Privacy Policy

Pasture is a trading name of LRC Innovation Ltd(“Pasture”, “we”, “us”), company number 15072688, registered office 71–75 Shelton Street, Covent Garden, London, WC2H 9JQ, ICO registration [ICO REGISTRATION NO]. Because the Platform connects shops with their customers, who is the “controller” depends on the data:

• Pasture is the controller for: shop owner (merchant) account and billing data; the login and identity data of everyone who holds an account (we operate the sign-in system); and technical and usage data about how the Platform is used.
• Each Shop is the controller for the personal data of its own Customers — the customer book and order history inside its back office. For that data Pasture acts as the Shop’s processor, handling it only on the Shop’s instructions under a Data Processing Agreement. If you ordered from a Shop and want to exercise your rights over that data, contact the Shop; we will support them.
• Stripe is an independent controller for the card and payment data it processes, under its own privacy policy.

• Account & identity — name, email, password (stored only as a secure hash), role and shop association.
• Order data — items ordered, amounts, collection or delivery details and order history.
• Payment data — handled by Stripe. We receive confirmation and limited metadata (such as a payment reference and the last four digits / card type); we do not store full card numbers.
• Marketing preferences — whether you have opted in to marketing and your contact preferences.
• Technical data — IP address, device and browser information, and logs needed to run and secure the Platform, plus strictly-necessary cookies (see section 9).

We use personal data on these legal bases:

• Performance of a contract — to create your account, take and fulfil orders, process payments and provide the service.
• Legitimate interests — to run, secure, support and improve the Platform and prevent fraud and abuse, where these interests are not overridden by your rights.
• Consent — to send you marketing by email where you have opted in (see section 10). You can withdraw consent at any time.
• Legal obligation — to keep accounting and tax records and to comply with the law.

We share personal data only as needed to run the service, with:

• the Shop you ordered from (for Customer order data);
• Stripe, for payment processing;
• our hosting and database provider [HOSTING / DATABASE PROVIDER] and email provider [EMAIL PROVIDER], who act as our processors;
• authorities or advisers where we are required to by law, or to establish or defend legal claims.

A current list of our sub-processors is available at [SUB-PROCESSOR LIST]. We do not sell your personal data.

Where a provider processes data outside the UK, we ensure an appropriate safeguard is in place — UK adequacy regulations, the UK International Data Transfer Agreement (IDTA) or the UK Addendum to the EU Standard Contractual Clauses, as applicable [CONFIRM SAFEGUARD PER PROVIDER].

We keep personal data for as long as your account is active and as needed to provide the service [RETENTION PERIODS]. Order and financial records are kept for the statutory accounting period of [6 years]. When data is no longer needed we delete or anonymise it.

Under UK data protection law you have the right to:

• access a copy of your personal data;
• have inaccurate data corrected;
• have data erased in certain circumstances;
• restrict or object to certain processing;
• data portability; and
• withdraw consent at any time where we rely on it.

To exercise these rights for data we control, contact us at [PRIVACY EMAIL]. Where the data is held by a Shop as controller (your customer/order data with that Shop), please contact the Shop and we will assist.

We use appropriate technical and organisational measures, including encryption of data in transit, hashing of passwords, and access controls so staff and shops only see what they need. No system is perfectly secure, but we work to protect your data and will notify you and the ICO of a personal data breach where the law requires.

We use only strictly-necessary cookies — there are no advertising or third-party tracking cookies. These cookies are needed for the Platform to work, so they do not require consent under PECR:

• an authentication / session cookie, which keeps you signed in; and
• a shop-routing cookie, which remembers which shop you are viewing.

You can block or delete cookies in your browser settings, but parts of the Platform may stop working if you do. If we add any optional cookies in future, we will ask for your consent first and update this section.

We only send marketing emails where you have opted in, or under the limited “soft opt-in” PECR allows for similar products to an existing customer. Every marketing email has an unsubscribe link, and you can opt out at any time in your account or by contacting us — this will not affect service messages about your orders or account.

The Platform is intended for adults and is not directed at children under 18. We do not knowingly collect data from under-18s.

For any privacy question, or to exercise your rights, contact us at [PRIVACY EMAIL], or write to LRC Innovation Ltd, 71–75 Shelton Street, Covent Garden, London, WC2H 9JQ. Our data protection contact is [DPO / DATA CONTACT].

If you are unhappy with how we handle your data you can complain to the Information Commissioner’s Office (ICO) at ico.org.uk, though we would welcome the chance to address your concern first.

We may update this policy from time to time. The “last updated” date above shows when it last changed, and we will notify you of material changes where required.