, we will notify you.
The accuracy of your information is important to us. If any of your business or relevant personal details change, please let us know by emailing us at email@example.com and we will update your record.
We keep all of our privacy practices under regular review, and any updates to this Notice will be placed on the Privacy page of our website. This Privacy Notice was last updated in May 2018.