Legal
Privacy Policy
Last updated: June 2026
1. Who we are
The data controller for this website is Produce Network Limited (“Produce Network”, “we”, “us”). We operate producenetwork.co.uk, a marketing and trade-account application site for our London produce wholesale service.
Produce Network Limited
New Covent Garden Market, London, Greater London, SW8
2. What we collect
We may collect the following categories of personal data:
Trade-account application data
When you fill in our application form we collect: your name, work email address, phone number, company or group name, number of sites, delivery postcode, name of your current supplier, and any message you include.
Postcode serviceability check
If you use the postcode check on our homepage, we receive the postcode you enter and the result of the coverage lookup. We use this signal to understand demand by area.
Market Journal subscription
If you subscribe to the Market Journal, we collect your email address and the date you opted in. Subscription is double opt-in: we send a confirmation email and only add you to our list after you click the link.
Technical and analytics data
We collect standard server logs (IP address, browser, device type, referring URL, pages visited) as part of normal website operation. Analytics tools — Google Analytics 4 and Microsoft Clarity — are only loaded after you grant consent. No analytics cookies run before you choose.
Attribution data
Where present in the URL, we record UTM parameters (campaign, source, medium), referrer, and landing path alongside your application, so we can understand which channels are reaching kitchen operators.
3. How we use it and our lawful basis (UK GDPR Art. 6)
| Purpose | Lawful basis |
|---|---|
| Receive and assess trade-account applications; take pre-contractual steps | Steps prior to entering a contract (Art. 6(1)(b)) / Legitimate interests |
| Send service messages about your own application (e.g. receipt, outcome, follow-up) | Legitimate interests (Art. 6(1)(f)) |
| Send the Market Journal and other marketing content | Consent (Art. 6(1)(a)); you may withdraw at any time |
| Web analytics (Google Analytics 4, Microsoft Clarity) | Consent (Art. 6(1)(a)) — nothing loads until you accept |
| Advertising measurement and retargeting (Meta, TikTok, LinkedIn) | Consent (Art. 6(1)(a)) — nothing loads until you accept advertising cookies |
4. Who we share your data with — sub-processors
We share data only with the service providers listed below. Each is bound by a Data Processing Agreement (DPA) and may not use your data for their own purposes.
| Processor | Purpose | Location | Safeguard |
|---|---|---|---|
| Attio | CRM — managing trade leads and application pipeline | United States | DPA + Standard Contractual Clauses (UK Addendum / IDTA) |
| Resend | Transactional and consented marketing email delivery | US / EU (varies by region) | DPA + appropriate transfer mechanism |
| Supabase | Secure database for lead and application records | Our configured region (confirm) | DPA |
| Vercel | Website hosting and serverless edge functions | Global CDN (primary US / EU) | DPA |
| Google (Analytics 4) | Web analytics — loaded only after analytics consent | United States | DPA + SCCs; IP anonymisation enabled |
| Microsoft (Clarity) | Heatmaps and session replay — loaded only after analytics consent; input fields masked | United States | DPA + SCCs |
| Meta | Advertising measurement and retargeting — loaded only after advertising consent | United States | DPA + SCCs |
| TikTok | Advertising measurement and retargeting — loaded only after advertising consent | United States / Singapore | DPA + SCCs |
| Advertising measurement and retargeting — loaded only after advertising consent | United States | DPA + SCCs |
5. International transfers
Several of our sub-processors are based in the United States (notably Attio, our CRM). Where data is transferred outside the UK or EEA, we rely on one of the following safeguards as appropriate: Standard Contractual Clauses (SCCs) with the UK Addendum or International Data Transfer Agreement (IDTA), an EU–US Data Privacy Framework adequacy decision (where applicable), or another mechanism approved by the ICO.
6. How long we keep it
- Application and lead records — we retain these for up to approximately 24 months from the date you applied, after which they are deleted by our scheduled retention purge.
- Email suppression records — if you unsubscribe from marketing, or a message bounces, we keep a suppression record indefinitely. This is to honour your choice and ensure we do not contact you again.
- Postcode check signals — these are stored in aggregate without personal identifiers.
7. Marketing and your control
The Market Journal is double opt-in: you enter your email, we send a confirmation message, and you are only added to the list after you click the link in that message. Every marketing email we send includes a one-click unsubscribe link at the bottom. When you unsubscribe, we remove you from the active list and add your address to a suppression list so you are not inadvertently re-added.
8. Your rights (UK GDPR)
You have the following rights over your personal data. To exercise any of them, contact us using the details in section 10.
- Access — request a copy of the personal data we hold about you.
- Rectification — ask us to correct inaccurate or incomplete data.
- Erasure — ask us to delete your data where there is no compelling reason for us to keep it.
- Restriction — ask us to limit how we use your data in certain circumstances.
- Objection — object to processing based on legitimate interests, or to direct marketing at any time.
- Portability — receive a copy of data you provided in a structured, machine-readable format.
- Withdraw consent — where processing is based on consent, you can withdraw it at any time without affecting the lawfulness of processing before withdrawal.
If you are not happy with how we handle your data, you have the right to complain to the Information Commissioner’s Office (ICO) at ico.org.uk or by calling 0303 123 1113.
9. Cookies
We use cookies and similar technologies on this site. Non-essential cookies — analytics and advertising — are only set after you grant consent. For a full breakdown of what we use and how to manage your preferences, see our Cookie Policy.
10. Contact
Produce Network Limited (data controller)
New Covent Garden Market, London, Greater London, SW8
You can reach us through the contact options on this site.
Last updated: June 2026