Privacy policy

TRUE ORIGIN PRIVACY POLICY

Last updated: 12th October 2026

1.       Introduction

True Origin is committed to protecting your privacy and managing personal information responsibly. We recognise the importance of keeping personal information secure and being transparent about how it is used.

This Privacy Policy explains our approach to protecting personal information and the measures we take to respect individuals' privacy when conducting our activities.

2.       Purpose

The purpose of this Privacy Policy is to establish a clear and transparent approach to the collection, use, storage, protection and sharing of personal information by True Origin.

It aims to ensure that personal information is handled responsibly, used only for appropriate purposes, and processed in accordance with applicable data protection legislation. It also explains the rights individuals have in relation to their personal information and how they can exercise those rights.

3.       Scope

This policy applies to True Origin's activities involving the processing of personal information, including information collected through our websites, communications, and wider business operations.

It covers personal information relating to:

·         Retail and trade customers.

·         Visitors to our websites.

·         Suppliers, business partners, and professional contacts.

·         Donors and supporters.

·         Newsletter subscribers and marketing contacts.

·         Individuals who contact us by email, telephone, online chat, or other communication channels.

·         Individuals who register for or participate in our events and activities.

This policy applies to personal information collected electronically, in writing or through other means, where applicable. It should be read alongside any additional privacy information we provide for specific activities.

This policy applies to website: https://order.trueorigin.org.uk/. It does not replace any additional notices that may be provided for a particular service or activity.

4.       Who We Are

For the purposes of data protection legislation, the organisation responsible for determining how and why your personal information is processed is the data controller.

Business name: Just Trading Scotland Ltd T/A True Origin

Address: Unit 3/4 Wallneuk Road, Paisley, Renfrewshire, PA3 4BT

Email: info@trueorigin.org.uk

Telephone: 0141 255 0901

Website: https://order.trueorigin.org.uk/

Throughout this policy, references to “True Origin”, “we”, “us” or “our” refer to the organisation identified above.

If you have questions about this policy or wish to exercise your data protection rights, you can contact us using the details above.

5.       What Information We Collect

The personal information we collect depends on how you interact with us. This may include the following categories.

5.1   Contact Information

·         Name, email address, telephone number, and postal address.

·         Business name, job title, and business contact details.

5.2 Customer and Order Information

·         Billing and delivery addresses.

·         Products purchased and order history.

·         Customer account details and preferences.

·         Correspondence relating to orders, enquiries, complaints, and customer support.

5.3 Payment and Financial Information

·         Transaction records, invoices and payment details relating to purchases and other payments.

·         Information required to process refunds, reconcile payments, and maintain financial records.

Online orders are processed through Shopify, and payments may be handled by Shopify and/or third-party payment providers, including PayPal and Square, depending on the payment method used.

True Origin does not store customers' full payment card details. However, Shopify and the relevant payment provider may process and retain payment information in accordance with their own privacy policies and data retention practices.

We may receive transaction confirmations, payment status and other relevant payment information necessary to manage orders, process refunds and maintain our financial records.

For further information about how these providers manage personal information, please refer to their privacy policies:

·         Shopify Privacy Policy: https://www.shopify.com/legal/privacy

·         PayPal Privacy Statement: https://www.paypal.com/uk/legalhub/paypal/privacy-full

·         Square Privacy Notice: https://squareup.com/gb/en/legal/general/privacy

5.4 Marketing and Communications Information

·         Email marketing preferences and subscription status.

·         Records of communications and responses to marketing campaigns, where applicable.

·         Information provided when registering for events, completing forms or responding to surveys.

5.5 Supplier, Donor, and Business Relationship Information

·         Contact details and correspondence relating to suppliers, donors, supporters, business partners, and other organisations.

·         Transaction and donation records, where applicable.

·         Information necessary to manage business relationships and related administrative activities.

5.6 Website and Technical Information

·         Internet Protocol (IP) address.

·         Browser type and version.

·         Device information, including device type and operating system.

·         Pages visited and time spent on pages.

·         Referring websites and information about how you arrived at our websites.

·         Website usage information, including interactions with website features.

·         Cookie identifiers and other information collected through cookies and similar technologies, depending on your cookie preferences.

The technical information collected may vary between our websites and will depend on the features, analytics tools, and cookies in use. We aim to collect only the personal information necessary for the purposes for which it is required.

 

6.       How We Collect Personal Information

We may collect personal information in several ways, including:

·         Directly from you when you place an order, complete a form or contact us.

·         When you subscribe to our mailing list or register for an event.

·         When you enquire about our products or services, establish a trade account or enter into a business relationship with us.

·         Through our websites and associated online services.

·         Through third-party platforms or business partners where you interact with us or provide information for a purpose connected with our activities.

·         From publicly available sources, where appropriate and lawful.

Where personal information is obtained from a source other than the individual concerned, we will provide the required privacy information where applicable.

7.       How We Use Personal Information

We use personal information for legitimate business and organisational purposes, including the following.

Processing and Fulfilling Orders

To manage purchases, arrange deliveries, process refunds, respond to order-related enquiries and provide customer support.

Managing Customer and Business Relationships

To respond to enquiries, manage trade accounts, communicate with customers and suppliers, and maintain appropriate business records.

Payments and Financial Administration

To process and reconcile transactions, manage invoices and payments, recover outstanding debts, and meet accounting and financial record-keeping obligations.

Marketing and Communications

To send information about our products, offers, events, and activities where permitted by law and in accordance with your preferences.

Website Operation and Improvement

To maintain website functionality, monitor performance, understand how visitors use our websites and improve our services, subject to applicable privacy and cookie requirements.

Donations and Supporter Relationships

To record donations, communicate with supporters and administer related activities, where applicable.

Legal and Regulatory Obligations

To maintain required records, comply with applicable legislation and respond to lawful requests from regulatory or public authorities.

Security and Fraud Prevention

To help protect our organisation, customers and systems, prevent fraud, investigate suspected misuse, and resolve disputes.

8.       Legal Basis for Processing

Under the UK General Data Protection Regulation (UK GDPR), we must have a lawful basis for processing personal information. Depending on the circumstances, we may rely on the following.

Contract: Where processing is necessary to fulfil an order, provide a service or take steps at your request before entering into a contract.

Legal obligation: Where processing is necessary to comply with legal requirements, including applicable accounting and financial record-keeping obligations.

Legitimate interests: Where processing is necessary for our legitimate business interests, provided those interests do not override your rights and freedoms. These interests may include managing customer relationships, responding to enquiries, maintaining business records, improving our services, and promoting our products where permitted by law.

Consent: Where you have given permission for a specific purpose, such as receiving certain marketing communications or allowing non-essential cookies where consent is required. You may withdraw your consent at any time.

The lawful basis we rely on will depend on the specific processing activity. Where required, we will provide further information about the applicable lawful basis.

The following services may process personal information on our behalf or in connection with your use of our websites. The exact services and data involved may vary by activity.

8.1 Online Store and Payments

Shopify hosts our online store and any personal information required to operate the store, and process orders may be stored and processed through Shopify in accordance with its privacy policy: https://www.shopify.com/legal/privacy

Payments may be processed by Shopify and/or the payment provider selected at checkout. Relevant providers may include PayPal and Square. Please consult the provider's privacy notice for details of its processing and retention practices.

·         Shopify Privacy Policy: https://www.shopify.com/legal/privacy

·         PayPal Privacy Statement: https://www.paypal.com/uk/legalhub/paypal/privacy-full

·         Square Privacy Notice: https://squareup.com/gb/en/legal/general/privacy

8.2 Analytics and Website Performance

We use Shopify Analytics and Google Search Console to help understand and monitor aspects of our online store and website performance. The information available to us and the information processed by each service may differ. Further details are available in the relevant provider privacy information.

9.       Marketing Communications

We use Mailchimp to collect and manage email addresses for our mailing list, and Mailjet to send marketing emails and updates. These services process personal information on our behalf to help us manage our mailing list and communicate with subscribers.

We will only send marketing communications where we have the appropriate permission or other lawful basis to do so. You can unsubscribe from marketing emails at any time by using the unsubscribe link included in our emails or by contacting us directly.

We may retain basic information about your marketing preferences and whether emails have been delivered or opened, where this information is available through our email marketing services.

10.   Cookies

Our website uses cookies and similar technologies to operate effectively, remember preferences, understand performance, and improve customer experience. Our websites may use cookies and similar technologies to support essential functions, remember preferences, understand website performance, and improve the user experience. The cookies and technologies used may differ between our websites.

Strictly necessary cookies may be used where required for website functions. Where consent is legally required for analytics, advertising, or other non-essential cookies, we will seek consent before placing or using them. You can manage available cookie choices through the website's cookie controls and/or your browser settings. Blocking some cookies may affect website functionality.

11.   Sharing and Processing of Information

We do not sell your personal information. We may share personal information where necessary for the purposes described in this policy, including with service providers acting on our behalf or organisations that provide services directly to you.

Depending on the activity, these may include Shopify, Mailjet, Mailchimp, relevant payment providers such as PayPal and Square, delivery partners, IT and website providers, professional advisers, and third-party platforms or advertising services such as LinkedIn Lead Gen Forms where used.

We may also disclose personal information where required by law, to respond to lawful requests from public authorities, or to establish, exercise or defend legal claims. Service providers may act as processors or as independent controllers depending on the service they provide. Where required, we put appropriate data-processing arrangements in place.

12.   International Transfers

Some of the third-party service providers we use may process or store personal information outside the United Kingdom. This may include providers that support our websites, online orders, payment processing, and email marketing.

Where personal information is transferred outside the UK, we will take steps to ensure that the transfer complies with applicable data protection law and that appropriate safeguards are in place where required.

Further information about how individual service providers manage personal information can be found in their respective privacy policies.

13.   How Long We Keep Personal Information

We retain personal information only for as long as necessary to fulfil the purposes for which it was collected, comply with legal obligations and maintain appropriate business records.

The retention period depends on the type of information, the reason it was collected and any applicable legal or accounting requirements. When information is no longer needed, we will take appropriate steps to delete it securely or anonymise it where appropriate.

14.   How We Protect Personal Information

We use appropriate technical and organisational measures intended to protect personal information against unauthorised access, loss, misuse, alteration, or disclosure. Access to personal information is limited to those who need it for legitimate business purposes, and we expect service providers handling information on our behalf to apply appropriate protections.

No method of transmitting or storing information can be guaranteed to be completely secure, but we take reasonable steps to protect the information we hold.

15.   Your Data Protection Rights

Depending on the circumstances and subject to the conditions and exemptions in data protection law, you may have the right to:

·         Request access to the personal information we hold about you.

·         Ask us to correct inaccurate or incomplete information.

·         Request erasure of your personal information.

·         Request restriction of processing.

·         Object to processing in certain circumstances, including direct marketing.

·         Request transfer of information you have provided to us, where the right to data portability applies.

·         Withdraw consent where we rely on consent to process your information. Withdrawal does not affect the lawfulness of processing conducted before consent was withdrawn.

To exercise a right, contact us using the details in Section 4. We may need to verify your identity before responding. We will respond within the time limits set by applicable law. Not every right applies in every situation.

16.   Complaints

If you have concerns about how we use your personal information, please contact us first using the details in Section 4 so that we can try to resolve your concern.

You also have the right to complain to the Information Commissioner's Office (ICO), the UK data protection regulator. Information is available at https://ico.org.uk/ and the ICO can be contacted on 0303 123 1113.

17.   Third-Party Websites

Our websites may contain links to third-party websites or services. Those websites operate under their own privacy policies and practices. We are not responsible for the privacy practices of third-party websites, and we encourage you to read their privacy information before providing personal information.

18.   Changes to this Policy

We may update this policy from time to time to reflect changes in our practices, services, or legal requirements. The latest version will be published on our websites, with the date of the latest update shown at the beginning of the policy.