Privacy Policy — Blackstone

Who we are

Blackstone is a fresh produce wholesaler operating in the United Kingdom, and is the data controller for this website.

Our full registered company name, company number, and registered office address are being confirmed and will be published here shortly. Until they are, any question about who controls your data — and any request under this policy — should go to contact@blackstoneproduce.uk, which reaches the people responsible for it.

This policy explains what personal data we collect when you visit blackstoneproduce.uk, how we use it, and what rights you have under the UK General Data Protection Regulation (UK GDPR) and the Data Protection Act 2018.

Questions about this policy should be directed to contact@blackstoneproduce.uk.

What we collect

Depending on how you use this site, we may process the following data:

Trade account applications: The account opening form on our homepage collects details about your business and about the person applying on its behalf. It is the largest set of data we hold about you, so it has a section of its own: see Trade account applications below.
Orders: When you order from our price list we store the contact name, email address, telephone number if you give one, delivery address, any delivery notes you add, and the items, quantities, and prices ordered, along with an order reference and whether the order has been paid.
Payment details: Payment is taken on a checkout page hosted by Stripe. Your card details are entered on Stripe's systems and are never sent to or stored on ours. From Stripe we receive and keep only the identifiers for the payment, the amount, and whether it succeeded.
Account records: For businesses that trade with us we keep an account record — business name, email address, and any note our staff add — and a ledger of purchases and payments against it. Orders paid through the site are matched to an existing record by email address so a returning customer is not duplicated.
Contact enquiries: When you reach us via the email button, we receive your email address and the content of your message. That message arrives directly in our email inbox; there is no form database behind it.
Technical data: Your IP address, browser type, operating system, and requested page paths are processed automatically by Cloudflare, our infrastructure and CDN provider. This data is not linked to your identity in our own systems.
Anti-abuse records: When you submit the account application form, place an order, or sign in to our staff panel, we briefly record the IP address the request came from so we can rate-limit automated abuse. These records contain nothing but an IP address, a timestamp, and whether the submission was accepted, and they are deleted automatically once they fall outside the ten-minute window we count them in.
Staff accounts: Our internal panel is not open to the public. For each staff user we store a username, a hashed password — never the password itself — and a record of active sign-in sessions.
Cookies: We set a small number of cookies to make the site work correctly. See the Cookies section below for details.

We never see or store your full card number, expiry date, or security code.

Trade account applications

The “Open an account” form on our homepage is how a business asks us to set up a trade account. When you submit it, the following is stored in our database:

Company name: The registered name of the business applying. Required.
Trading name: The name the business trades under, where it differs. Optional.
VAT number: For VAT registered businesses. Optional, and stored with spaces removed.
Registered address: The address the business is registered at. Required.
Trading address: Where deliveries should go, where it differs from the registered address. Optional.
Telephone: A contact number for the business. Required.
Email: The address we reply to. Required, and stored in lower case.
Director's name: The name of the person applying on behalf of the business. Required.
Position: That person's position in the company. Required.
Date signed: The date shown on the form when you completed it.

Alongside these we generate a reference for the application, record the date and time it reached our server, and record whether staff have reviewed it yet. We also keep the short-lived record of the IP address it was submitted from, described under anti-abuse records above.

Much of this is information about a business rather than about you personally. The name and position of the person signing are personal data, and where the applicant is a sole trader the business details may identify them as well, so we treat the whole application as personal data.

Nothing about the application is automated. Submitting the form does not create a login, set your prices, or approve anything. A member of our staff reads the application and decides by hand whether to open an account, then contacts you on the email address you gave. There is no automated decision-making and no profiling.

We use these details to assess your application and open your account, and for nothing else. They are not used for marketing and are not passed to anyone outside the processors listed under Third parties.

How we use it

We use the data we collect to:

Assess trade account applications and open accounts
Respond to your enquiries and provide wholesale quotations
Take payment for, prepare, and deliver the orders you place
Keep account and ledger records of what has been bought and paid for
Manage standing orders and delivery logistics
Protect our public forms against automated abuse
Operate and improve the website
Comply with our legal and regulatory obligations

We do not sell, rent, or share your personal data with third parties for their own marketing purposes. We do not use your data for automated decision-making or profiling.

Legal basis

We process your personal data on the following UK GDPR grounds:

Legitimate interest Art. 6(1)(f): Responding to business enquiries, operating a secure website, rate-limiting our public forms against automated abuse, and detecting and preventing fraud. We have conducted a legitimate interests assessment; you may request a copy.
Contract performance Art. 6(1)(b): Fulfilling orders placed with us, taking payment for them, and managing delivery schedules for wholesale customers. The same ground covers steps taken at your request before any contract exists — assessing your trade account application and setting the account up.
Legal obligation Art. 6(1)(c): Accounting records and tax filings required under UK law, including the Companies Act 2006 and HMRC's record-keeping rules for Corporation Tax and VAT (Value Added Tax Act 1994).
Consent Art. 6(1)(a): Non-essential cookies, where we ask for your agreement before setting them. We currently set none, so in practice we do not rely on this ground today. You may withdraw consent at any time without affecting past processing.

Third parties

We engage the following processors who may access personal data when providing their services:

Cloudflare, Inc.: United States. Provides CDN, DNS, and DDoS protection, and hosts both this website and the database holding applications, orders, and account records. All traffic to this website transits Cloudflare's network. Cloudflare is certified under the UK Extension to the EU–US Data Privacy Framework and operates data centres in the UK. See Cloudflare's privacy policy.
Stripe: Stripe Payments Europe, Ltd. (Ireland) and Stripe, Inc. (United States). Processes card payments made on this site. We pass Stripe the order amount and reference, the items ordered, and your email address; your card details go to Stripe directly and never reach us. Stripe acts as an independent controller for the payment data it handles, under its own terms, and is certified under the UK Extension to the EU–US Data Privacy Framework. See Stripe's privacy policy.
Email provider: Our contact address (contact@blackstoneproduce.uk) is handled by a third-party email hosting provider. Messages you send us are stored on their infrastructure in accordance with their privacy policy. We will name that provider here once our arrangements are confirmed; ask us in the meantime and we will tell you who it is.

Where personal data is transferred outside the United Kingdom, it is protected by appropriate safeguards — the UK International Data Transfer Agreement, the UK Addendum to the European Commission's standard contractual clauses, or UK adequacy regulations — in accordance with Chapter V of the UK GDPR.

We do not share your data with any other third parties.

Your rights

Under the UK GDPR, you have the following rights in relation to your personal data:

Access: Request a copy of the personal data we hold about you.
Rectification: Ask us to correct inaccurate or incomplete data.
Erasure: Ask us to delete your data. This right applies in most cases but is subject to our legal retention obligations (see Retention below).
Restriction: Ask us to pause processing of your data while a dispute is pending.
Portability: Receive the data you provided to us in a structured, machine-readable format.
Object: Object to processing based on legitimate interests, including direct marketing (we send none).
Withdraw consent: Withdraw consent you have given (e.g. for non-essential cookies) at any time, without affecting the lawfulness of prior processing.

To exercise any of these rights, email contact@blackstoneproduce.uk with a description of your request. We will respond within one calendar month. We may ask for proof of identity before disclosing or deleting data.

You also have the right to lodge a complaint with the UK supervisory authority, the Information Commissioner's Office (ICO), at ico.org.uk or on 0303 123 1113.

Cookies

Cookies are small text files your browser stores on your device. We use the following categories:

Essential: We set one cookie of our own, bs_session, and only when a member of our staff signs in to the internal panel. It holds a random session token, cannot be read by JavaScript, and expires after 30 days. Ordinary visitors are never given it. Cloudflare may also set its own security cookies to tell genuine visitors from automated traffic.
Payment: Stripe sets cookies on its own hosted checkout pages to process the payment and prevent fraud. Those are set by Stripe under its privacy policy, not by us, and only once you reach checkout.
Analytics: None. We use no analytics, advertising, or tracking cookies on this site, and embed no third-party trackers.

You can manage or block cookies via your browser settings. Guidance for common browsers: Chrome, Firefox, Safari. Disabling essential cookies will affect site functionality.

Retention

We keep personal data only for as long as necessary:

Trade account applications: Where an application leads to an account, for as long as that account is open, and afterwards as part of the accounting records below. Where we do not take an application forward, 12 months from submission, or sooner if you ask us to delete it.
Contact enquiries: 2 years from the date of last contact, or until you request deletion, whichever is sooner.
Order and invoice records: 6 years from the end of the financial year they relate to, as required by HMRC for tax and VAT records. This includes the payment confirmations we receive from Stripe for each order.
Account and ledger records: For the life of the trading relationship, then kept as accounting records for the period above.
Anti-abuse records: Ten minutes. Rows are deleted automatically as they fall outside the rate-limiting window.
Staff sign-in sessions: 30 days, or until the staff member signs out, whichever is sooner.
Infrastructure logs: Up to 30 days, as determined by Cloudflare's log retention settings.

When the retention period expires, data is securely deleted or anonymised.

Contact

The data controller for this website is:

Blackstone United Kingdom
contact@blackstoneproduce.uk

Our registered company name, number, and office address will be added here once confirmed. Email is the fastest way to reach us in the meantime, and is the address we handle data protection requests from.

We may update this policy periodically. Material changes will be reflected on this page with a revised date at the top. Continued use of the site after changes constitutes your acknowledgement of the updated policy.