Privacy notice
Who is the controller
Mise Supply Ltd, Unit 4, St Philips Trading Estate, Albert Road, Bristol, BS2 0XA, is the controller for the personal data described here. Contact compliance@misesupply.co.uk with any question about this notice or to exercise a right below.
What we collect and why
| Data | Why | Lawful basis |
|---|---|---|
| Name, work email, work phone, job role | Operating your trade account, taking orders, delivering | Contract |
| Business name, address, company number, VAT number, FSA registration details | Verifying that we are supplying a real food business | Legal obligation and legitimate interests |
| Confirmation that the account holder is 18 or over | Age assurance on controlled goods | Legal obligation |
| Orders, invoices, delivery records, name of the person who signed | Fulfilling orders; the controlled-drug register | Contract and legal obligation |
| Records of refused orders, and our reasons | Demonstrating we are not reckless in supplying a controlled drug | Legal obligation, substantial public interest |
| Site logs and security records | Keeping the service running and secure | Legitimate interests |
Records relating to suspected offences
Where we refuse an order, or report a concern to the police or to Trading Standards, we record personal data relating to a suspected criminal offence. That is data to which Article 10 UK GDPR applies.
We process it under the substantial public interest condition in paragraph 10 (preventing or detecting unlawful acts) and paragraph 12 (regulatory requirements relating to unlawful acts) of Part 2 of Schedule 1 to the Data Protection Act 2018, and under paragraph 36 (extension of insurance conditions) where relevant. We maintain the Appropriate Policy Document required by paragraph 5 of Part 4 of that Schedule; it is available from compliance@misesupply.co.uk and is reviewed annually.
Because telling a person we suspect of an offence what we hold and why could prejudice the prevention or detection of crime, we may rely on the exemption in paragraph 2 of Schedule 2 to the Data Protection Act 2018 to restrict some of the rights below. We apply that exemption case by case, not as a blanket rule, and we record our reasons.
Who we share it with
- Our carriers, so they can deliver to you.
- Our payment provider and our accountants.
- The Food Standards Agency register and Companies House, when we look your business up — these are public searches; we send them your business details, not your personal life.
- The police, a local authority, Trading Standards, HMRC or a regulator, where we are required to produce records or where we are reporting a concern.
- Our hosting provider, which stores the data on servers in Germany.
We do not sell data and we do not use it for advertising profiling.
How long we keep it
- Controlled-drug register entries: two years from the last entry, as required by regulation 23 of the Misuse of Drugs Regulations 2001. In practice we keep six years, matching the accounting records the register is tied to.
- Refusal records: six years, because their value is in showing a pattern over time.
- Orders, invoices and food traceability records: six years.
- Account and verification records: for the life of the account and six years after it closes.
- Enquiries that do not become accounts: 12 months.
- Site and security logs: 12 months.
Your rights
You can ask for a copy of your data, ask us to correct it, ask us to delete it, object to processing based on legitimate interests, ask us to restrict processing, or ask for it in a portable form. Write to compliance@misesupply.co.uk; we respond within one month.
Some rights do not apply to records we are legally required to keep. We cannot delete a controlled-drug register entry on request, and we will usually decline to delete a refusal record while it remains relevant. We will tell you which exemption we are relying on unless doing so would itself prejudice the purpose.
You can complain to the Information Commissioner’s Office at ico.org.uk or on 0303 123 1113. We would rather you came to us first.
Cookies
See our cookie notice. We use one cookie, to keep you signed in.
Changes
We review this notice annually and when our processing changes. Material changes are notified to account holders by email.