Last Updated: May 2018
Your personal data will be held by us in accordance with the data protection laws of the United Kingdom. For the purposes of data protection laws in the United Kingdom, the controller is NH Foods UK Ltd.
Address: Attn: Yasuyuki Endo, 1 St. Katharine’s Way, London, UK, E1W 1UN
We generally collect your personal data directly from you when you are one of our customers or when you are an individual contact at one of our customers.
When you purchase from us, you will be asked to provide personal data. This information is likely to include your name, contact details, financial information, and business activities (this is not an exhaustive list).
The categories and range of personal data we collect and hold will vary from customer to customer. However, our policy is to collect only the personal data necessary to provide you with our products.
Business contacts and suppliers
We collect certain limited personal data about our business contacts, including subcontractors and individuals associated with our suppliers and subcontractors, and service providers (including professional advisors and individuals associated with our service providers). Personal data collected in this context is usually (but may not exclusively be) limited to name, employer name, contact title, phone, email and other business contact details.
NH Foods UK website
When you visit our website, we may collect the following information from you directly and/or automatically:
Careers and Recruitment
If you apply for a job or work placement you may need to provide information about your education, employment, nationality, racial background and state of health. We will use this information to assess your application and to allow us to carry out both recruitment analytics and any monitoring activities which may be required of us under applicable law as an employer. We may also carry out screening checks (including reference, background, directorship, financial probity, identity, eligibility to work, vocational suitability and criminal record checks) and consider you for other positions. We may disclose your personal data (including diversity and equal opportunities data) to academic institutions, recruiters, screening check providers, health service providers, professional and trade associations, law enforcement agencies, recruitment analytics and diversity research providers, referees and your current and previous employers. We may also collect your personal data from these parties in some circumstances. Without your personal data we may not be able to progress considering you for positions with us.
Visitors to our offices
We have security measures in place at our offices, including building access controls.
The images captured are securely stored and only accessed on a need to know basis (e.g. to look into an incident). The captured images are typically automatically overwritten after a short period of time unless an issue is identified that requires investigation (such as a theft).
We require visitors to our offices to sign in at reception and keep a record of visitors for a short period of time. Our visitor records are securely stored and only accessible on a need to know basis (e.g. to look into an incident).
Selling our products and marketing
We sell a range of food products. We may use your personal data for storing your details (and updating them when necessary) on our database, so that we can contact you in relation to the marketing of our products and facilitate the sales and delivery of our products. We may also use your personal data to notify you about changes to the products that we offer and (where you have indicated your consent) to directly market these products to you.
We process personal data in relation to our suppliers, service providers and their staff as necessary to receive the services in question. For example, where a supplier is providing us with facilities management or other outsourced services, we will process personal data about those individuals that are providing services to us.
Keeping systems secure
We process certain personal data, both in an online context but also offline, in order to keep our assets and premises secure, and to prevent physical and cyber attacks which could damage our business.
Complying with any requirement of law, regulation or any professional body of which we are a member
We are subject to legal, regulatory and professional obligations. We need to keep certain records to demonstrate that our products are provided in compliance with those obligations and those records may contain personal data.
Assessing job or work placement applications
We process personal data in relation to assessing applications for jobs or work placements.
We may share your personal data with the following categories of recipients:
Your personal data will be used by us and disclosed to our group companies (including NH Foods Ltd. our headquarters in Japan and its subsidiaries).
We may disclose your personal data to third party service providers who require access to such information for the purpose of providing specific services to us. These third parties will generally only be able to access your data in order to provide us with their services and will not be able to use it for their own purposes.
Professional advisors and auditors
We may disclose your personal data to professional advisors (such as legal advisors and accountants) or auditors for the purpose of providing professional services to us.
In the event that we sell or buy any business assets, we may disclose your personal data to the prospective seller or buyer of such business or assets.
If NH Foods UK or substantially all of its assets are acquired by a third party, personal data held by us about our clients will be one of the transferred assets.
You have various rights in relation to the data which we hold about you. We have described these below.
To get in touch with us about any of these rights, please contact us at:
Address: Attn: Yasuyuki Endo, 1 St. Katharine’s Way, London, UK, E1W 1UN
We will seek to deal with your request without undue delay, and in any event within one month (subject to any extensions to which we are lawfully entitled). Please note that we may keep a record of your communications to help us resolve any issues which you raise.
The GDPR gives you the following rights in relation to your personal data:
Right to object
This right enables you to object to us processing your personal data where we do so for one of the following reasons:
Right to withdraw consent
Where we have obtained your consent to process your personal data for certain activities (for example, for marketing), you may withdraw this consent at any time and we will cease to use your data for that purpose unless we consider that there is an alternative legal basis to justify our continued processing of your data for this purpose, in which case we will inform you of this condition.
Data Subject Access Requests
You may ask us for a copy of the information we hold about you at any time, and request us to modify, update or delete such information. If we provide you with access to the information we hold about you, we will not charge you for this unless permitted by law. If you request further copies of this information from us, we may charge you a reasonable administrative cost. Where we are legally permitted to do so, we may refuse your request. If we refuse your request we will always tell you the reasons for doing so.
Right to erasure
You have the right to request that we “erase” your personal data in certain circumstances. Normally, this right exists where:
We would only be entitled to refuse to comply with your request for erasure in limited circumstances and we will always tell you our reason for doing so.
When complying with a valid request for the erasure of data we will take all reasonably practicable steps to delete the relevant data.
Right to restrict processing
You have the right to request that we restrict our processing of your personal data in certain circumstances, for example if you dispute the accuracy of the personal data that we hold about you or you object to our processing of your personal data for our legitimate interests. If we have shared your personal data with third parties, we will notify them about the restricted processing unless this is impossible or involves disproportionate effort. We will, of course, notify you before lifting any restriction on processing your personal data.
Right to rectification
You have the right to request that we rectify any inaccurate or incomplete personal data that we hold about you. If we have shared this personal data with third parties, we will notify them about the rectification unless this is impossible or involves disproportionate effort. You may also request details of the third parties that we have disclosed the inaccurate or incomplete personal data to. Where we think that it is reasonable for us not to comply with your request, we will explain our reasons for this decision.
Right of data portability
If you wish, you have the right to transfer your personal data between companies. In effect, this means that you are able to transfer the details we hold on you to another third party. To allow you to do so, we will provide you with your data in a commonly used machine-readable format so that you can transfer the data. Alternatively, we may directly transfer the data for you.
Right to complain
You have the right to lodge a complaint with our regulator, who is the Information Commissioner’s Office in the UK. You can contact them in the following ways:
Cookies are small data files sent by a website to your computer that is stored on your hard drive when you visit certain online pages of our website.
You can set your browser to accept or reject all cookies, or notify you when a cookie is sent. If you reject cookies or delete our cookies, you may still use our websites, but you may have reduced functionality and access to certain areas of our websites or your account.
We will take all reasonable precautions necessary to protect your personal data from misuse, interference and loss, and unauthorised access, modification or disclosure.
This includes, for example, the protection of passwords using industry standard encryption, measures to preserve system security and prevent unauthorised access and physical destruction of digital storage devices. We may use third party data storage providers to store personal data electronically. We take reasonable steps to ensure this information is held as securely as information stored on our own equipment.
Unfortunately, there is always risk involved in sending information through any channel over the internet. You send information over the internet entirely at your own risk. Although we will do our best to protect your personal data, we cannot guarantee the security of your data transmitted over the internet and we do not warrant the security of any information, including personal data, which you transmit to us over the internet.
The data that we collect from you may be transferred to, and stored at, destinations both within and outside the European Economic Area (EEA). As discussed above, we may disclose your personal data to our group companies and their service providers located in particular, in Japan and elsewhere, and to employees operating outside of the EEA who work for us or for one of our group companies or their respective service providers.
We want to make sure that your personal data is stored and transferred in a way which is secure. We will therefore only transfer data outside of the EEA where it is compliant with data protection legislation and the means of transfer provides adequate safeguards in relation to your data. For example, this could be:
We will not keep your personal data for longer than is necessary for the purposes for which we have collected it, unless we believe that the law or other regulation requires us to keep it (for example, because of a request by a tax authority or in connection with any anticipated litigation) or if we require it to enforce our agreements.
In general, we will retain your personal data for as long as we provide services to you and, following that period, we will only retain your personal data for as long as is reasonably necessary in the circumstances.
When it is no longer necessary to retain your personal data, we will delete the personal data that we hold about you from our systems. While we will endeavour to permanently erase your personal data once it reaches the end of its retention period, some of your personal data may still exist within our systems, for example if it is waiting to be overwritten. For our purposes, this data has been put beyond use, meaning that, while it still exists in the electronic ether, our employees will not have any access to it or use it again.
There are a number of different ways that we are lawfully able to process your personal data. We have set these out below.
Where using your data is in our legitimate interests
We are allowed to use your personal data where it is in our interests to do so, and those interests aren’t outweighed by any potential prejudice to you.
We believe that our use of your personal data is within a number of our legitimate interests, including but not limited to:
Where you give us your consent to use your personal data
We are allowed to use your data where you have specifically consented. In order for your consent to be valid:
As part of our relationship with you, we may ask you for specific consents to allow us to use your data in certain ways. If we require your consent, we will provide you with sufficient information so that you can decide whether or not you wish to consent.
You have the right to withdraw your consent at any time. We have set out details regarding how you can go about this in section 5 above.
Where using your personal data is necessary for us to carry out our obligations under our contract with you
We are allowed to use your personal data when it is necessary to do so for the performance of our contract with you.
For example, we need to collect your contact details in order to be able to communicate with you and provide you with any products you have requested.
Where processing is necessary for us to carry out our legal obligations
As well as our obligations to you under any contract, we also have other legal obligations that we need to comply with and we are allowed to use your personal data when we need to in order to comply with those other legal obligations.