Privacy

Introduction

1.1. The following sets out the data privacy policy (the "Privacy Policy") for Parsley Box Limited and Parsley Box Group Limited (“we”, “us”, “our”) ("Parsley Box") and the manner in which we collect, use and store personal data and information submitted to us by our customers, prospective customers and/or users of this website ("you", "your").

1.2. We are committed to protecting your personal data and handling it lawfully, fairly and transparently.

1.3. This Privacy Policy contains important information for you. It explains:

(i) who we are and how to contact us;

(ii) what personal data we collect about you and where we collect it from;

(iii) how, when and why we collect, store, use and share your personal data;

(iv) the lawful bases we rely on when using your personal data;

(v) how we use your personal data for marketing, cookies, analytics and advertising;

(vi) who we share your personal data with;

(vii) whether your personal data is transferred outside of the United Kingdom;

(viii) how we keep your personal data secure;

(ix) how long we keep your personal data;

(x) your rights in relation to your personal data; and

(xi) how to contact us, or the relevant supervisory authority, should you have a complaint.

1.4. For the purposes of Applicable Data Protection Laws, Parsley Box Limited is the controller of the personal data described in this Privacy Policy. This means that we decide why and how your personal data is used.

1.5. Our company details are:

(i) Parsley Box Limited

(ii) Parsley Box Group Limited

1.6. You can contact us about this Privacy Policy or about how we use your personal data:

(i) by email at [email protected];

(ii) by telephone on 0131 326 0131; or

(iii) by post at Parsley Box Customer Care, Orchard Brae House, 30 Queensferry Road, Edinburgh, EH4 2HS.

1.7. This Privacy Policy applies where we are acting as a data controller in relation to the personal data we collect about you through:

(i) our websites (www.parsleybox.com and corporate.parsleybox.com) (“Websites”);

(ii) communications with you by post, email, text, telephone or online;

(iii) orders, enquiries, catalogue requests and customer accounts;

(iv) customer service interactions;

(v) marketing communications and preference-management activities; and

(vi) any other interaction you have with us as a customer, prospective customer, website user, catalogue recipient or marketing recipient.

1.8. This Privacy Policy does not apply to websites, apps or services operated by third parties, even where our Websites link to them. Those third parties are responsible for explaining how they use your personal data. Our Websites and services are not intended for children and we do not knowingly collect data relating to children. If you are a parent or guardian and believe that your child has provided us with personal data, please contact us in accordance with section ‎1.7 to request deletion.

1.9. This Privacy Policy also applies where a customer provides us with the contact details of another person, such as a family member or friend, so that we can send that person delivery updates or other service communications relating to the customer’s order.

1.10. References in this Privacy Policy to our Terms and Conditions are to our terms and conditions that apply to customers and potential customers for our products.

1.11. In this Privacy Policy, please note the use of the following terms:

(i) “Applicable Data Protection Laws” means all applicable United Kingdom laws relating to data protection, privacy, direct marketing and the use of cookies and similar technologies, including the UK GDPR, the Data Protection Act 2018, the Privacy and Electronic Communications Regulations 2003 (PECR), and those laws as amended, supplemented or replaced from time to time, including by the Data (Use and Access) Act 2025;

(ii) "controller" means the organisation that decides why and how your personal data is used;

(iii) "ICO" means the Information Commissioner's Office, the UK supervisory authority for data protection matters;

(iv) “personal data” has the meaning given to it by the UK GDPR and means any information relating to an identified or identifiable individual;

(v) “processing” means anything done with personal data; for example collection, recording, organisation, structuring, storing, altering, deleting or otherwise using personal data;

(vi) "special category data" means personal data that reveals or concerns racial or ethnic origin, political opinions, religious or philosophical beliefs, trade union membership, genetic data, biometric data used for identification purposes, health data, sex life or sexual orientation;

(vii) "UK GDPR" means the United Kingdom General Data Protection Regulation; and

(viii) “you” and “your” refers to the person whose data is processed.

2. The types of personal data we collect about you and the purposes for which we use it

2.1. Personal data means any information about an individual from which that person can be identified.

2.2. We may collect, use, store and transfer different kinds of personal data about you, which we have grouped together as follows:

(i) Identity and Contact Data includes your name, postal address, delivery address, billing address, email address and telephone number and may include the name and contact details of a person nominated by a customer to receive delivery updates or service communications.

(ii) Order and Transaction Data includes catalogue requests, products ordered, order history, invoices, delivery details, delivery status, information about any delivery issues, payment status, refunds and other information needed to process orders, payments and refunds.

(iii) Account and Loyalty Data includes your account history, account preferences, password, payment methods and points, rewards or loyalty information.

(iv) Customer Service and Communications Data includes enquiries, complaints, correspondence with you, records of customer service interactions and information used to respond to requests or resolve disputes.

(v) Marketing, Preference and Profile Data includes your marketing choices, communication preferences, newsletter subscriptions, catalogue preferences, product interests, prospective-customer information, information about the source of your details where we receive them from a third party, information about products or offers that may be relevant to you, demographic information, and information we infer from your browsing behaviour, purchasing behaviour, product preferences and interactions with our Websites and related apps, if applicable, or marketing communications.

(vi) Website, Device, Usage and Analytics Data includes IP address, browser information, referring website, hardware model, operating system information, device identifiers, cookie identifiers, advertising identifiers, log files, pages visited, approximate location or where our Websites were accessed from, information about how often you use our Websites, what you do on our Websites, aggregated usage information, performance data, errors and debugging information.

(vii) Location, Advertising and Social Media Data includes location information provided by your device where you have enabled location settings, iOS IDFA, IDFV, Android advertising ID, advertising identifiers, information collected across different devices, information received from advertising or analytics partners, and information about your online presence or external accounts where you choose to connect your account to a third-party application, such as Facebook, Twitter or another social media platform.

(viii) Fraud Prevention, Security and Verification Data includes information used to protect our Websites, accounts, transactions and customer services from fraud, misuse, unauthorised access or other security incidents, and age-verification information such as date of birth where this is needed to supply age-restricted products.

(ix) Compliance, Audit, Credit and Legal Data includes information needed for audits, enquiries, investigations, regulatory requests, legal claims, disputes, debt recovery and compliance with legal obligations.

2.3. We may collect information about dietary requirements, allergies, intolerances, health conditions, disability, vulnerability or support needs where this is relevant to your order, enquiry or customer service request. Where this information is special category data, we will only use it where permitted by Applicable Data Protection Laws and only for the purpose for which it was provided, unless we tell you otherwise or the law permits another use.

2.4. We collect and use personal data so that we can operate our business, provide our products and services, manage customer accounts, process orders and payments, deliver products, respond to enquiries, improve our Websites, prevent fraud, comply with our legal obligations and, where permitted, send marketing communications.

2.5. Annex 1 sets out, in table format, a description of all the ways we plan to use the various categories of your personal data, and which of the legal bases we rely on to do so. We have also identified what our legitimate interests are where appropriate.

3. Legal Bases

3.1. The law requires us to have a legal basis for collecting and using your personal data. We rely on one or more of the following legal bases:

(i) Consent: We rely on consent only where we have obtained your active agreement to the use of your personal data for one or more specific purposes.

(ii) Performance of a contract with you: Where the use is necessary for the performance of a contract to which you are party, or in order to take steps at your request prior to entering into a contract.

(iii) Legal obligation: Where the use is necessary for compliance with a legal obligation that we are subject to.

(iv) Legitimate Interests: Where the use is necessary to conduct our business and pursue our legitimate interests or those of a third party, except where those interests are overridden by your interests or fundamental rights and freedoms which require protection of personal data. We do not use your personal data for activities where our interests are overridden by the impact on you (unless we have your consent or are otherwise required or permitted to by law).

4. How is your personal data collected?

4.1. In most cases we will collect data about you directly from you. This may include personal data you provide when you place an order, create or use an account, request a catalogue, subscribe to marketing, complete a form, contact us, speak to our customer care team, give us feedback, or otherwise communicate with us.

4.2. Automated technologies or interactions: We may also collect personal data automatically when you use our Websites. This may include website, device and technical information, cookie identifiers (please see our Cookie Policy), device identifiers, advertising identifiers, and information about how you use our Websites.

4.3. Third parties or publicly available sources: We may also receive information about you from publicly‐available sources or third parties, including:

(i) payment service providers;

(ii) delivery companies;

(iii) address lookup and postcode verification;

(iv) fraud prevention, security or verification providers;

(v) marketing service providers, catalogue partners, data co-operatives or similar organisations, where permitted by Applicable Data Protection Laws;

(vi) advertising, analytics and social media platforms;

(vii) from another customer, for example where that customer nominates you to receive delivery updates or service communications relating to their order; and

(viii) publicly available sources, where relevant and lawful.

5. If you do not provide personal data

5.1. Some personal data is needed so that we can provide our products and services. For example, if you do not provide your name, delivery address and payment information, we may not be able to process or deliver your order.

5.2. Other personal data is optional. For example, you do not have to agree to receive marketing or accept non-essential cookies in order to place an order.

6. Keeping your personal data accurate

6.1. Please make sure that the personal data you give us is accurate and up to date. You can update certain account information through your account settings or by contacting us using the details in section ‎1.7.

7. Service communications and marketing

7.1. In addition to the general matters dealt with above, we may also use your personal data to provide you with updates concerning our products and special offers, or other related matters which might concern you or be of interest to you. This may be by post, telephone, email or text message, where permitted by Applicable Data Protection Laws.

7.2. Where we ask you to provide marketing preferences, we will explain your choices at the point we collect them.

7.3. We may also contact you with non-marketing communications related to products or services you have requested from us, including order confirmations, delivery updates, customer service messages, product safety notices and changes to our Terms and Conditions or policies.

7.4. Where we contact you for marketing purposes, we will rely on the lawful basis set out in Annex 1. For email and text message marketing, we will only contact you where you have consented or where we are permitted to rely on the soft opt-in under the PECR. This may apply where we obtained your contact details from you during a sale, or negotiations for a sale, the marketing relates to our own similar products or services, and you were given an opportunity to opt out when we collected your details and in every later message.

7.5. You have, at all times, the right to request that we do not contact you for marketing purposes. You may opt‐out of receiving such marketing communications at any time by:

(i) changing your preferences at https://parsleybox.com/members/preferences/;

(ii) contacting us directly using our contact details set out at section ‎1.7;

(iii) using the "unsubscribe" link in emails or replying "STOP" to text messages, where available; or

(iv) instructing the person contacting you.

7.6. If you opt out of marketing, we will stop using your personal data for direct marketing. We may keep your contact details and marketing preferences on a suppression list so that we can respect your choice.

7.7. For more information about the cookies we use and how to change your cookie preferences, please see our Cookie Policy.

8. Sharing your data with others

8.1. It may be necessary for us to share your personal data with third parties for the purposes described in this Privacy Policy and as set out in Annex 1.

8.2. Where we share personal data with third parties, we will take appropriate steps to protect it in accordance with Applicable Data Protection Laws. Where a third party processes personal data on our behalf, we require it to process that personal data only in accordance with our instructions and to use appropriate technical and organisational measures. Some third parties may use personal data as independent controllers and will be responsible for their own compliance with Applicable Data Protection Laws.

8.3. The third parties with which your personal data may be shared include:

8.4. We may also collect, use and share anonymous or aggregated statistical, demographic and transactional information with business partners or service providers. This information is not personal data as it does not directly (or indirectly) identify you. Where information identifies you or could be linked to you, we will treat it as personal data and protect it in accordance with this Privacy Policy.

8.5. Where we participate in marketing data co-operatives, we will only share personal data where permitted by Applicable Data Protection Laws. You can object to direct marketing at any time as explained in section ‎7.

9. How your personal data is kept secure

9.1. In order to help keep your personal data secure, we have put in place appropriate security measures that are intended to prevent your personal data from being accidentally lost, used, altered, disclosed or accessed unlawfully.

9.2. We restrict access to your personal data to those with a genuine business need to access it, and we have procedures in place to deal with any suspected data security breach. We will notify you, and any applicable regulator, of a suspected data security breach where we are legally required to do so.

9.3. In addition, we use encryption and other security measures where appropriate, including in relation to personal data transferred between your browser and our Websites.

9.4. For more information on how we protect you and your personal data, please see our Security Policy

10. International Transfers

10.1. Some of our service providers may process personal data outside the UK. Where we transfer personal data outside the UK, we will do so in accordance with Applicable Data Protection Laws.

10.2. Where required, we will use an appropriate transfer mechanism, such as UK adequacy regulations, the UK International Data Transfer Agreement, the UK Addendum to the EU Standard Contractual Clauses, or another transfer mechanism permitted by Applicable Data Protection Laws.

10.3. For further information please contact us using our contact details set out at section ‎1.7.

11. How your personal data is retained

11.1. Personal data that is processed by us will not be retained for any longer than is necessary for that processing, or for purposes relating to or arising from that processing. Different periods for keeping your personal data will apply depending upon the type of data being retained and the purpose of its retention.

11.2. When deciding how long to keep personal data, we consider the amount, nature and sensitivity of the personal data, the purposes for which we process it, the potential risk of harm from unauthorised use or disclosure, whether we can achieve those purposes through other means, and any applicable legal, regulatory, tax, accounting, reporting or other requirements.

11.3. Where your personal data is retained after we have finished providing our products to you, or where the contract with you has ended in any other way, then this will generally be for one of the following reasons:

(i) so that we can respond to any questions, complaints or claims made by you or on your behalf;

(ii) so that we are able to demonstrate that your matter was dealt with adequately; or

(iii) in order to comply with legal and regulatory requirements.

11.4. Where we record customer calls, we generally retain those call recordings for 60 days, unless a longer period is needed to deal with a complaint, dispute, investigation, legal claim or other legal or compliance matter.

11.5. Where you have opted out of marketing, we may keep limited contact details and marketing preference information on a suppression list so that we can respect your choice and ensure that we do not send you further marketing. If you would like to find out more about our retention policies, please contact us using our contact details set out at section ‎1.7.

11.6. If you no longer want us to use your information, you may close your account through your account settings. We will delete and/or anonymise any personal data which is no longer necessary for us to retain.

12. Your rights in relation to your data

12.1. Data protection legislation gives you, the data subject, various rights in relation to your personal data that we hold and process. These rights are exercisable without charge, although there are limited circumstances where we may charge a reasonable fee or refuse to comply where permitted by law. We are subject to specific time limits in terms of how quickly we must respond to you. Those rights are:

(i) Right of access (data subject access request): the right to obtain, from us, confirmation as to whether or not personal data concerning you is being processed and, where that is the case, access to that personal data and various other information, including the purpose for the processing, with whom the data is shared, how long the data will be retained, and the existence of various other rights.

(ii) Right to rectification: the right, without undue delay, to have inaccurate personal data concerning you put right. This enables you to have any incomplete or inaccurate data we hold about you corrected, though we may need to verify the accuracy of the new data you provide to us.

(iii) Right to erasure: sometimes referred to as the “right to be forgotten”, this is the right for you to request that, in certain circumstances, we delete or remove personal data relating to you where there is no good reason for us continuing to process it. You also have the right to ask us to delete or remove your personal data where you have successfully exercised your right to object to processing (see below), where we may have processed your information unlawfully or where we are required to erase your personal data to comply with local law. Note, however, that we may not always be able to comply with your request of erasure for specific legal reasons which will be notified to you, if applicable, at the time of your request.

(iv) Right to restrict processing: the right to request that, in certain circumstances, we restrict the processing of your data.

(v) Right to data portability: the right, in certain circumstances, to receive the personal data which you have provided to us in a structured, commonly used and machine‐readable format, and the right to have that personal data transmitted to another controller. Note that this right only applies to automated information which you initially provided consent for us to use or where we used the information to perform a contract with you.

(vi) Right to object: the right, in certain circumstances, to object to personal data being processed by us where it is in relation to direct marketing, or in relation to processing supported by the argument of legitimate interest. Where you object to direct marketing, we will stop using your personal data for that purpose. For other objections, we may continue processing where we can demonstrate compelling legitimate grounds or where the processing is needed for legal claims.

(vii) Right relating to automated decision making: where we make a significant decision about you based solely on automated processing, you may have the right to receive information about the decision, make representations, obtain human intervention and contest the decision.

12.2. Full details of these rights can be found in the UK GDPR or by reference to guidance produced by the ICO.

12.3. In the event that you wish to exercise any of these rights you may do so:

(i) by contacting us using the contact details set out in section ‎1.7; or

(ii) through a third‐party whom you have authorised for this purpose.

13.Your rights in relation to your account

13.1. You may access, correct, change and delete personal data associated with your account by visiting your account settings.

13.2. You can also request the deletion of the personal data in your account by contacting us using the contact details set out in section ‎1.7.

14. Making a complaint

14.1. If you have any complaints relating to the acquisition, use, storage or disposal of your personal data, please contact us using our contact details set out at section ‎1.7 or through our Data Protection Complaints Form.

14.2. If you are unhappy with any aspect of the use and/or protection of your personal data, you have the right to make a complaint to the ICO, who may be contacted in writing at Wycliffe House, Water Lane, Wilmslow, Cheshire, SK9 5AF; by telephone on 0303 123 1113; by fax on 01625 524510 or online at www.ico.org.uk. We would, however, appreciate the chance to deal with your concerns before you approach the ICO so please contact us in the first instance. The ICO will expect you to have done this before reviewing your complaint.

15.This Privacy Policy

15.1. We keep our Privacy Policy under regular review. This Privacy Policy was last updated in June 2026.

15.2. The terms and provisions of this Privacy Policy may be changed, updated and amended from time to time. If we do so during the time when we are providing you with products we will inform you of those changes.

16.Third Party Links

16.1. This website may include links to third-party websites, plug-ins and applications. Clicking on those links or enabling those connections may allow third parties to collect or share data about you. We do not control these third-party websites and are not responsible for their privacy statements. When you leave our website, we encourage you to read the privacy policy of every website you visit.

Annex 1: Purpose of Processing