Northwestern Extract Company
Effective date: [Insert date]

Who we are

Northwestern Extract Company (“NEC”, “we”, “us”, or “our”) is committed to protecting the privacy and security of your personal data. This Privacy Policy explains how we collect, use, disclose, and protect personal data when you visit our websites, purchase our products, or interact with us in any way.

NEC is the controller of your personal data where applicable data protection laws designate a controller. Our registered address is [Insert full postal address]. You can contact us using the details in the “How to contact us” section below.

Scope

This Policy covers personal data processed by NEC in connection with our websites, online accounts, product purchases, customer service, marketing activities, events, and other services. Additional notices may apply in specific contexts. If a local law requires something different, that local law will prevail.

The data we collect

Personal data means any information that relates to an identified or identifiable individual. The data we collect will depend on how you interact with us.

Identity data: first name, last name, user name or similar identifier, title, date of birth, and gender.

Contact data: billing and shipping address, email address, telephone number.

Profile data: account credentials, purchase history, saved preferences, survey responses, and feedback.

Financial data: payment card details or bank information processed by us or our payment providers where needed to complete a transaction.

Transaction data: details of products and services you purchased from us and related communications.

Marketing and communications data: your preferences for receiving marketing and how you prefer we contact you.

Interaction and usage data: records of calls, emails, and other communications, as well as information about how you use our websites and services.

Mandatory data: information required to satisfy legal and regulatory obligations such as health and safety records.

Sensitive data: information you choose to share about health or accessibility needs so we can support you, subject to applicable law.

Technical data: IP address, login data, browser type and version, time zone and location, operating system, and device identifiers collected through cookies and similar technologies.

CCTV data: if you visit NEC premises covered by security cameras, footage may be recorded for security and safety.

How we collect data

Direct interactions: you provide data by creating an account, placing an order, contacting customer support, entering a contest, or completing a form.

Automated technologies: we collect Technical data as you use our sites through cookies, server logs, and similar tools. See our Cookie Notice for details.

Third parties and public sources: we may receive data from analytics providers, advertising networks, payment and delivery partners, fraud prevention services, data brokers, and public registers where lawful.

How we use your data

We only use your personal data where the law allows. Common purposes include:

To register you as a customer.

To process and deliver orders including payments, fees, charges, shipping, and returns.

To manage our relationship including account administration, service notices, policy updates, and requests for feedback.

To run promotions, surveys, and events.

To administer and protect our business and websites including troubleshooting, data analysis, testing, maintenance, and fraud prevention.

To deliver relevant content and ads and to measure their effectiveness.

To improve our products, services, and user experience through analytics and research.

To market products or services that may interest you, subject to your choices.

To comply with legal obligations and to establish, exercise, or defend legal claims.

Legal bases

Depending on your location, we rely on one or more of the following legal bases: performance of a contract, compliance with legal obligations, legitimate interests that are not overridden by your rights, your consent where required, protection of vital interests, or tasks carried out in the public interest.

If you do not provide data

If you choose not to provide information that we need to perform a contract or meet a legal requirement, we may be unable to provide the related products or services.

Change of purpose

If we plan to use personal data for a new purpose that is not compatible with the original purpose, we will inform you and explain the legal basis unless the law permits otherwise.

Special category data

Where applicable law allows, we may process limited health information you share so we can meet accessibility and safety needs or comply with equality obligations. We will apply additional safeguards as required.

Automated decision making

We do not make decisions that produce legal or similarly significant effects based solely on automated processing without human involvement unless the law allows and appropriate safeguards are in place.

Marketing

We may contact you by email, phone, postal mail, or social media about products, services, and events that may interest you.

You can control your marketing preferences at any time by using the unsubscribe link in our emails or by contacting us. Where required, we will obtain your consent before sending electronic marketing. If you are an existing customer, we may send you marketing about similar products or services, subject to your right to opt out.

Data sharing

We share personal data with trusted third parties that provide services to us, such as payment processing, order fulfillment, shipping, IT hosting, analytics, advertising, customer support, and professional advisers. These parties must use the data only on our instructions and must protect it appropriately.

We may also disclose data where required by law or to regulators, law enforcement, courts, or in connection with a corporate transaction such as a merger, acquisition, or asset sale.

International transfers

Your data may be processed outside your home country. Where we transfer personal data internationally, we will take steps required by applicable law to ensure an adequate level of protection. These steps may include reliance on adequacy decisions, standard contractual clauses, or other lawful transfer mechanisms.

Security

We use technical and organizational measures designed to protect personal data against accidental or unlawful destruction, loss, alteration, unauthorized disclosure, or access. Access is limited to personnel and providers who have a business need and are bound by confidentiality duties. We maintain procedures to detect and respond to potential data incidents and will notify you and regulators where the law requires.

Retention

We retain personal data only as long as necessary for the purposes described in this Policy, including to satisfy legal, accounting, or reporting requirements. We may anonymize data so it no longer identifies you, in which case we may use it without further notice.

Your rights

Depending on your location, you may have rights such as:

Access to your personal data.

Correction of inaccurate data.

Erasure of your data.

Objection to processing.

Restriction of processing.

Portability of your data to another party.

The right to withdraw consent where processing is based on consent.

To exercise your rights, contact us using the details below. We may need to verify your identity. You will not usually have to pay a fee, but we may charge a reasonable fee or decline a request that is unfounded or excessive as permitted by law.

California privacy notice

If you are a California resident, additional disclosures and rights under the California Consumer Privacy Act and related regulations may apply. See our California Privacy Notice for details on the categories of personal information we collect, the sources, purposes, disclosures for business purposes, and your rights to know, delete, correct, or opt out of sale or sharing.

EEA and UK privacy notice

If you are in the EEA or UK, you have the rights set out in the GDPR or UK GDPR. Where required, NEC has appointed an EU and or UK representative, and you may contact our Data Protection Officer as provided below.

Cookies

We use cookies and similar technologies to operate our sites, remember preferences, analyze traffic, and personalize content and ads. For details on the types of cookies we use and how to manage your choices, see our Cookie Notice.

How to contact us

Privacy Office
Northwestern Extract Company
[Insert full postal address]
Email: [[email protected]]
If you are in the EEA or UK, you may also contact our Data Protection Officer at [Insert DPO details or service address].

Complaints

If you have concerns, please contact us first and we will try to resolve them. You may also have the right to complain to your local data protection authority.

EEA: Data Protection Commission or your local supervisory authority.

UK: Information Commissioner’s Office.

United States: your state attorney general or other applicable authority.

Changes to this Policy

We may update this Policy from time to time. If we make material changes, we will post the updated version on our website and adjust the effective date above. We may also notify you by other means where appropriate.