This policy explains how Ian Chatfield Limited collects and uses personal information when you visit www.ianchatfield.co.uk, shop with us, use a customer account or loyalty benefits, subscribe to meatRepeat, or contact us. It also explains your choices and rights.
We handle personal information under the UK General Data Protection Regulation (UK GDPR), the Data Protection Act 2018 and the Privacy and Electronic Communications Regulations 2003, as amended, including by the Data (Use and Access) Act 2025.
This policy provides privacy information. Using our website, placing an order or accepting our sales terms does not, by itself, give consent to marketing or optional tracking. The terms governing purchases and meatRepeat subscriptions are separate.
Ian Chatfield Limited is the controller responsible for the personal information described in this policy. Our company number is 09445646, registered in England and Wales.
Registered office: Unit K, The Brewery, Bells Yew Green Road, Bells Yew Green, Tunbridge Wells, England TN3 9BD.
For privacy enquiries, requests or complaints, contact us:
- Email: [email protected]
- Telephone: 01732 354 733
- Post: Privacy enquiries, Ian Chatfield Limited, 16 High Street, Tonbridge, Kent TN9 1EJ.
Please explain what you need. You do not have to use a particular form or legal wording to exercise your rights.
The information we use depends on how you interact with us. It can include:
- Contact and account information: your name, email address, telephone number, billing and delivery addresses, login details, account preferences and account activity.
- Orders and payments: products, quantities, prices, discounts, order history, delivery or collection arrangements, instructions, payment status, transaction references, refunds and payment disputes. Payment information is explained in section 5.
- Subscription and loyalty information: meatRepeat selections, repeat intervals, scheduled orders, changes, pauses, skips, cancellations, payment status, loyalty points and redemptions.
- Communications: enquiries, feedback, complaints, messages, photographs or other evidence you send us, and recordings of telephone conversations as explained in section 8.
- Marketing choices: subscriptions, consent records, communication preferences, withdrawals and objections.
- Website information: IP address, browser and device information, pages visited, referral information, identifiers, security logs and interactions such as clicks and scrolling. Optional tracking is explained in section 7.
- Recipient information: a gift recipient's name, contact details, delivery address and any message or instructions supplied by the purchaser.
Please give us only information relevant to your enquiry or order. Avoid including unnecessary medical details, identification documents or payment-card information in messages or order notes.
Allergies and other sensitive information. Information identifying someone's allergy or health condition needs additional protection. Where you ask us to record this information to deal with a request, we will explain the purpose and seek explicit consent for that use. You can withdraw that consent by contacting us. This may prevent us from continuing the particular arrangement that needs the information; we will explain any available alternative. Where health information is necessary to establish, exercise or defend a legal claim, we may instead rely on that specific legal condition, together with our legitimate interest in handling the claim. We do not treat an ordinary enquiry or acceptance of this policy as explicit consent, and we do not use health information for advertising.
Most information comes directly from you when you browse, order, create or manage an account, subscribe, use loyalty benefits, telephone us, complete a form or contact us by email, messaging or social media.
We also receive information from payment providers, such as payment confirmations, failures and refunds, and from delivery providers, such as delivery status and proof of delivery. Website and security tools provide technical information. If someone buys a gift for you or arranges an order on your behalf, they provide your relevant contact and delivery details.
If you provide another person's details, please ensure you are entitled to do so, give only what is needed and make this policy available to them. We remain responsible for providing privacy information where the law requires it, including when we first contact a recipient. Supplying someone's details for delivery does not sign them up to marketing.
We need a lawful basis for each use of personal information. The main purposes and bases are set out below.
Orders and requested services. We use contact, account, order and payment information to take the steps you request before buying, accept and fulfil orders, arrange delivery or collection, administer accounts and requested loyalty benefits, process payments and refunds, and manage meatRepeat. The basis is performance of our contract with you or the steps you ask us to take before entering into it. Necessary order and subscription messages use this basis too.
Gift recipients and people acting for customers. Where the person whose information we use is not our contracting customer, we rely on our legitimate interest in fulfilling the customer's purchase and communicating with the intended recipient or authorised representative.
Enquiries and customer care. We use relevant contact details and correspondence to answer questions and resolve problems. Order-related assistance is necessary for our contract with you. General enquiries and service reviews rely on our legitimate interest in responding and improving customer service. Compliance with consumer remedies and data protection requests also involves legal obligations.
Legal and accounting duties. We use relevant transaction, contact and correspondence records to meet tax, accounting, consumer protection and food safety obligations, deal with product recalls, and respond to legally binding requests. The basis is compliance with a legal obligation.
Security and disputes. We use proportionate account, transaction, technical and communication information to secure our systems, detect fraud or misuse, investigate payment disputes, and establish or defend legal claims. The basis is our legitimate interest in protecting customers, staff and the business and resolving disputes. Where a particular disclosure or action is legally required, we rely on that legal obligation.
Service quality and business improvement. We use relevant order patterns, feedback and service records to plan stock, assess demand, improve service and train staff. The basis is our legitimate interest in operating an efficient business and providing a reliable service. We use aggregated information where that meets the purpose. Optional website tracking and marketing use the separate bases below.
Marketing and optional tracking. We rely on consent for the email marketing and optional analytics and advertising described in sections 6 and 7. Consent is specific to the relevant activity and can be withdrawn.
Where we rely on legitimate interests, we assess whether the use is necessary and proportionate and balance it against your interests, rights and reasonable expectations. You can object to these uses as explained in section 13.
Where information is necessary to process an order, deliver it, verify a payment or provide another requested service, we may be unable to provide that service without it. We will explain this where relevant. Marketing permission and optional tracking are not required to place an ordinary order.
Initial job applications. If you respond to a vacancy advertised on our website, we use your contact details, CV, covering message and application correspondence to assess and discuss your application. We rely on taking steps at your request before a possible employment contract, and our legitimate interest in managing a fair recruitment process and keeping an appropriate recruitment record. We will provide further information before requesting additional checks or sensitive information. We do not add applicants to customer marketing lists because they have applied for a job.
Payment providers handle payments through the payment method used for your purchase. We receive the information needed to administer the transaction, including the amount, payment result and transaction reference. Depending on the method, this can include limited card information, such as the card type and last few digits.
Where you choose a saved or recurring payment method, the payment provider may retain payment credentials and provide a secure payment reference or token for authorised future payments. This enables recurring payments without storing the full card number in our website's customer database. We do not ask you to send your full card details or security code by email, contact form or messaging service.
If you choose a third-party payment or finance option, such as PayPal or Klarna where offered, we share the contact, billing, order and transaction information needed to provide that option. The provider also processes information for its own payment, identity, fraud prevention, credit assessment and regulatory purposes under its own privacy information. Choosing that option does not authorise unrelated marketing by us. See the PayPal Privacy Statement and Klarna privacy information.
For meatRepeat, we use your account, product selections, schedule, payment status and instructions to run the subscription. This includes renewal and price-change reminders, order confirmations, payment-failure messages and confirmations of changes, pauses, skips, resumptions and cancellations. These are service communications where they concern administration of your subscription. Promotional messages are subject to your marketing choices.
Cancelling a subscription stops future orders in accordance with its terms. It does not automatically erase transaction records we must retain or close your customer account. Unsubscribing from marketing does not cancel a subscription or stop necessary service communications.
We send newsletters, offers and other promotional emails when you have opted in to receive them. Creating an account, placing an order, contacting us or subscribing to meatRepeat does not by itself sign you up.
You can withdraw your permission at any time by using the unsubscribe link in a marketing email or contacting [email protected]. Withdrawal does not affect the lawfulness of messages sent before you withdrew consent. We will stop the relevant marketing and retain only the records needed to respect your choice and demonstrate how it was handled.
Permission for promotional email does not automatically cover promotional text messages or WhatsApp messages. We obtain the appropriate separate permission before using another electronic messaging channel for marketing.
We may still send information necessary for an order, account security, subscription administration, a product recall or another legal obligation. We do not use these messages to bypass an objection to marketing.
You have the right to object at any time to use of your personal information for direct marketing, including profiling connected with that marketing. We will stop that use when you object.
Our website uses cookies and similar technologies to operate the site, keep a basket and session working, remember relevant choices and support security. Some identifiers and technical information can be personal information even if they do not contain your name.
We use technologies that are strictly necessary for a service you request without asking for cookie consent where the law allows this. Our related use of personal information is based on providing that service or our legitimate interest in keeping it secure. We ask for consent before using optional analytics, session replay and advertising tracking. Accepting our terms, scrolling or continuing to browse is not consent to these activities.
Microsoft Clarity. With your analytics consent, Clarity helps us understand how visitors use the website through information such as page visits, clicks, scrolling, device information, heatmaps and session replays. We use this to identify usability problems and improve the website. Where you also give advertising consent, relevant information may be used with Microsoft's advertising services. Microsoft's own uses are explained in the Microsoft Privacy Statement.
Meta Pixel. With your advertising consent, the Meta Pixel shares website activity and relevant technical identifiers with Meta to help measure advertising and show relevant adverts, including on Facebook and Instagram. Meta may connect this activity with information it holds about you, including your account information. See the Meta Privacy Policy.
Google services. We use Google Tag Manager to manage website tags and Google reCAPTCHA to help protect forms against spam and abuse. Security checks can involve browser, device, IP address and interaction information. Tags managed through Tag Manager remain subject to the consent requirements for their individual purposes. See the Google Privacy Policy.
You can review or change optional cookie choices through Cookie Settings on our Cookie Policy page. That page provides further information about the technologies and their duration. You can also block or delete cookies through your browser, although blocking essential cookies can affect functions such as the basket or sign-in. Withdrawing consent stops future consent-based tracking; it does not retrospectively undo lawful processing already carried out.
We record telephone conversations to and from our store for staff training, quality assurance and fraud prevention. We rely on our legitimate interests in maintaining service standards and protecting customers and the business, subject to the balancing assessment described above.
We will tell you when a call is being recorded. Access to recordings is limited to people who need them for these purposes. If you would prefer to use another channel, you can contact us by email or post. You can also raise an objection to the recording with us; we will consider it under the applicable data protection rules.
We retain routine recordings only for the period needed for the relevant quality review, training or fraud-prevention assessment. A relevant recording or extract may be retained longer where needed to investigate a specific complaint, transaction dispute or suspected fraud, or deal with a legal claim. We do not keep every recording simply because a dispute might arise in future.
We share information where needed for the purposes in this policy, with access limited to what is relevant. Recipients include:
- Website, hosting, IT support, communications, telephony and business-system providers that help us operate the website, accounts, email, records and services.
- Payment processors, payment and finance providers, banks and relevant fraud-prevention services for payments, refunds, verification and disputes.
- Delivery and fulfilment providers, including DPD where used, for names, delivery addresses, contact details, instructions and relevant delivery information.
- Email marketing providers for messages you have agreed to receive, and the analytics and advertising providers described in section 7, subject to your choices.
- Accountants, professional advisers, insurers and legal advisers where needed for accounts, advice, insurance or claims.
- HMRC, regulators, law enforcement bodies, courts and other authorised recipients where disclosure is legally required or otherwise lawful and necessary.
If we explore or complete a business sale, restructuring or transfer, relevant information may be shared with advisers and a prospective or actual successor where necessary, subject to appropriate confidentiality and data protection safeguards. This is based on our legitimate interest in managing the transaction. We will provide further privacy information if the controller of your information changes.
Providers acting on our instructions are required to protect information and use it only for the agreed services. Some recipients, including payment providers and online platforms, also act as controllers for their own purposes. Their privacy information explains those activities; we remain responsible for our own collection, use and sharing.
If you contact us through WhatsApp or social media, the platform also handles information under its own privacy terms. An email or telephone alternative is available using section 1.
Some technology, communications, payment and online-platform providers operate internationally. Information may therefore be stored or accessed outside the UK, including in the European Economic Area and the United States.
Where we make a restricted international transfer, we use a lawful transfer mechanism. Depending on the recipient and destination, this is an applicable UK adequacy regulation, or appropriate contractual safeguards such as the UK International Data Transfer Agreement or the UK Addendum to the EU Standard Contractual Clauses, with the assessment and additional protections required by law. An adequacy arrangement only applies where its conditions cover the particular recipient and transfer.
Contact us using section 1 for information about relevant destinations or a copy of the applicable safeguards. We may redact confidential commercial terms while providing the information needed to explain the protection.
We keep identifiable information for the period needed for its purpose, then delete it or make it anonymous. Different records have different retention needs:
- Order, payment and accounting records: normally six years from the end of the company financial year to which they relate, with longer retention where tax rules, an investigation or an identified legal claim require it. This does not mean every item of customer information must be kept for six years.
- Account, subscription and loyalty records: while needed to provide the active service or administer outstanding orders, balances and benefits. For inactive or closed accounts, we consider the time since the last interaction, any remaining service or benefit, and outstanding obligations, and remove information no longer needed. Relevant transaction records follow the accounting rule above.
- Enquiries and complaints: while dealing with the issue and necessary follow-up. If a dispute, safety incident or claim arises, we retain the relevant evidence through its resolution and any applicable period for bringing or defending a claim, taking account of the nature of the issue and legal requirements.
- Call recordings: according to the review and investigation criteria in section 8. A justified need for one recording does not extend retention of unrelated calls.
- Marketing records: while your permission remains current and the information is needed for the mailing relationship. We review inactive records. After you opt out, a limited suppression record, such as your email address and opt-out date, is retained for as long as needed to avoid contacting you again. Evidence of consent or withdrawal may also be retained to demonstrate compliance or resolve a specific dispute.
- Website and security information: according to the purpose, the tool's retention settings and any identified security investigation. Cookie duration is explained through the Cookie Policy. Clarity's published periods are 30 days for ordinary playback data and nine months for click data, heatmaps and labelled or favourited sessions.
- Job applications: through the recruitment process and any necessary follow-up or period for resolving a recruitment dispute. Relevant successful-applicant records become part of the employment record under the information provided to staff. Keeping an unsuccessful application for future vacancies requires a separately explained arrangement.
Closing an account or withdrawing consent does not require us to delete information that must be retained under another applicable legal basis. Any such retention is limited to that purpose. Backup copies are removed through the backup cycle and are not used to restart deleted accounts or marketing.
We use appropriate technical and organisational measures to protect personal information against unauthorised access, loss, misuse or disclosure. These include access controls, restricting staff access to their responsibilities and safeguards for the systems and providers we use. Website connections use encryption in transit.
No website or communications system can guarantee absolute security. This does not limit our legal responsibility to protect your information. Keep your account login details secure and contact us promptly if you suspect unauthorised access. Where a personal data breach requires notification to the regulator or affected people, we will make those notifications in accordance with the law.
Depending on the circumstances and the lawful basis involved, you can:
- Ask for access to your personal information and a copy of it.
- Ask us to correct inaccurate or incomplete information.
- Ask us to erase information where the right to erasure applies.
- Ask us to restrict how we use information in the circumstances provided by law.
- Receive information you provided in a portable format, or ask for it to be transferred to another controller where the right to portability applies.
- Withdraw consent at any time where we rely on it.
You can object to processing based on legitimate interests for reasons relating to your situation. We will stop unless we demonstrate compelling legitimate grounds that override your interests, rights and freedoms, or the information is needed for legal claims. The separate right to object to direct marketing is absolute.
Our systems automatically carry out routine functions, such as applying order rules, scheduling subscription activity and responding to payment results. A failed renewal payment can place a subscription on hold. You can ask our team to explain an outcome and review a problem. Payment and finance providers may make their own automated identity, fraud or credit decisions, as explained in their privacy information.
Where a decision for which we are responsible is made solely by automated means and has legal or similarly significant effects, you have the applicable rights to information about it, to make representations, to obtain human intervention and to challenge it. Contact us using section 1.
We normally respond to rights requests without undue delay and within one month. We may need proportionate information to verify identity or authority. Where the law permits additional time or clarification, we will explain why and keep you informed; a complex request or a number of requests can allow an extension of up to two further months. Requests are normally free. We only charge a fee or refuse a request where the law allows and will explain the reason and your options.
Some rights have exceptions, including where information must be retained for a legal duty or legal claim. We consider each request individually.
If you are concerned about how we handle personal information, please contact us by email, telephone or post using section 1. You can also use our contact form. You do not have to describe your concern as a formal complaint.
We will acknowledge a data protection complaint within 30 days, investigate and take appropriate steps without undue delay, keep you informed and tell you the outcome without undue delay.
You also have the right to complain to the Information Commissioner's Office (ICO), the UK data protection regulator. The ICO generally recommends giving the organisation an opportunity to address the issue first. This does not remove your right to contact the ICO.
- Online: Make a complaint to the ICO
- Telephone: 0303 123 1113
- Post: Information Commissioner's Office, Wycliffe House, Water Lane, Wilmslow, Cheshire SK9 5AF.
We review this policy and publish updates here with the revised date. Where a change materially affects how we use your information, we will provide an appropriate notice. If a new use requires your consent, we will ask for it before starting that use. An update to this policy does not retrospectively create consent or remove your rights.
Updated: 23.09.2026
