This Privacy Notice explains what personal data we collect about you and how we use it. We have put a lot of information in this notice to be as open and transparent as possible about our use of personal data. If you have any questions about our use of your personal data, please contact us.

Warburtons Limited is the largest bakery brand in the UK, manufacturing and distributing products to a wide range of retail customers. We don’t currently sell products directly to consumers. We are committed to protecting your personal data and respecting your privacy and it is important to us that you understand how and why we use your data.

Personal data is information that relates to an identified or identifiable living individual. For example, this includes names, addresses, date of birth or more indirect information like post code, job title, age-range, IP address of a person.

We collect personal data about:

• Our Workforce – current and former employees and agency workers
• Potential Employees – people who apply for jobs, people we find through talent searches, and people who request notice of job vacancies
• People we deal with for business or charitable purposes – customers, suppliers, contractors and service providers, regulatory, trade and industry bodies, charities and schools
• Our Consumers – individuals who we send marketing material to, individuals who submit complaints and queries and visitors to our website
• Others who visit us – visitors to our sites

For each of these categories of individuals we collect different categories of personal data and use it for different purposes. To assist with explaining this we have created a specific privacy section for each of these categories of individuals and these are linked above. These specific privacy sections explain for each categories of individual what personal data we collect, how we use it and who we share it with. These apply in addition to the general information in this privacy information notice.

The law sets out a limited number of reasons for which we may collect and process your data, these include:

What it means: The processing is necessary for us to comply with the law (not including contractual obligations) eg employment records, accident reports for H&S, HMRC requirements.

What it means: The processing is necessary for our legitimate interests or the legitimate interests of a third party unless there is good reason to protect the individual’s personal data which overrides those legitimate interest. (eg finance company using third party debt collection agency to locate and recover monies from "disappeared” defaulting customer)

What it means: The processing is necessary for a contract we have with an individual (eg processing credit card details to perform payment) or because we have asked you to take specific steps before entering into a contract (eg provide a quote).

What it means: The individual has given clear consent for us to process their personal data for one or more specific purpose (we must be able to demonstrate this was informed and appropriate).

What it means: Occasionally, we may need to process information to protect someone’s life) eg emergency services receiving a list of site visitors upon responding to an emergency call. Each specific privacy section explains our lawful basis for processing the personal data for the individuals covered by that notice.

We do use some third parties under contract who collect, store and process personal data on our behalf. Such providers are only allowed to process your personal data to the extent necessary for them to provide the service we have requested from them. Categories of service providers we use include, IT system providers, marketing service providers, employee benefit providers. More specific information about service providers are set out in the specific privacy sections.

We will require all these third parties to:

• Comply with all applicable data protection legislation
• Ensure personal data is held securely
• Enter into and comply with data processing terms or agreements
• Use your data only for the purposes of providing services to us
• We do not intend to transfer your personal data to a third country. Where we transfer data to a third party we will require them to keep your data in the European Economic Area. If they cannot give this assurance we will require them to ensure that the approicate safeguards are in place.

We use measures to protect the personal data we hold. These include internal policies, procedures and controls which limit access to and use of personal data. You can obtain further information on our personal data security arrangements by contacting our Company Secretary (address and contact details below).

We have a clear policy that specifies that personal data should only be kept as long as is necessary for the purpose we use it.

In certain circumstances, you have the right to

• Request access to and a copy of your personal data (known as "subject access request”). Please refer to our contact below for further information
• Request correction of the personal data we hold about you so that you can have any incomplete or inaccurate information about you corrected
• Request erasure of your personal data, which means you can ask us to delete or remove your personal information where there is no good reason for us to continue to use it
• Object to processing of your personal information if we are relying on a legitimate interest (or those of third party) and there is something about your situation which makes you want to object to processing on this ground. You also have the right to object if we are using your personal information for direct marketing purposes
• Tell us to stop using your personal data for direct marketing purposes (either through specific channels or all channels)
• Request that we stop any consent-based processing of your personal data after you have withdrawn consent

We reserve the right to update this privacy notice at any time. This privacy notice was last updated in May 2018

You have the right to make a complaint at any time to the Information Commissioner’s Office (ICO), the UK supervisory body for data protection matters.

If you want further information, a copy of our privacy policy or to exercise any of your rights in relation to your personal data please email us at gdpr@warburtons.co.uk or write to us at:

Company Secretary – Data Protection Queries
Warburtons Limited, Back’o’th Bank House, Hereford Street, Bolton, BL1 8HJ