Personal Data Protection Policy

Privacy Charter - Data Protection & Privacy & Security: Version effective as of: 22/02/2026.

At MOUTTA FARM, the protection of Personal Data (PD) is at the heart of the trust we build with our customers, prospects and employees. We are committed to best protecting your personal information and complying with all applicable European and Irish data protection regulations.

Scope

This policy aims to explain how MOUTTA FARM collects and processes your personal data, in particular through the website www.mouttafarm.co.uk.

It applies to all processing performed by MOUTTA FARM, or by one of its service providers acting on its behalf, regarding the personal data of its customers or prospects, regardless of their nationality or place of residence.

For simplicity, individuals concerned by this policy will hereafter be referred to as “Customers”, “Prospects” or “You”.

This policy also aims to inform you of your rights relating to the processing of personal data carried out by MOUTTA FARM, in particular your right to object, and how you can exercise these rights.

To ensure compliance with Regulation (EU) 2016/679 of the European Parliament and the Council of 27 April 2016, known as the General Data Protection Regulation (GDPR), MOUTTA FARM has appointed a Data Protection Officer (DPO).
The DPO ensures that the data processing is in compliance with the law and meets the purposes set out in this policy.

Principles of Personal Data (PD) Collection 

2.1 – What personal data do we process?

Personal data is any information relating to an identified or identifiable individual, directly or indirectly, especially by cross-referencing information.

For example, this may include a name, a photograph, a postal address, an email address, a phone number, an IP address, a login identifier, or even a voice recording.

The categories of personal data we may process include:

• Personal information: name, surname, postal address, email address, preferences, etc.
• Activity data: purchases, deliveries, participation in loyalty programmes, competitions, exchanges with customer service or after-sales service, etc.
• Bank information: data required to process payments (excerpts of credit card numbers, transactions, etc.).
• Technical and browsing data: login identifiers (password), IP address, browsing history, geolocation data, technical or application logs, etc.

We do not collect any so-called “sensitive” data under GDPR, such as those relating to health, political opinions, religious beliefs, sexual orientation or trade union membership.

Furthermore, MOUTTA FARM does not process data specifically relating to minors.
It is the responsibility of legal guardians to ensure that minors only make purchases or use MOUTTA FARM services with their authorisation and under their supervision.
Where consent is required for processing, it must be given or authorised by the legal representatives of the minor.

2.2 – How do we collect your data?

Your data may be collected at different points in your relationship with MOUTTA FARM, directly from you or via our partners, especially when:

• You make a purchase on the website www.mouttafarm.co.uk;
• You create a customer account;
• You subscribe to our newsletter;
• You browse one of our websites using cookies or other internal or third-party trackers;
• You join a loyalty program. For offers involving financing, our financial partner only shares with us the status of your account (open, active, closed, inactive), never your financial information;
• You contact our customer service or after-sales service;
• You participate in a competition or promotional operation;
• You have consented for your data to be communicated to MOUTTA FARM by a partner;
• You interact with us on social networks, in particular through "Like", "Share", or "Tweet" buttons on our official pages (Facebook, Instagram, X, ...). These interactions can involve data exchanges between the social networks and MOUTTA FARM;
• You view our commercial offers, adverts or promotional emails;
• You give your feedback about a product or shopping experience;
• You complete a questionnaire or satisfaction survey.

When certain information is required to execute a contract or meet a legal obligation, this will be indicated at collection, generally with an asterisk (*).

Personal Data Protection Policy 

Processing refers to an operation, or set of operations, carried out using automated or non-automated means, and applied to personal data.

The personal data collected by MOUTTA FARM is processed by SAS FERME DU MOUTTA, with its registered office at 40 chemin du Moutta – 64330 Boueilh Boueilho Lasque (France).

The Data Protection Officer (DPO) is MOUTTA FARM’s contact for any queries about personal data. You may contact them:

• by mail at the following address: FERME DU MOUTTA, 15 avenue Gay-Lussac – 64140 Lons (France);
• or via the contact form available on the "Contact Us" page of the site.

3.1 – What is the legal basis for our processing?

MOUTTA FARM processes your data for lawful and legitimate purposes. Each processing activity is based on one of the following legal bases:

• execution of a contract,
• the consent of the individual,
• compliance with a legal obligation,
• or the legitimate interest of MOUTTA FARM or a third party.

a) Processing necessary for the execution of a contract or pre-contractual measures

This legal basis applies when processing is necessary for the execution of a contract between you and MOUTTA FARM, or to carry out pre-contractual steps at your request.

Examples of applicable processing include:

• execution of your online purchases;
• management of services (warranties, insurance);
• management of quotes and reservations;
• tracking orders, deliveries, returns or cancellations;
• after-sales service management, handling claims and contractual warranties;
• management of loyalty programmes, gift cards and store credits;
• participation in competitions;
• product recalls;
• transmission of financing requests to our partners;
• management of billing, payments and outstanding debts.

b) Processing based on consent

Where no other legal basis applies, some processing is based on your explicit consent.
This is particularly the case for:

• the management of cookies and marketing trackers, for:
• targeted advertising on behalf of MOUTTA FARM or third parties;
• personalisation of display and content on our website;
• the use of your data for marketing purposes:
• if you are a prospect, to receive offers from MOUTTA FARM by email, SMS, or voice message;
• if you are a customer or prospect, to receive third-party offers via the same channels.

c) Processing based on MOUTTA FARM's legitimate interest

Certain processing activities are carried out on the legal basis of MOUTTA FARM's legitimate interest, provided that your fundamental rights and freedoms are not overridden.

These processing activities include in particular:

• audio recording of calls to customer service or after-sales service;
• improvement of our products, services and offers;
• carrying out satisfaction surveys and gathering customer feedback;
• commercial prospecting (email, SMS, phone, letter) to customers for similar products to those already purchased;
• postal or telephone prospecting, unless opposed via Bloctel;
• acquisition of new clients via partners or affiliation;
• producing statistics and measuring site audience;
• physical security of our premises, personnel and visitors;
• IT security and fraud prevention;
• defending our legal interests in the event of a dispute or litigation.

d) Processing necessary to comply with a legal obligation

Certain processing is required by law, particularly for:

• keeping accounting and tax records;
• managing rights requests (access, rectification, deletion, etc.);
• complying with judicial or administrative orders.

3.2 – Do we make automated decisions?

MOUTTA FARM does not carry out automated decision-making within the meaning of the GDPR.

However, certain data may be processed by third parties (banks, finance providers, payment services) to combat fraud or assess credit applications.

Such processing may result in the automatic refusal of certain suspicious transactions.
In such cases, you can challenge the decision, submit comments, or request human intervention directly with these third parties.

Who do we share your data with?

In connection with its business, MOUTTA FARM may transmit certain personal data to service providers, suppliers or partners, or allow them access.
Such transmission is strictly limited to what is necessary for them to carry out their tasks, in accordance with contractual agreements and applicable regulations.

4.1 – Sharing with our providers and processors

We use a variety of service providers in the following fields:

• IT: hosting, maintenance, security, application support, supervision, backup management, etc.;
• Logistics: order preparation, packaging, shipping, delivery, returns management, etc.;
• Customer relations: call centres, product review management, satisfaction surveys, polls, etc.;
• After-sales service (SAV): diagnostics, repairs, replacements, warranty returns processing, etc.;
• Marketing and communication: prospecting for MOUTTA FARM (mail, email, SMS, phone, voice messages, online campaigns), competition management, advertising agencies, marketing studies, performance analysis, personalised recommendations, vouchers, etc.;
• Financial transactions: payment processing (cheques, credit cards, transfers, etc.).

Some providers act on behalf of MOUTTA FARM without determining the purposes; they are thus data processors within the meaning of the GDPR.

We require contractually that our processors:

• maintain the confidentiality and security of data processed,
• use the data exclusively in line with our instructions,
• retain it only for as long as is necessary to fulfil their tasks.

When providers determine the purposes or means of processing themselves, they are then considered data controllers. In such cases, MOUTTA FARM ensures contractually that your data will be used in line with your expectations and legal requirements.

4.2 – Sharing with partners and third parties

Your data may also be transmitted to commercial partners or third parties in the following cases:

• when we offer products or services in partnership with other companies (e.g.: insurance, consumer credit, gift boxes, additional warranties, etc.);
• where partners are involved in processing which MOUTTA FARM does not undertake directly (e.g.: payment by cheque or card, or funding requests);
• where your products are returned to the manufacturer under warranty;
• where we need to share data with our agents (lawyers, bailiffs, experts) in the course of a dispute or legal proceedings;
• if you are a customer or prospect and your data is used for direct marketing or advertising actions (post, phone, email, SMS, online advertising) on behalf of third-party advertisers, in accordance with regulations and your consent choices.

4.3 – Legal obligations and exceptional transfers

Your data may also be disclosed to administrative or judicial authorities authorised by law, upon explicit and motivated request, in accordance with current regulations.

Finally, in the event of total or partial sale of MOUTTA FARM or its assets, your personal data may be made available to those involved in the transaction (auditors, buyers, advisers, etc.) and included in the transferred assets.

Transfers of Data outside the European Economic Area 

MOUTTA FARM informs you that some of its providers or partners may be located outside the European Economic Area (EEA). In this context, it may be necessary to give them restricted, controlled and secure access to some of your personal data, solely so they can fulfil their tasks.

Such transfers may involve providers located in particular in the United Kingdom or the United States, or more generally in countries not offering a level of protection equivalent to that required by the European Union.

To guarantee the privacy and integrity of your data during these transfers, MOUTTA FARM implements appropriate safeguards, such as signing Standard Contractual Clauses adopted by the European Commission, binding contractual commitments with providers, and, if necessary, additional technical measures such as encryption or pseudonymisation. These measures ensure your data are protected to a level equivalent to that within the European Union, in line with the General Data Protection Regulation (GDPR).

How long do we retain your data? 

We ensure your personal data are not stored for longer than necessary, depending on the needs of relevant activities, contracts, and legal or tax obligations. After the retention or archiving period, your data is deleted or anonymised.

Retention periods by use:

• Product and service purchases: data retained for 5 years after the end of the commercial relationship.
• Commercial prospecting: data retained until consent is withdrawn or for 3 years from the last contact, which may be the last purchase, last opened email, contract end, warranty expiration, or data collection date.
• Call recordings: kept for 1 month from the date of the call.
• Statistical analyses: data retained as per the timeframes above; beyond these periods, data are anonymised.
• Physical security: data kept 1 month from their creation date.
• Bank transactions: kept for the duration of the transaction and, where relevant, the statutory dispute period, with truncated data (maximum 13 months).
• IT security: data retained for 1 year.
• Accounting documents and supporting documents: kept in compliance with applicable legislation. This also includes product recalls, TV licence fees, and processing of your rights requests.
• Judicial or administrative procedures: your data will be retained for the entire duration of the procedure until a final decision is made.

How do we protect your data? 

We ensure your data is processed with an appropriate security level through:

• Technical measures appropriate to the sensitivity of the processing and data, such as traffic filtering, encryption, pseudonymisation, or even physical security of our sites.
• Organisational measures, including segregation of duties and responsibilities, limiting access to operational needs, defining retention periods, implementing controls, and staff awareness.

Particular care is paid to the security of payments and your bank details: we never collect all your banking information (full card number, CVV, expiration date). Only part of the data is used to identify the card used for payment. All your bank information is collected exclusively by our payment providers, PCI-DSS certified, ensuring security compliant with credit card industry standards.

What is our cookie management policy?

When browsing the mouttafarm.co.uk site and its subdomains, cookies and trackers may be placed on your device by your browser or collected by our systems. For their period of validity, these allow us to identify your device on future visits. Partners or providers of MOUTTA FARM, as well as third-party companies, may also deposit or collect cookies and trackers.

Some cookies and trackers are essential for secure navigation and remembering your cart, order, or login details. Others are used to improve your user experience, provide services or offers relevant to your interests, or measure site audience. All purposes of cookies and trackers used are detailed on our cookie management platform, accessible from any page on mouttafarm.co.uk via the footer bar.

Only the issuer of a cookie or tracker can read or modify the information it contains.

You can accept or refuse cookies and trackers at any time via our cookie management platform. Even if you have previously consented, you can withdraw consent at any time.

What are your rights and how do you exercise them?

9.1 - Your rights

You have the following rights regarding your personal data:

• Access and correction: you can access your data and correct it if it is incorrect.
• Objection and restriction: you can object to processing, particularly direct marketing, or request restriction of processing in certain cases.
• Profiling: you can object to any automated processing to create a profile about you.
• Deletion: you can request your data to be deleted when it is no longer necessary or if required by law.
• Portability: you can obtain your data in a usable format when processing is based on your consent or a contract.
• Post-mortem directives: you can define how your data should be retained, deleted or passed on after your death.
• Complaint: you can contact the Data Protection Commission if you believe MOUTTA FARM is not handling your requests correctly.
• Telephone canvassing: you may opt out of cold calling by registering for free on the Bloctel list.

You may exercise these rights at any time. We are committed to responding as quickly as possible, and in any event within one month, except in exceptional cases provided for by regulation, where an additional two months may apply.

9.2 - How to exercise your rights

You may exercise your rights by mail to the following address:

• by mail at: FERME DU MOUTTA, 15 avenue Gay-Lussac – 64140 Lons (France);
• or via the contact form available on the "Contact Us" page of the site.

To ensure rapid and secure processing of your request, some information may be required: name, surname, e-mail, postal address, phone number, loyalty card number, etc. In certain cases (right of access, portability, rights for heirs), you may be asked to provide proof of identity and any relevant supporting documents with your request.

For processing by our service providers, you may also exercise your rights by mail, email or online. A complete list of these providers is available in the appendix.

Amendments and updates to the Personal Data Protection Policy 

This personal data protection policy may be changed or updated at any time. In case of change, the revised version will be published on the mouttafarm.co.uk website, with indication of its last update date.