1. Introduction

Boards & Baskets is committed to protecting your privacy and personal information.

This Privacy Policy explains how we collect, use, store and protect your personal data when you visit our website, make an enquiry, purchase our products or services, attend our events or workshops, or communicate with us.

We process personal data in accordance with the UK General Data Protection Regulation (UK GDPR), the Data Protection Act 2018 and, where applicable, the Privacy and Electronic Communications Regulations (PECR).

Boards & Baskets is operated by Graze & Garden Ltd, which is responsible for the personal data described in this policy.

Website: www.boardsandbaskets.co.uk Email:enquiries@boardsandbaskets.co.uk

2. Personal Data We Collect

Depending on how you interact with us, we may collect:

• Personal identification: Your name and, where relevant, the name of your organisation.
• Contact information: Email address, telephone number, billing address and      delivery address.
• Booking and event information: Event dates, locations, guest numbers, booking      preferences and service requirements.
• Dietary and allergen information: Dietary preferences, allergies, intolerances and other requirements voluntarily provided to help us deliver our services safely.
• Payment and transaction information: Payment status, purchase history and transaction records. Payments may be processed through secure third-party      payment providers.
• Photographs and video recordings: Images or recordings captured during workshops,      events or other activities where photography or filming takes place.
• Marketing preferences: Your choices regarding promotional emails, SMS messages,      telephone communications and use of photographs or video.
• Website usage information: Information collected through cookies, analytics and similar technologies, where applicable.

We collect this information directly from you, through our website, enquiry forms, booking processes, communications, consent forms or interactions at events.

3. How We Use Your Personal Data

We may use your personal information to:

• Respond to enquiries and manage bookings.
• Prepare and deliver catering, workshops, events and other services.
• Communicate important booking, delivery and event information.
• Process payments, maintain financial records and issue invoices.
• Accommodate dietary requirements and manage food safety.
• Improve our products, services and customer experience.
• Maintain appropriate records of customer consent and communication preferences.
• Share photographs or video for promotional purposes where appropriate consent has been obtained.
• Send promotional communications where permitted by applicable law and your      marketing preferences.
• Comply with legal, regulatory and accounting obligations.

We do not sell your personal information.

4. Legal Basis for Processing

We process personal data only where we have an appropriate lawful basis under UK GDPR.

These may include:

Contract: Where processing is necessary to provide products or services you have requested, manage bookings or fulfil contractual obligations.

Legal obligation: Where processing is required to comply with applicable legal, accounting, tax or regulatory requirements.

Legitimate interests: Where necessary for reasonable business purposes, such as responding to enquiries, managing our operations, maintaining security and improving our services, provided these interests are not overridden by your rights and freedoms.

Consent: Where you have freely agreed to specific uses of your information, such as identifiable promotional photography or video, or certain marketing communications.

Where dietary or allergy information reveals health information or another special category of personal data, we will identify an appropriate additional condition for processing under Article 9 of UK GDPR, such as explicit consent where applicable.

Consent can be withdrawn at any time without affecting the lawfulness of processing carried out before withdrawal.

5. Photography and Video Recordings

We may take photographs or video recordings at Boards & Baskets workshops, tasting experiences, catering events, pop-ups and other activities.

These may be used to showcase our products, services and customer experiences through:

• Our website.
• Social media platforms, including Instagram and Facebook.
• Digital advertisements and promotional campaigns.
• Printed marketing materials.
• Other Boards & Baskets promotional communications.

Where individuals are identifiable and their images are intended for promotional use, we will seek appropriate consent.

Our photography and video consent form allows participants to select:

• Full consent: Permission to use identifiable photographs and video for      promotional purposes.
• Limited consent: Permission to appear in wider group or background images, but not as the main subject of close-up promotional photography or video.
• No consent: A request not to be intentionally photographed or filmed for      promotional use.

Providing consent is voluntary. Declining consent will not affect your ability to participate in our services or activities.

Photographs and video may be cropped, edited or formatted for promotional use without materially misrepresenting the individual.

We will not sell identifiable photographs or video recordings as standalone content to third parties.

Withdrawal of Photography or Video Consent

You may withdraw your consent by emailing enquiries@boardsandbaskets.co.uk.

Following withdrawal, we will cease further consent-based promotional use and take reasonable steps to remove identifiable material from channels under our control where applicable.

Please note that content already distributed in printed materials, downloaded, shared or reposted by third parties may not always be capable of complete removal.

We will consider requests concerning previously published material in accordance with applicable data protection rights and obligations.

Children and Young People

Where identifiable promotional photographs or video involve children, we will obtain appropriate consent from a parent or legal guardian where required and apply additional safeguards.

6. Marketing Communications and Contact Permissions

We may invite customers, event attendees and website visitors to receive updates about Boards & Baskets products, workshops, tasting experiences, special offers and upcoming events.

Marketing preferences are collected separately from photography and video permissions.

Depending on your preferences and applicable law, communications may include:

Email marketing: Newsletters, event announcements, special offers, new products and promotional updates.

SMS marketing: Text messages containing event announcements, offers and promotional information.

Telephone marketing: Calls concerning relevant products, services, events or special offers.

Where consent is required, we will only send marketing communications through channels for which you have provided the relevant permission.

In certain circumstances, the law permits marketing to existing customers without separate consent, subject to applicable PECR requirements, including the opportunity to opt out when contact details are collected and in each subsequent marketing message.

We will respect your recorded marketing preferences and any applicable objections or opt-outs.

Withdrawing Marketing Consent

You may withdraw marketing consent or change your communication preferences at any time by:

• Emailing enquiries@boardsandbaskets.co.uk.
• Using an unsubscribe link where provided in a marketing email.
• Following any opt-out instructions included in promotional messages.

Withdrawal of marketing consent will not prevent us from contacting you about existing bookings, payments, deliveries or other necessary service-related matters.

We maintain appropriate records of consent, withdrawal and marketing preferences to help ensure your choices are respected.

7. Sharing Your Personal Data

We do not sell or rent your personal information.

Where necessary, we may share relevant information with trusted third-party service providers, including:

• Payment processing providers.
• Website hosting and technical support providers.
• Email and communications service providers.
• Delivery and event service partners.
• Professional advisers and accounting providers.
• Social media and advertising platforms where promotional content is published.

We share only information reasonably necessary for the relevant purpose.

Where third parties process personal data on our behalf, we require appropriate contractual and data protection safeguards.

We may also disclose information where required by law or to protect legitimate legal rights.

8. International Data Transfers

Some service providers, website platforms and social media companies may process personal data outside the United Kingdom.

Where personal data is transferred internationally, we will take appropriate steps to ensure that transfers comply with applicable UK data protection requirements, including the use of recognised adequacy arrangements or approved contractual safeguards where required.

9. Data Security

We take appropriate technical and organisational measures to protect personal data against unauthorised access, disclosure, alteration, loss or misuse.

These measures may include secure systems, access controls, password protection and the use of reputable service providers.

Access to personal information is limited to those who reasonably require it for legitimate business purposes.

Although we take reasonable precautions, no method of electronic transmission or storage can be guaranteed to be completely secure.

10. Data Retention

We retain personal information only for as long as reasonably necessary for the purposes for which it was collected, including applicable legal, accounting and regulatory obligations.

Retention periods may vary depending on the type of information:

• Booking and transaction records: Retained for the period necessary to meet financial, accounting and legal obligations.
• Enquiries and customer communications: Retained for as long as reasonably      necessary to manage the enquiry, provide services or address subsequent questions.
• Dietary and allergen information: Retained only for as long as necessary for food safety, service delivery, recordkeeping or legitimate legal purposes.
• Marketing contact information: Retained while there is a valid basis for marketing and until you unsubscribe, withdraw consent or otherwise object, subject to retaining limited suppression records where necessary.
• Photography and video: Retained for legitimate promotional purposes while the      relevant lawful basis remains applicable, subject to consent withdrawal, periodic review and applicable rights.
• Consent records: Retained as reasonably necessary to demonstrate compliance with data protection obligations.

Where information is no longer required, we will securely delete, anonymise or otherwise appropriately dispose of it.

11. Cookies and Website Analytics

Our website may use cookies and similar technologies to support website functionality, understand visitor interactions and improve the user experience.

Where cookies or similar technologies require consent under applicable law, we will request that consent before using them.

You may manage your cookie preferences through any available cookie controls on our website or through your browser settings.

Essential cookies required for the operation of the website may not require consent.

12. Your Data Protection Rights

Under UK GDPR, you may have the right to:

• Access: Request a copy of the personal data we hold about you.
• Rectification: Request correction of inaccurate or incomplete personal information.
• Erasure: Request deletion of personal information in applicable circumstances.
• Restriction: Request that we limit certain processing activities.
• Objection: Object to certain processing, including direct marketing.
• Data portability: Request transfer of eligible personal information in a commonly used, machine-readable format.
• Withdrawal of consent: Withdraw consent at any time where consent is the lawful      basis for processing.
• Rights concerning automated decisions: Exercise applicable rights in relation to qualifying automated decision-making.

These rights are subject to applicable legal conditions and exemptions.

To exercise your rights, please contact enquiries@boardsandbaskets.co.uk.

We will respond to requests within the timeframes required by applicable data protection law.

You also have the right to complain to the Information Commissioner's Office (ICO).

ICO website: www.ico.org.uk

13. Third-Party Websites and Social Media

Our website and communications may contain links to external websites or social media platforms.

These services operate under their own privacy policies and data processing arrangements.

We encourage you to review the privacy information provided by those organisations before sharing personal information with them.

14. Changes to This Privacy Policy

We may update this Privacy Policy periodically to reflect changes in our services, business operations, legal requirements or data processing practices.

The most recent version will be published on our website with the updated revision date.

Where material changes require additional notification or consent, we will take appropriate steps to meet those obligations.

15. Contact Us

If you have questions about this Privacy Policy, wish to change your marketing preferences, withdraw photography or video consent, or exercise your data protection rights, please contact:

Boards & Baskets Operated by Graze & Garden Ltd Email: enquiries@boardsandbaskets.co.uk Website:www.boardsandbaskets.co.uk

We will endeavour to respond promptly and in accordance with applicable data protection requirements.