Privacy policy
Cornthwaite Group : Privacy Policy
Last updated 06/02/2025
1. How to contact us
1.1 We have a dedicated Data Protection team, led by our Data Privacy Manager, Claire Cornthwaite, Director. Claire can be contacted at data.privacy@cornthwaitegroup.com or 01704 790008.
1.2 Cornthwaite Group are committed to protecting and respecting your privacy. This Privacy Policy sets out the basis on which we hold personal data relating to our customers and prospective customers, and how this data will be processed by us. This policy also explains your privacy rights, how the law protects you and how your data protection rights are adhered to by Cornthwaite Group.
1.3 Further explanations may be provided for specific pages or features of our website(s) or business processes, to help you understand how we, this website and its third parties (if any) interact with you.
2. Who are we?
2.1 When we refer to ‘we’, ‘us’, ‘our’ in this policy, this refers to Cornthwaite Agricultural Ltd, a company registered in the UK under company number 06236827 and has its registered office at Hall Lane, Bispham Green, Ormskirk, Lancashire, L40 3SB.
2.2 Cornthwaite Agricultural Ltd (trading as Cornthwaite Group) are a company who supply agricultural machinery and groundcare equipment, with the main franchise being John Deere. We service and support the agricultural industry in north Shropshire, Cheshire, Lancashire, Cumbria and Dumfries & Galloway.
3. How do we collect your personal data?
Whether you are an individual, a business or a representative of a business, the main ways we collect your information include:
3.1 If you contact us directly, e.g. via our websites, phone, email, face to face, to make an enquiry, or request information about our products and services.
3.2 If you provide us with your details at a show or event.
3.3 If you buy a product, or service directly from us.
3.4 If you use any of our products or services, such as websites, social media.
3.5 If you reply to our direct marketing campaigns (e.g. filling out a response form).
3.6 If your contact details are transferred to us from other third parties (e.g. Shopify).
3.7 If your machinery data (incl. vehicle identification number) is transferred to us while you’re having your machinery serviced or repaired.
3.8 If you submit a job application via our website, recruitment email, or other recruitment websites we use. Please see our Job Application Privacy Notice.
3.9 If you subscribe to our marketing mailing list.
4. Important Information
4.1 Our website is not intended for use by children, and we do not knowingly collect data relating to children. If you are a child, please do not use our website or provide us with any of your information.
4.2 Please help us to keep your information up to date by informing us of any changes to your contact details, preferences or any other information.
5. What is the information we may collect about you?
We do not collect special category personal data from our customers, prospective customers, or website users. The following types of personal information may be collected about you:
5.1 Contact details including name, address, phone number, email address, VAT number.
5.2 Interests including any information you have provided to us about your interests e.g. new machinery, used machinery, groundcare, parts, service, merchandise, finance offers etc.
5.3 Website and communication usage. For example, how you use our websites and apps and whether you open or forward our communications, including information collected through cookies and other tracking technologies (please see our Cookie Policy) or app specific privacy policy and terms and conditions (available within the app) for more information).
5.4 Enquiries sent in via our website, social media, phone conversations, emails and face to face meetings. This information is provided by you at your discretion.
5.5 Identifiers assigned to your computer or other internet connected device including your Internet Protocol (IP) address and machinery details.
5.6 Information relating to purchases and services, including cheque, card and BACs payments, as well as complaints and claims.
5.7 Information which enables us to confirm your identity such as government issued photo identity, passport or driving license.
5.8 Information which enables us to confirm your driving eligibility (for demonstration equipment)
5.9 Information that enables us to conduct our risk management activities such as the identification of fraud, offences, suspicious transactions, politically exposed persons (PEP’s) and Sanctioned Parties.
5.10 Information about how you use our products and services (including usage via your mobile phone or agricultural machinery).
5.11 Travel and Hospitality Information. E.g. if you provide us information which enables us to make arrangements for you when attending a branded event. Depending on the scenario, this could include dietary requirements, passport details, arrival and departure times etc.
5.12 Job Application Data. Please see our Job Application Privacy Notice for more information.
5.13 CCTV Images. Information captured by means of closed-circuit television, also known as video surveillance, which is the use of video cameras to transmit a signal to a specific place on a limited set of monitors.
6. How may your personal information be used?
The use of personal information under UK data protection laws must be justified under legal grounds and we are required to set out the grounds in respect of each use in this policy.
The main uses of your information include:
|
|
Purposes/ Activity |
Type of Data |
Lawful Basis for Processing |
3rd Party Processing/ International Transfer Information
|
|
Customer Support |
To respond to customer and prospective customer enquiries and offer excellent customer support. |
We will obtain contact details, and details on the machine/ product/ service or other information you are enquiring about. This will be shared with appropriate employees who can best help with your enquiry or issue.
|
Legitimate interests (we have a legitimate interest in contacting our customers and prospective customers in order to respond to their enquiry.) |
We log enquiries on our John Deere platforms e.g. CRM, Expert Connect etc. to ensure customer enquiries are dealt with efficiently. |
|
Marketing |
To bring you news, offers & events. To send you personalized communication of our product and service information.
Marketing may include telephone, text, email or postal methods and the opportunity to opt out of these will be offered with each campaign.
|
To ensure that you receive relevant communications, we will use data we hold about you to create an individual customer profile. This may include but is not limited to data you have provided to us or which is generated by your use of our products, for example contact details, interests, website, app and communication usage, sales and services information, machinery and service usage, machinery configuration details and machinery/ equipment location information.
|
Legitimate interests (we have a legitimate interest in providing our customers with information relating to our products or services for marketing purposes).
|
We use the 3rd party website, Mailchimp, to process customer data for marketing purposes. |
|
Machinery/ Equipment Sales & Services |
To process your sale, configure and service your machine.
|
We will obtain contact details, payment information, machinery configuration details, machinery technical information and sales and services information when you purchase a machine from us or we service or repair your machinery or equipment. As part of the sale or service we will use this information to provide the services you request and notify you of issues in relation to your machinery. This information may be accessed by Cornthwaite Group to troubleshoot technical or other issues relating to the delivery of these services.
|
The lawful basis for processing this data will be ‘contract’ – having entered a contract with a customer when they purchase a product or service from us. |
None |
|
Other Products & Services |
To process your applications, orders and requests. |
We will obtain contact details and depending on the product or services we may also collect data regarding identity verification, interests, website, app and communication usage, sales and services information, device and service usage, machinery configuration details, machinery location information, travel and hospitality information.
|
The lawful basis for processing this data will be ‘contract’ – having entered a contract with a customer when they purchase a product or service from us. |
None |
|
Teleservices |
To process information about John Deere machinery that customers have purchased to ensure that customers receive the optimum performance from products and services. |
We have access to customer machinery information from John Deere services such as: Contact Details, Vehicle Location Information as well as Device and Service Usage Information. |
The lawful basis for processing this information is ‘Consent’. This information is only received and processed if the customer has consented to this. The customer may opt out or remove their consent at any time through John Deere Operations Centre. For these John Deere Services, customers have given explicit consent for their data to be processed and they can opt out at any time. More information can be found in John Deere Operations Centre Privacy Policy here - https://www.deere.com/en/privacy-and-data/data-services/?cid=VURL_trust
|
John Deere provide these service platforms e.g. JDLink & John Deere Operations Centre. John Deere Service Advisor Remote. If you reside in the UK you can contact John Deere at: John Deere GmbH & Co. KG |
|
Legal Requests for your information |
To comply with our legal obligations, including requests from law enforcement, regulators and the court service.
|
We may be legally required to provide your information to law enforcement agencies, regulators, courts and third-party litigants in connection with proceedings or investigations anywhere in the world.
|
The lawful basis for us processing this information is ‘Legal Obligation’ - the processing is necessary for us to comply with the law. |
The only 3rd party involved would be law enforcement who request the information. |
|
Compliance & Risk Management |
To comply with our compliance and risk management procedures. |
We may process your data such as, identity verification information, driving eligibility information, and financial crime prevention information to identify, for example: · Politically exposed persons · Driving eligibility in order to comply with our insurance obligations (if you drive a vehicle owned by us) · Sanctioned parties
|
The lawful basis for processing this information is ‘legal obligation’. |
None |
|
Security information including CCTV images |
To utilize closed circuit television (CCTV) images to provide a safe and secure environment for staff and visitors. Such images are also used to protect buildings and assets from damage, disruption, vandalism, and other crime to assist in the resolution of disputes which occur on our premises, to assist in the defense of any civil litigation and to support law enforcement bodies in the prevention, detection and prosecution of crime.
|
Closed circuit television (CCTV) images. |
The lawful basis for processing this information is ‘Legitimate Interest’ to keep our staff, customers, and property safe, and also ‘legal obligation’ to aid Health and Safety compliance. |
Our CCTV is hosted by a 3rd party company who are based in the UK. |
|
Online Auction |
To enable you to set up an account & register for our online auctions. Marketing: To receive emails regarding reminders of when the online auctions will be taking place. The opportunity to opt out of these will be offered with each email sent out. Marketing: For re-marketing purposes – these may included telephone, text, email or postal methods and the opportunity to opt out of these will be offered with each campaign. For successful bidders, to process your auction order, including: (a) manage payments, fees and charges; and (b) collect and recover money owed to us. |
To ensure that you can participate in the online auctions by setting up an account – bidders need to share personal details including: Email address, Full Name & Title, Language, Company Name (if applicable), Address, Time Zone, Telephone contact details). We will use data we hold about you to create an individual customer profile. This may include but is not limited to data you have provided to us or which is generated by your use of our online auction, for example contact details, bidding history, website usage, & sales information.
|
The lawful bases are; Legitimate interests (we have a legitimate interest in providing our customers with an account for participating in the online auction & so we can contact them if they make a purchase but also to market to them for future sales); Contract, because bidders will be entering into a contract with Cornthwaite Group and the online auction T&Cs at the point of account registration, and registration for each auction, and to allow us to manage payments, fees, charges and recovery of debts due to us; and Consent, where the customer has given their consent to being contacted in relation to receiving news and marketing material for the auctions, the information is only processed if the customer has consented to this. The customer may opt out or remove their consent at any time.
|
Our online auction software is hosted on our website by ‘Webtron’. Webtron are an Australian company and therefore there will be international transfer of data. Webtron are a Data Processor & we are the Data Controller. The online auction software involves the storage of customer data. We have completed a Transfer Risk Assessment, as recommended by the ICO, because currently there are no adequacy regulations in place for Australia, therefore the transfer of personal data from the UK to Australia is a ‘restricted transfer’.
|
7. How do we keep your personal information safe?
Although data transmission over the internet or website cannot be guaranteed to be secure, we and our business partners work hard to maintain physical, electronic and procedural safeguards to protect your information in accordance with applicable data protection requirements.
8. Who may we share your personal data with?
8.1 Suppliers - Personal data may be shared with John Deere, or our other machinery suppliers, who will use this to register your machinery for warranty purposes and Webtron who host our online auction software for our auction website. We will never sell your personal data to a third party.
8.2 Finance - Data will be shared with finance companies if you enter into a financial contract.
8.3 DVLA - Data will be shared with DVLA to register vehicles that you have purchased.
8.4 Businesses - If the Cornthwaite Group is involved in a merger, acquisition or asset sale, your personal data may be transferred. If a change happens to our business, then the new owners may use your personal data in the same way as set out in this privacy policy.
8.5 Law Enforcement - Under certain circumstances, Cornthwaite Group may be required to disclose your personal data if required to do so by law or in response to valid requests by public authorities (e.g. a court or a government agency).
8.6 Legal Requirements – Cornthwaite Group may disclose your personal data in the good faith belief that such action is necessary to:
(a) Comply with a legal obligation.
(b) Protect and defend the rights or property of Cornthwaite Group
(c) Prevent or investigate possible wrongdoing.
(d) Protect the personal safety of users of our website or the public.
(e) Protect against legal liability.
9. Will we transfer your data out of the EU, and if so, will it be safe?
9.1 We may transfer your personal data to service providers that carry out certain functions on our behalf. This may involve transferring personal data outside the UK to countries which have laws that do not provide the same level of data protection as the UK law.
9.2 Whenever we transfer your personal data out of the UK to service providers, we ensure a similar degree of protection is afforded to it by ensuring that the following safeguards are in place:
(a) We may transfer your personal data to countries that have been deemed by the UK to provide an adequate level of protection for personal data, namely, John Deere who process personal data on our customers in Germany;
(b) We may use specific standard contractual terms approved for use in the UK which give the transferred personal data the same protection as it has in the UK, namely the International Data Transfer Agreement or International Data Transfer Addendum to the European Commission’s standard contractual clauses for international data transfers. For further information, please contact us at data.privacy@cornthwaitegroup.com .
10. How long will we keep your personal information for?
10.1 We retain your information only as long as is necessary for the purpose for which we obtained it and any other permitted linked purposes. If information is used for two purposes, we will retain it until the purpose with the longest period expires.
10.2 We restrict access to your information to only those persons who need to use it for the relevant purpose.
10.3 Our retention periods are based on a combination of legal requirements (where applicable) and business needs. Information that is no longer needed is either irreversibly anonymized or destroyed securely.
10.4 Please contact us at data.privacy@cornthwaitegroup.com if you require information on specific retention periods.
11. Use for marketing
We retain your personal information for marketing, such as contact details and interests as long as is necessary. For example, if you have expressed an interest in one of our products or services, we will keep your information for as long as we have an ongoing dialogue with you, or until such time as you ask us to stop. You retain the right to object to our use of your data for marketing at any point and can opt out by clicking unsubscribe in an email or emailing enquiry@cornthwaitegroup.com to update your marketing preferences.
12. Use to perform contract
In relation to your information used to perform any contractual obligation with you, we may retain that data whilst the contract remains in force plus seven years to deal with any queries or claims thereafter. It is a requirement from HMRC for audit purposes that we retain certain information for this period of time.
13. Security
13.1 We have put in place appropriate security measures to prevent your personal data from being accidentally lost, used or accessed in an unauthorised way, altered or disclosed. In addition, we limit access to your personal data to those employees, agents, contractors and other third parties who have a business need to know. They will only process your personal data on our instructions, and they are subject to a duty of confidentiality.
13.2 We have put in place procedures to deal with any suspected personal data breach and will notify you and any applicable regulator of a breach where we are legally required to do so.
14. What rights do you have in respect of the personal data we hold about you?
14.1 You have the right to:
(a) Be informed about the collection and use of your personal data. This privacy policy, together with any other applicable policies or notices we may issue, provides you with this information.
(b) Have your personal data rectified. This enables you to have any incomplete or inaccurate data we hold about you corrected, though we may need to verify the accuracy of the new data you provide to us.
(c) Have your personal data erased in certain circumstances. This enables you to ask us to delete or remove personal data where there is no good reason for us continuing to process it. You also have the right to ask us to delete or remove your personal data where you have successfully exercised your right to object to processing (see below), where we may have processed your information unlawfully or where we are required to erase your personal data to comply with local law. Note, however, that we may not always be able to comply with your request of erasure for specific legal reasons which will be notified to you, if applicable, at the time of your request.
(d) Object to processing of your personal data where we are relying on a legitimate interest (or those of a third party) as the legal basis for that particular use of your data (including carrying out profiling based on our legitimate interests). In some cases, we may demonstrate that we have compelling legitimate grounds to process your information which override your right to object.
(e) You also have the absolute right to object any time to the processing of your personal data for direct marketing purposes (see the section on Marketing below for details of how to object to receiving direct marketing communications).
(f) Request the transfer of your personal data to you or to a third party. We will provide to you, or a third party you have chosen, your personal data in a structured, commonly used, machine-readable format. Note that this right only applies to automated information which you initially provided consent for us to use or where we used the information to perform a contract with you.
(g) To withdraw consent at any time where we are relying on consent to process your personal data (see the table above details of when we rely on your consent as the legal basis for using your data). However, this will not affect the lawfulness of any processing carried out before you withdraw your consent. If you withdraw your consent, we may not be able to provide certain products or services to you. We will advise you if this is the case at the time you withdraw your consent.
(h) To access the personal data held about you (commonly known as a "subject access request"). This enables you to receive a copy of the personal data we hold about you and to check that we are lawfully processing it.
14.2 Request restriction of processing of your personal data. This enables you to ask us to suspend the processing of your personal data in one of the following scenarios:
(a) If you want us to establish the data's accuracy;
(b) Where our use of the data is unlawful but you do not want us to erase it;
(c) Where you need us to hold the data even if we no longer require it as you need it to establish, exercise or defend legal claims; or
(d) You have objected to our use of your data but we need to verify whether we have overriding legitimate grounds to use it.
14.3 Please contact data.privacy@cornthwaitegroup.com to exercise any of these rights.
14.4 You will not usually have to pay a fee to exercise these rights. However, we may charge a fee if your request is clearly unfounded, repetitive or excessive. Alternatively, we may refuse to comply with your request in these circumstances.
14.5 We may need to request specific information from you to help us confirm your identity and ensure your right to access your personal data (or to exercise any of your other rights). This is a security measure to ensure that personal data is not disclosed to any person who has no right to receive it. We may also contact you to ask you for further information in relation to your request to speed up our response.
14.6 We try to respond to all legitimate requests within one month. Occasionally it could take us longer than a month if your request is particularly complex or you have made a number of requests. In this case, we will notify you and keep you updated.
15. What happens if you don’t provide your information?
There is a contractual requirement to provide certain personal and non-personal data such as name, address, telephone number, email address, VAT number etc. Without this data, we are unable to create a financial contract or a contract of sale for items such as machinery, or for an account with a credit facility.
16. Marketing
16.1 Use of Cookies. We have a dedicated cookie policy.
17. Email Mailing List & Marketing Messages
17.1 We operate an email mailing list program, used to inform subscribers about products, services, offers and/or news we supply/publish.
17.2 Users can subscribe through an online automated process where they have given their explicit permission. Subscriber personal details are collected, processed, managed and stored in accordance with the regulations named in this policy. Subscribers can unsubscribe at any time through an automated online service, or if not available, other means as detailed in the footer of sent marketing messages (or unsubscribe from all Mailchimp lists).
17.3 The type and content of marketing messages subscribers receive, and if it may contain third party content, is clearly outlined at the point of subscription.
17.4 Email marketing messages may contain tracking beacons / tracked clickable links or similar server technologies in order to track subscriber activity within email marketing messages. Where used, such marketing messages may record a range of subscriber data relating to engagement, geographic, demographics and already stored subscriber data. Our EMS (email marketing service) provider is; MailChimp and you can read their privacy policy at the bottom of this page.
17.5 On occasion, Sales Representatives will send marketing emails direct from their company email addresses to several current & potential customers who have been identified as having an interest in the specific content of their email. For example, the used machinery stock list emailed out to relevant customers & potential customers. An opportunity to opt out will be given each time these emails are sent.
18. External Website Links & Third Parties
18.1 Where our website includes external links, clicking on those links or enabling those connections may allow third parties to collect or share data about you. We do not control these third-party websites and are not responsible for their privacy statements. When you leave our website, we encourage you to read the privacy policy of every website you visit.
18.2 Although we only look to include quality, safe and relevant external links, users are advised to adopt a policy of caution before clicking any external web links mentioned throughout this website. External links are clickable text / banner / image links to other websites.
18.3 Shortened URL's; URL shortening is a technique used on the web to shorten URL's (Uniform Resource Locators) to something substantially shorter. This technique is especially used in social media and looks similar to this (example: http://bit.ly/IDFuAk). Users should take caution before clicking on shortened URL links and verify their authenticity before proceeding. We cannot guarantee or verify the contents of any externally linked website despite our best efforts.
18.4 Users should therefore note they click on external links at their own risk, and we cannot be held liable for any damages or implications caused by visiting any external links mentioned.
19. Our Social Media Policy & Usage
We have a dedicated Social Media Policy.
20. Postal Marketing
When promoting marketing campaigns, we may post marketing material to customers and potential customers who have previously purchased something similar to what is being marketed, shown an interest relevant to this material or where we have judged them to have a potential interest e.g. a potential customer, who has not dealt with us before but we know will use products/ services similar to what we are promoting due to the nature of their business.
21. John Deere Expert Connect/ Telephone Communication
21.1 John Deere Expert Connect is a digitalized thread for centralized and connected support, in which users can contact Cornthwaite Group via a recorded system of telephone calls, text/SMS messages or emails.
21.2 The purpose being to enable John Deere dealerships, like Cornthwaite Group, to drive improved customer service.
21.3 When Cornthwaite Group employees are using John Deere Expert Connect, user’s personal data may be collected via recorded telephone calls, text/SMS messages or emails.
21.4 This purpose of call recording is to provide a record of incoming & outgoing calls which can:
(a) Identify staff training needs.
(b) Protect staff from nuisance and abusive calls.
(c) Establish facts relating to incoming/outgoing calls made (e.g. complaints).
(d) Identify any issues in practice processes with a view to improving them.
21.5 Employees will make every reasonable effort to advise callers that their call may be recorded and for what purpose the recording may be used. There is a pre-recorded message within the telephone system.
21.6 The voice file will be stored within a recording system to which the same rules of confidentiality apply.
22. Playback / monitoring of recorded calls
22.1 Monitoring of the call recordings will be undertaken by the relevant Aftersales Manager or employee.
22.2 Any playback of recordings will take place in a private setting and where applicable, individuals should be given the opportunity to listen to relevant recordings to receive feedback and developmental support.
22.3 All recordings will be stored securely online, within the Expert Connect App, and access to these will be controlled and managed by the relevant employees.
22.4 Recordings will be accessed by logging in to a dedicated, password protected online system.
22.5 Calls will be retained by Cornthwaite Group for a period of 5 years.
23. ONLINE AUCTION SOFTWARE
23.1 Our online auction software is hosted on our website [INSERT LINK TO AUCTION WEBSITE] by Webtron.
23.2 Our online auction software stores customer personal data, however, Webtron does not access customer personal data unless it is so requested by Cornthwaite or the online auction website user for the purpose of providing software support.
23. 2 The online auction software involves the storage of Customer data. Webtron and ourselves will process any customer data in accordance with GDPR guidelines.
24. How can you change your marketing preferences?
24.1 You can change your marketing preferences, withdraw your consent for marketing or object to our use of your data for marketing purposes by emailing our Data Privacy Manager, Claire Cornthwaite, at data.privacy@cornthwaitegroup.com or by writing to us at the following address:
Data Privacy Manager
Cornthwaite Group
J36 Rural Auction Centre
Milnthorpe
Cumbria
LA7 7FP
25. Changes to this Privacy Policy
25.1 We may update this Privacy Policy from time to time. If we change this Privacy Policy, the changes will be published here on this website and the ‘Last Updated’ date at the top of this policy will be amended.
25.2 You are advised to review this Privacy Policy periodically for any changes. Changes to this Privacy Policy are effective when they are posted on this page.
26. Complaints
You have the right to make a complaint at any time to the Information Commissioner’s Office (ICO), the UK regulator for data protection issues (www.ico.org.uk). We would, however, appreciate the chance to deal with your concerns before you approach the ICO so please contact us in the first instance.