Privacy Policy

1. Controller and contact

The controller responsible for personal data processed through loraventhessique.com is Zunarethivessia Apiary Ltd, whose correspondence address is 42 Meadow Lane, Shrewsbury, SY2 5PE, United Kingdom. You can contact us about privacy matters at info@loraventhessique.com or by writing to the address above.

This notice explains how we handle personal data connected with website visits, enquiries, correspondence, product availability requests, gift requests, apiary visit enquiries and other direct communications. It should be read together with our Cookie Policy and Terms & Conditions.

2. Legal framework and our approach

We process personal data under the UK General Data Protection Regulation (UK GDPR), the Data Protection Act 2018 as amended, and other applicable UK privacy and electronic communications rules. Where electronic communications technologies are relevant, we also take account of the Privacy and Electronic Communications (EC Directive) Regulations 2003 (PECR), as amended.

Our approach is to collect only information that is reasonably needed for a defined purpose, keep it for no longer than necessary, restrict access, and explain our use of data in clear language. We do not use personal data merely because it is available to us.

3. Personal data we may collect

Depending on how you interact with the site, we may collect information you provide directly, including your name, email address, telephone number, message content, preferred contact method, product or gift requirements, requested quantities, preferred dates, and any practical details you choose to include in an enquiry.

When you correspond with us, we may retain the content of that correspondence and related follow-up information so that we can answer your request and maintain an appropriate record of the conversation. If an enquiry develops into an order or other arrangement outside the website, additional information may be required for fulfilment, payment records, accounting, delivery or collection. Any such information should be limited to what is necessary for that purpose.

Technical information may be generated by the infrastructure that serves the website, such as IP address, browser type, device information, requested pages, timestamps, referral information and security logs. The exact technical data available can depend on the hosting environment. We do not use the public website to intentionally collect special category data, criminal offence data or unnecessary identification documents.

4. Purposes and lawful bases

We use personal data only where we have a lawful basis. The basis depends on the context:

• Responding to enquiries: usually our legitimate interests in communicating with people who contact the apiary, or steps requested by you before entering into an arrangement.
• Managing an order, collection, booking or agreed service: performance of a contract or steps necessary before entering into a contract.
• Business administration and record keeping: our legitimate interests in running the apiary responsibly, keeping appropriate correspondence records, resolving disputes and maintaining continuity of service.
• Legal and accounting obligations: compliance with legal duties where records must be retained or disclosed.
• Website security: our legitimate interests in protecting the site, detecting misuse and maintaining reliable access.
• Non-essential electronic tracking, if introduced: consent where UK law requires it. Such technologies will not be activated merely on the basis of this privacy notice.

Where we rely on legitimate interests, we consider the purpose, necessity and effect on individuals before proceeding. You can object to processing based on legitimate interests in the circumstances explained below.

5. Where the data comes from

Most personal data is obtained directly from you when you submit the contact form, email, telephone us, write to us or otherwise communicate with the apiary. We may also receive information from another person where they are arranging a gift, collection or visit on your behalf. In that situation we expect them to share only information that is reasonably necessary.

Technical security and access information may be generated automatically by the systems used to host and deliver the website. We do not purchase marketing lists for use through this website.

6. Sharing and service providers

We do not sell personal data. Information may be shared with carefully selected service providers only where this is necessary for legitimate business functions, such as website hosting, secure email, professional advice, accounting, delivery or IT support. Providers should process information only for agreed purposes and with appropriate confidentiality and security protections.

We may disclose information where required by law, court order, regulatory obligation, insurance process, tax requirement or the establishment, exercise or defence of legal claims. We may also disclose information where reasonably necessary to protect the rights, property or safety of the business, customers or others, provided the disclosure is lawful and proportionate.

7. International transfers

Our preference is to use services that keep personal data within the United Kingdom or another location covered by an appropriate UK data protection safeguard. If a supplier processes personal data outside the UK, we will use an appropriate legal mechanism where required, such as UK adequacy regulations, an approved transfer agreement or addendum, together with supplementary protections where appropriate.

The fact that a service can technically be accessed from another country does not by itself describe the full legal arrangement. Transfer safeguards depend on the actual provider, destination and processing activity in use at the relevant time.

8. Retention

We keep personal data for no longer than necessary for the purpose for which it was collected, while taking account of legal, accounting, dispute and security requirements. Routine enquiries that do not lead to an ongoing relationship will generally be reviewed and deleted when they are no longer useful for follow-up. Records connected with completed transactions may need to be retained for longer where tax, accounting, contractual or legal requirements apply.

Security logs are retained only for a proportionate period consistent with protecting the website and investigating misuse. Where information is no longer required but cannot immediately be deleted from a protected backup, it will remain isolated from ordinary use until that backup is overwritten or securely retired.

9. Your data protection rights

Subject to the conditions and exemptions in applicable law, you may have the right to request access to your personal data; ask for inaccurate data to be corrected; request erasure; request restriction of processing; object to processing based on legitimate interests; and receive certain information in a portable format where the right to data portability applies.

Where processing is based on consent, you can withdraw that consent at any time. Withdrawal does not make earlier lawful processing unlawful. Some rights are not absolute and may not apply to every record, for example where information must be retained to comply with a legal obligation or to establish or defend a legal claim.

To exercise a right, contact {email}. We may ask for information reasonably necessary to verify identity before disclosing or changing personal data. We aim to respond within the period required by UK data protection law and will explain if a lawful extension is needed.

10. Automated decision-making

We do not use the website to make decisions about individuals based solely on automated processing that produce legal effects or similarly significant effects. Enquiries are handled as ordinary communications and assessed in context.

11. Security

We use organisational and technical measures appropriate to the nature of the information and the risks involved. These may include access controls, software maintenance, restricted administrative permissions, secure communications, backups and review of service providers. No internet transmission or storage method can be guaranteed absolutely secure, so security is managed as an ongoing risk rather than a one-time promise.

If a personal data breach occurs, we will assess the likely risk to individuals and meet applicable notification obligations, including notification to the relevant regulator and affected individuals where the legal thresholds are met.

12. Children

The website is intended for a general audience and is not designed to collect personal data from children. A parent, guardian or responsible adult should make any product, visit or correspondence enquiry on behalf of a child where appropriate.

13. Questions and complaints

Please contact us first if you have a concern about how your personal data has been handled. You also have the right to complain to the UK data protection regulator, the Information Commission, if you believe data protection law has been infringed. Using our internal contact route does not remove your right to approach the regulator.

14. Changes to this notice

We may update this Privacy Policy when our practices, services or legal obligations change. The current version will be published on this page with a revised date. Material changes will be explained in a proportionate way where required.