Privacy Notice

  1. Overview & About Us

1.1. Heathcote Holdings Limited (“Heathcote Holdings”, “we”, “us”, “our”) is committed to protecting your personal data.

1.2. Heathcote Holdings operates a group of companies providing complementary services. This Privacy Notice explains how personal data is collected and used across the group.

1.3. Depending on the circumstances, companies within the Heathcote Holdings group may act as:

  • independent data controllers; or
  • joint controllers with Heathcote Holdings.

Where personal data is shared within the group, this is done for defined purposes such as service delivery, administration, and marketing (where permitted). Further details about the relevant controller can be provided on request.

1.4. Our registered office is:
Stanford Bridge Farm, Station Road, Pluckley, Ashford, Kent TN27 0RU.

1.5. If you have any questions about this Privacy Notice or how your data is used, please contact our Data Protection Officer (DPO):
DPO@Heathcoteholdings.com

  1. Heathcote Holdings Group Companies

2.1. Heathcote Holdings has a number of subsidiary and affiliated companies within its group structure.

2.2. Personal data collected through any of our websites, services, or interactions may be shared within the group where relevant to:

  • responding to your enquiry;
  • delivering services;
  • managing customer relationships; or
  • providing marketing communications (where permitted).

2.3. Different companies within the group may contact you directly in relation to their services, where this aligns with your interests and marketing preferences.

2.4. A list of group companies is available at:
heathcoteholdings.com/companies/

  1. Customers

3.1 Why do we process your personal data?

We process personal data to provide, manage, and improve our services, including fulfilling contractual and legal obligations.

Without this data, we may be unable to provide our services.

We only collect personal data that is necessary for these purposes.

3.2 What type of personal data do we process?

We may collect and process:

  • Account Data: name, email address
  • Profile Data: address, telephone number, job title
  • Transaction Data: service and payment details
  • Marketing Data: preferences for receiving communications

3.3 How do we collect your data?

We collect personal data:

  • directly from you; and
  • in some cases, from third parties such as your employer or publicly available sources.

3.4 Where is your personal data processed and by whom?

3.4.1. Personal data is primarily processed in the United Kingdom.

3.4.2. Data may be shared within the Heathcote Holdings group as described above.

3.4.3. We may use trusted third-party service providers, including:

  • IT and website providers
  • CRM and database providers
  • analytics providers
  • payment processors
  • professional advisers and insurers
  • print and mailing providers

3.4.4. These providers act under our instructions and are required to keep data secure and confidential.

3.4.5. We do not sell personal data or share it for third-party marketing without consent.

3.5 International transfers

Some third-party providers may process personal data outside the UK.

Where this occurs, we ensure appropriate safeguards are in place, such as:

  • UK adequacy regulations; or
  • International Data Transfer Agreements (IDTAs).

Further details are available on request.

3.6 What is the legal basis for processing your personal data?

We rely on the following lawful bases:

  • Contract: to provide services and manage your account
  • Legal obligation: to comply with regulatory requirements
  • Legitimate interests: to operate and improve our business
  • Consent: for marketing communications

Where we rely on legitimate interests, these include:

  • business administration and record keeping
  • customer relationship management
  • service improvement and operational efficiency
  • ensuring network and information security

We ensure that our legitimate interests are not overridden by your rights and freedoms.

3.7 Marketing communications

Where you have provided consent and/or legitimate interests, we may send marketing communications about relevant products and services across the group.

You can withdraw consent at any time by:

  • clicking the unsubscribe link in emails; or
  • contacting us directly

Each communication will identify the sender.

You also have the right to object to direct marketing at any time.

3.8 How secure is your personal data?

We implement appropriate technical and organisational measures to protect personal data.

Access is restricted to those who need it for legitimate purposes.

3.9 CCTV and Monitoring

CCTV and, where applicable, body-worn cameras may be used for:

  • safety and security
  • prevention and detection of crime
  • protection of staff, customers and property
  • incident investigation

The lawful basis for this processing is our legitimate interests in maintaining safety and security.

Footage is retained for a limited period and only kept longer where required for investigation or legal purposes.

3.10 How long do we keep your personal data?

We retain personal data only for as long as necessary for the purposes it was collected.

Typical retention periods include:

  • Waste Duty of Care records: up to 3 years
  • Financial records: at least 6 years
  • Marketing data: until you opt out or withdraw consent

Data may be retained longer where required for legal claims, insurance, or regulatory purposes.

We regularly review data to ensure it is not kept longer than necessary.

  1. Website Visitors

4.1 Cookies and technical data

Our website uses cookies and similar technologies to support:

  • essential functionality
  • security
  • performance and analytics

We may collect technical information such as:

  • IP address
  • browser type
  • device information

Where required, we will request consent before using non-essential cookies.

You can manage your cookie preferences through your browser settings.

  1. Your Rights

5.1 Your rights include:

  • access to your data
  • rectification of inaccurate data
  • erasure of your data
  • restriction of processing
  • objection to processing
  • data portability
  • withdrawal of consent (where applicable)
  • the right to complain to the ICO

5.2 Exercising your rights

To exercise your rights, contact the DPO.

We may request proof of identity before responding.

We will respond within one month unless your request is complex, in which case we will inform you of any delay.

5.3 Complaints

We encourage you to contact us first so we can try to resolve any concerns.

You also have the right to complain to the Information Commissioner’s Office:
ico.org.uk/concerns/

  1. Amendments

6.1. We may update this Privacy Notice from time to time.

6.2. Updates will be published on our website and highlighted where appropriate.

Copyright © 2026 FGS Agri Limited