Privacy Policy

This privacy policy sets out how Priory Farm Estate Limited t/a Priory Farm uses and protects any information that you give us when you use this website.

1. Introduction

Priory Farm Estate Limited (“we”, “us”, “our”) is committed to protecting and respecting your privacy. 

This policy explains how we collect, use, store, and protect your personal data when you: 

• Visit our website 

• Make purchases or bookings 

• Sign up to marketing communications 

• Use our services or facilities

We comply with: 

• UK General Data Protection Regulation (UK GDPR) 

• Data Protection Act 2018 

• Privacy and Electronic Communications Regulations (PECR) 

• Relevant provisions of the EU Data Act (2026 updates) 

2. Who We Are

Data Controller: Priory Farm Estate Limited 
Address: Sandy Lane, South Nutfield, Surrey, RH1 4EJ 
Email: farmoffice@prioryfarm.co.uk 

We are responsible for deciding how your personal data is processed. 

3. What Personal Data We Collect

We may collect and process: 

Information you provide 

• Name 

• Email address 

• Postal address 

• Phone number 

• Reward Card details 

• Preferences and interests 

• Date of Birth

Information we collect automatically 

• IP address 

• Browser type and device information 

• Website usage data (via cookies)

Transaction data 

• Purchase history 

• Booking information 

• Payment details (processed securely via third parties – we do not store card details) 

4. How We Use Your Data

We use your data to: 

• Provide goods, services, and bookings 

• Manage your account or Reward Card 

• Improve our products and customer experience 

• Send marketing communications (where consent is given) 

• Conduct market research 

• Comply with legal obligations 

5. Lawful Bases for Processing

We process your data under the following lawful bases: 

• Consent: for marketing communications 

• Contract: to fulfil purchases or bookings 

• Legitimate Interests: to improve services and manage operations 

• Legal Obligation: where required by law (e.g. tax or regulatory compliance) 

6. Data Sharing

We may share your data with trusted third parties where necessary, including: 

• Payment processors 

• IT and website providers 

• Delivery or service partners 

• Email marketing platforms 

All third parties are required to process your data securely and lawfully. 

We do not sell your personal data. 

7. International Transfers

Where data is transferred outside the UK, we ensure appropriate safeguards are in place, such as: 

• UK adequacy regulations 

• Standard contractual clauses 

8. Data Retention

We only retain personal data for as long as necessary: 

• Customer records: up to 6 years (for legal/tax purposes) 

• Marketing data: until consent is withdrawn

   

9. Your Rights

You have the right to: 

• Access your personal data 

• Correct inaccurate data 

• Request deletion (“right to be forgotten”) 

• Restrict or object to processing 

• Request data portability 

• Withdraw consent at any time 

You can exercise your rights by contacting us. 

10. Data Act Rights (2026 Update)

In line with evolving data regulations, you also have: 

• The right to receive your data in a structured, machine-readable format 

• The right to request transfer of your data to another provider 

• Greater transparency over how your data is used and shared 

11. Cookies and Tracking

We use cookies to: 

• Ensure the website functions correctly 

• Improve user experience 

• Analyse website traffic 

You can manage your cookie preferences through your browser settings. 

We use only essential cookies. These help our website work properly, and we don’t use them to track you or collect personal data. You can continue browsing knowing your privacy is respected.

12. Data Security

We take appropriate technical and organisational measures to protect your data, including: 

• Secure servers 

• Access controls 

• Encryption where appropriate 

13. Data Breaches

In the event of a data breach: 

• We will assess risk immediately 

• Notify affected individuals where required 

• Report to the ICO within 72 hours if applicable 

14. Data Protection Complaints

We are committed to handling any concerns fairly and promptly. 

How to make a complaint 

You can contact us via: 

• Email: farmoffice@prioryfarm.co.uk 

• Post: Priory Farm Estate Limited, Sandy Lane, South Nutfield, Surrey, RH1 4EJ

What happens next 

• Acknowledgement within 5 working days 

• Full response within 30 days (or up to 60 days if complex)

Escalation 

If you are not satisfied, you may contact: 

Information Commissioner’s Office (ICO) 

• Website: https://ico.org.uk 

• Phone: 0303 123 1113 

15. Automated Decision-Making

We do not carry out automated decision-making that significantly affects individuals. 

16. Changes to This Policy

We may update this policy from time to time. 

Updates will be posted on this page, and you should check periodically to ensure you are happy with any changes. 

17. CCTV, Audio Recording, ANPR and Facial Recognition Systems

To ensure the safety, security, and efficient management of our premises, Priory Farm Estate uses: 

• Closed Circuit Television (CCTV) 

• Limited audio (sound) recording 

• Automatic Number Plate Recognition (ANPR) 

• Facial recognition technology (where deployed) 

These systems operate across our estate, including car parks, entrances, retail areas, and public spaces. 

Purpose of Processing 

We use these systems to: 

• Prevent and detect crime 

• Protect visitors, staff, and property 

• Monitor site usage and safety compliance 

• Support incident investigations 

• Manage parking and vehicle flow 

• Enhance security through identity verification (facial recognition, where used) 

Lawful Basis 

We rely on: 

• Legitimate Interests – maintaining safety, security, and business operations 

• Legal Obligations – cooperation with law enforcement

   

Facial Recognition (Biometric Data) 

Where facial recognition is used to identify individuals, we process biometric data under: 

• Explicit consent, or 

• Another lawful condition permitted under Article 9 UK GDPR (where applicable) 

We will not use facial recognition for identification without a valid lawful basis, and it will only be used where necessary and proportionate. 

What Data We Collect 

CCTV 

• Video images of individuals 

• Location, date, and time of recordings 

Audio Recording (where enabled) 

• Limited sound recordings captured alongside video
• Audio recording is used only where justified, with clear signage in place.

ANPR 

• Vehicle registration numbers 

• Entry/exit times 

• Location data 
  

Facial Recognition 

Where deployed, we may process: 

• Facial images 

• Biometric templates derived from facial features (for identification or verification purposes) 

How Facial Recognition Is Used 

Facial recognition may be used for: 

• Enhanced site security in restricted areas 

• Prevention of repeat incidents or banned individuals re-entering 

• Identity verification for specific services (if implemented) 

We ensure: 

• Use is targeted and proportionate 

• Individuals are clearly informed before entering monitored areas 

• Alternatives are available where appropriate (e.g. non-biometric access methods) 

Data Sharing 

We may share data with: 

• Police and law enforcement authorities 

• Insurers and legal advisers 

• Regulatory bodies 

Biometric data (facial recognition) is never shared for commercial purposes and only disclosed when legally required. 

Data Retention 

• CCTV and audio: up to 30 days 

• ANPR data: up to 90 days 

• Facial recognition data:  

• Stored only for as long as necessary for its specific purpose 

• Typically retained for short, strictly limited periods 

• Deleted sooner where no longer required 

Data may be retained longer if required for investigations or legal proceedings. 

Your Rights 

You have the right to: 

• Request access to your personal data 

• Request deletion or restriction 

• Object to processing 

• Withdraw consent (where applicable, including facial recognition) 

For CCTV/ANPR requests, please provide: 

• Date, time, and location 

• Description of yourself or your vehicle 

• Proof of identity 

We may restrict access where it affects others’ rights or ongoing investigations. 

Transparency and Signage 

We display clear signage across the estate explaining: 

• CCTV, audio recording, ANPR, and facial recognition use 

• The purposes of data collection 

• How to contact us regarding your data 

Where facial recognition is used, signage will explicitly state this. 

Data Security 

All data collected is: 

• Stored securely 

• Access-controlled and monitored 

• Protected against unauthorised access, misuse, or loss 

Biometric data is handled with additional security safeguards due to its sensitive nature.