At Vestey Holdings we take your privacy very seriously and we ask you to read our Privacy Notice before providing us with any personal data. This document explains how we collect, store and handle your personal data.
This is the Privacy Notice of Vestey Holdings Limited (“Vestey”), a private company registered in England and Wales with the company number (00066076). Our registered office is at 3rd Floor, 7 Howick Place, London, SW1P 1BB .
Vestey have a number of operating subsidiary companies (“Group Companies”) with which Vestey will occasionally share personal data, as detailed in this Privacy Notice.
If you have any questions about how we look after your personal data, you can contact us:
For the purposes of relevant data protection legislation, we are a controller of your personal data and as a controller we use the personal data we hold about you in accordance with this Privacy Notice.
For the purposes of UK GDPR, if you wish to make a data protection complaint, please contact us here at general@vestey.com and we will acknowledge receipt of the complaint within 30 days. You also have the right to make a complaint at any time to the Information Commissioner’s Office (ICO) or the equivalent supervisory authority for data protection issues.
When you contact Vestey via our website, by email, over the telephone or by post, we collect personal data about you to enable us to effectively answer your enquiry or fulfil your order. This personal data includes:
We obtain your personal data from the following sources:
(a) Directly from you, either in person (at our locations or otherwise), via our website or by telephone or email. This could include personal data which you provide when you:
(b) Cookies, server logs and other similar technologies. We may automatically collect Information Technology Data about your equipment, browsing actions and patterns by using cookies, server logs and other similar technologies. If you have any questions about our use of cookies, see our Cookies Policy on our website or you can contact us at general@vestey.com;
(c) Publicly available sources, such as:
(d) Our operating subsidiary companies and Group Companies.
We collect personal data about you in order to:
(a) perform our contractual obligations to you. This would include:
(b) use your personal data for health and safety requirements;
(c) use your personal data in an official role which we have been designated to carry out by an official authority (e.g. the government) or where we are otherwise carrying out tasks which are in the public interest (e.g. which have been designated as such by government, or which would otherwise be deemed in the public interest);
(d) manage our relationship with you including:
(e) administer our business and carry out business activities;
(f) protect our business including to deal with any misuse of our website and to comply with our security policies at our locations;
(g) detect and prevent fraud and other illegal activities (and to assist regulators, trade bodies and law enforcement agencies in relation to the same);
(h) make suggestions and recommendations to you about goods or services that may be of interest to you;
(i) sell, make ready for sale, financing or dispose of our business in whole or in part including to any potential buyer or their advisers;
(j) enforce or apply our terms of use, terms and conditions of supply and other agreements with third parties;
(k) use our knowledge of any health-related personal data you disclose to us in the event of illness or injury or some other related emergency or to record any accident or injury or other incident you may suffer when visiting any of our locations; or
(l) investigate and defend any third-party claims or allegations.
Where we may rely on consent
For certain purposes it may be appropriate for us to obtain your prior consent. The legal basis of consent is only used by us in relation to processing that is entirely voluntary – it is not used for processing that is necessary or obligatory in any way.
In the event that we rely on your consent, you may at any time withdraw the specific consent you give to our processing your personal data. Please contact us using the contact details set out in paragraph 1 to do so. Please note even if you withdraw consent for us to use your personal data for a particular purpose we may continue to rely on other bases to process your personal data for other purposes.
Other legal basis
Where we are relying on a basis other than your consent, the lawful basis for processing personal data will be one of the following:
In particular, our legitimate interests include:
We may disclose your personal data to:
(a) our Group Companies and affiliates or third party data processers who may process data on our behalf to enable us to carry out our usual business practices. Any such disclosure will only be so that we can process your personal data for the purposes set out in this Privacy Notice;
(b) HMRC or other tax authorities, legal and other regulators or authorities (e.g. the Information Commissioners Office), including those who request your personal data or to report any potential or actual breach of applicable law or regulation;
(c) external professional advisers such as accountants, bankers, insurers, auditors and lawyers;
(d) law enforcement agencies (e.g. the police or the Serious Fraud Office), courts or other relevant party, to the extent necessary for the establishment, exercise or defence of legal rights;
(e) third parties where necessary for the purposes of prevention, investigation, detection or prosecution of criminal offences or the execution of criminal penalties; or
(f) third parties which are considering or have decided to acquire some or all of our assets or shares, merge with us or to whom we may transfer our business (including in the event of a reorganisation, dissolution or liquidation).
If we believe that your enquiry will be best served or answered by one of our Group Companies we will pass your personal data on to them. As some of these Group Companies are located in countries outside the United Kingdom and the European Economic Area (EEA) it is possible that personal data we collect from you may be transferred, stored and/or processed outside of the United Kingdom and the European Economic Area, including Dubai, China or the USA.
In connection with such transfers we will ensure that:
(a) there are appropriate safeguards in place such as binding corporate rules or approved model contractual clauses; or
(b) the transfer is to a country that provides an adequate or equivalent level of protection; or
(c) one of the derogations for specific situations applies to the transfer including explicit consent or necessary for the performance of a contract or exercise or defence of legal claims.
We will store your personal data for the time period which is appropriate in accordance with the following criteria:
We keep the length of time that we hold your personal data for under review. These reviews take place periodically.
In certain circumstances the provision of personal data by you is a requirement to comply with the law or a contract, or necessary to enter into a contract.
If you do not provide your personal data then the consequences of failing to provide your personal data are that we may not be able to perform to the level you expect under our contract with you.
We do not currently use automated decision-making tools that produce legal effects or similarly significantly affect you. If this changes, we will update this Privacy Notice and provide you with information about the decision, including the logic involved, the main factors and criteria used in the decision-making, and the significance and envisaged consequences for you. When automated decision-making is used, you will be informed when we first communicate with you of the existence of such automated decision-making, meaningful information about the logic involved and the significance and envisaged consequences for you.
If, for any reason, you are unsure about the personal data we are holding in your name, please contact us. We will happily review your details and update the records if required. You can contact us by email, phone or letter.
You have a number of rights under data protection laws; these are summarised below.
(a) the right to request access to your personal data that we process or control;
(b) the right to request rectification of any inaccuracies in your personal data or, taking into account the purposes of our processing, to request that incomplete data is completed;
(c) the right to request, on legitimate grounds as specified in law:
(d) the right to object, on legitimate grounds as specified in law, to the processing of your personal data;
(e) the right to receive your personal data in a structured, commonly used and machine-readable format and to have your personal data transferred to another controller, to the extent applicable in law; and
(f) the right to lodge complaints regarding the processing of your personal data with us and the Information Commissioner’s Office or other relevant supervisory body. Please see https://ico.org.uk/concerns/ for how to do this.
If you would like to exercise any of the rights set out above, please contact us using the contact details set out in paragraph 1.
We regularly review our privacy policy. Any changes to our privacy policy will be posted on this site so that you may ensure that you are fully informed of your rights and can notify us of any changes to your preferences. We last updated this policy on 26 June 2026.
This policy only applies to us. If you link to another website from our website, you should remember to read and understand that website’s privacy policy as well. We do not control unconnected third-party websites and are not responsible for any use of your personal data that is made by unconnected third-party websites.