Non-Customer Privacy Policy – Mamas & Papas UK

New locations including Watford & Poole. Find your nearest store!

Non-Customer Privacy Policy


Mamas & Papas are committed to protecting your personal information. We have published this Privacy policy to ensure that you are fully aware of what personal information we collect from you, how we use it, who we share it with and what your rights are. We have written our Privacy Policy to make it clear, simple and easy to read. We like to make things easier for our customers and that means being clear and open about how and why we use your personal information. We hope that you find it useful and informative.

This policy relates to our franchisees, distributors, partners and wholesale suppliers. If you're looking for our Customer Privacy Policy, please click here


Who are we?

We are a group of companies which includes Mamas & Papas (Stores) Limited, Mamas & Papas (Digital) Limited and Mamas & Papas (Concessions) Limited (collectively called “Mamas & Papas”). Each is a Data Controller responsible for deciding how your personal information is collected, stored and used.


What information do we collect?

When you or your company enters into a contract to become one of our franchisees, distributors, partners or wholesale suppliers, you may provide us with, or we may obtain personal information.

  • If you are a company, the details we collect may include: the telephone number and email address for the Managing Director’s and Directors; employee details (such as store staff members and the accounts department) and a telephone number for each, signatory details, bank account details, other credit accounts.
  • If you are a sole trader or partnership, the details we collect may include: your name, contact number, residential address of each partner, a contact name and number for each store, a personal email address, signatory details, bank account details, other credit accounts.

Depending on the nature of our interactions with you, there may be certain essential personal information that we must collect from you in relation to your relationship with us. This will vary depending on the relationship we have with you.

We will always aim to make it clear which personal information it is necessary for you to provide and which personal information is optional. However, if you are unsure as to whether you are required to provide any particular piece of personal information please ask.

How we use it

We are committed to protecting your privacy and will only use your personal information in accordance with applicable data protection legislation, including the UK General Data Protection Regulation and the Data Protection Act 2018.

We need all the categories of information in the list in paragraph 1 above primarily to allow us to perform our contract with you and to enable us to comply with legal obligations. In some cases we may use your personal information to pursue legitimate interests of our own or those of third parties, provided your interests and fundamental rights do not override those interests. These legitimate interests are to manage our relationship with you, determine our respective rights and obligations and to properly conduct our business. There are more limited circumstances where we process personal data pursuant to your consent.

The situations in which we will process your personal information are listed below.

Purpose Personal Information used Lawful basis
Opening an account All the personal information we collect Necessary for the performance of a contract with you.
Offering credit terms and determining credit status and credit limits Personal details and credit information Necessary for the performance of a contract with you and to fulfil the orders.
Carrying out financial due diligence and other legal checks such as fraud and money laundering as required All the personal information we collect

We have a legal obligation to check satisfy financial and purchasing controls and a legitimate interest to safeguard our business.

It is also necessary for the performance of a contract with you.

Obtaining trading references All the personal information we collect We have a legitimate interest to ensure the conduct and reputation is line with our principles.
Entering, negotiating and concluding the contract Information regarding your disability and work patterns This is necessary for the purposes of carrying out the obligations under our agreement with you.
Promotional offers All the personal information we collect (but not your payment or credit information) We will only send marketing information if we have received your explicit consent. You can unsubscribe at any time by clicking the link at the bottom of any marketing email.
Processing and managing invoices and payment All the personal information we collect We have a legitimate interest to run our company effectively.
Administering the delivery and provision of goods All the personal information we collect Necessary for the performance of a contract with you.
Arranging for the return and collection of products All the personal information we collect Necessary for the performance of our contract with you.
Ongoing contract administration All the personal information we collect We have a legitimate interest to run our company effectively.
Complying with legal obligations such as record keeping All the personal information we collect We have a legal obligation to comply with legislation.
Monitoring account activity All the personal information we collect We have a legitimate interest to run our company effectively.
Auditing the premises All the personal information we collect We have a legitimate interest to run our company effectively and check that you are running your business in accordance with good working principles and producing our products to the required specification (including complying with our ethical principles)
Sale or takeover of our business All the personal information we collect We have a legitimate interest in relation to corporate transactions relating to us.

We also use Creditsafe, a credit reference agency, to satisfy financial and purchasing controls in order to safeguard our business. We will keep a record of our enquiry with a credit reference agency against your name. If you would like further information about Creditsafe and how they process your personal information, click here to review their privacy notice.

If you fail to provide certain information when requested, we may not be able to perform the contract we have entered into with you (for example, open an account or supply and deliver the product to you) or we may be prevented from complying with our legal obligations (such as arranging returns).

We will only use your personal information for the purposes for which we collected it, unless we reasonably consider that we need to use it for another reason and that reason is compatible with the original purpose. If we need to use your personal information for an unrelated purpose, we will notify you and we will explain the legal basis which allows us to do so.

Please note that we may process your personal information without your knowledge or consent, in compliance with the above rules, where this is required or permitted by law.

You will not be subject to decisions that will have a significant impact on you based solely on automated decision-making, unless we have a lawful basis for doing so and we have notified you.

Back to top


What information do we collect from third parties?

Any data processor acting for us will only process your personal information on our instructions and they are subject to a duty of confidentiality. Where a third party is a data controller, i.e. they control how your personal information is used, then they will be subject to compliance with data protection and privacy laws and should provide you with an equivalent privacy notice which sets out the bases and uses they will make of your personal information. Examples would be tax authorities, pension providers and insurance providers

We have put in place procedures to deal with any suspected data security breach or data loss and will notify you and any applicable regulator of a suspected breach where we are legally required to do so.

Our security procedures mean that we may occasionally request proof of identity (we will only accept your driving licence, passport or utility bill) before we are able to disclose personal information to you. We will not keep copies of these documents.


Back to top


What is our legal basis for using your personal information?

We are committed to protecting your privacy and will only use your personal information in accordance with applicable data protection legislation, including the UK General Data Protection Regulation and the Data Protection Act 2018.


Back to top


What happens if I don’t provide my information?

If you fail to provide certain information when requested, we may not be able to perform the contract we have entered into with you (for example, open an account or supply and deliver the product to you) or we may be prevented from complying with our legal obligations (such as arranging returns).


Back to top


Will we use your personal information for automated decision making?

Under certain circumstances, you have the right to object to certain automated decision making processed using your personal information (although this does not currently apply as we do not currently carry out automated decision making).

If you want to review, verify, correct or request erasure of your personal information, object to the processing of your personal data, object to automated decision making or request that we transfer a copy of your personal information to another party, please use the contact details in paragraph 8.


Back to top


Will we change the purpose for using your information?

We will only use your personal information for the purposes for which we collected it, unless we reasonably consider that we need to use it for another reason and that reason is compatible with the original purpose. If we need to use your personal information for an unrelated purpose, we will notify you and we will explain the legal basis which allows us to do so.


Back to top


How long do we keep your information?

The duration for which we retain your personal information will differ depending on the type of information and the reason why we collected it from you. We will not keep your personal information for longer than we need it for and pursuant to the purposes we have explained in this privacy notice. We will keep your personal information for the duration of the contract and for a period of 12 years after it has ceased. If a dispute arises between us, we will keep your personal information until the dispute has been resolved for the purposes of responding to and dealing with this dispute and this may mean that we keep your personal information for longer than is detailed above to enable us to deal with the dispute.


Back to top


Who do we share your information with?

We may share your personal information with the following third parties:

  • Payment processors;
  • Invoice processors;
  • Delivery companies;
  • Marketing service providers (such as DotDigital and MailChimp);
  • Due diligence companies;
  • Carrier companies; and
  • IT companies.

We may also disclose your personal information to third parties if we are under a duty to disclose or share your personal information in order to comply with any legal obligation, or in order to enforce or apply such other terms as apply to our relationship, or to protect rights, property, or safety of our other employees, workers and contractors our customers, ourselves or others with you or where we have a legitimate interest in doing so. This includes exchanging information with other companies and organisations for the purposes of providing references and fraud protection.

”Third parties” includes third-party service providers (including contractors and designated agents) and other entities within the Mamas & Papas Group.

The third parties we share your personal information with where required by law are courts and governmental agencies.

The following activities are carried out by third-party service providers:

  • professional advisors, auditors, administration and IT services. All our third-party service providers and other entities in the group are required to take appropriate security measures to protect your personal information.

We do not allow our third-party service providers who only process data in accordance with our instructions to use your personal data for their own purposes. We only permit them to process your personal data for specified purposes and in accordance with our instructions. Some third parties we share your personal information with process it for their own purposes, and will therefore be a data controller in their own right. This is usually where they are providing you with their own product, services or fulfilling a regulatory or legal function. This would include for example tax authorities, pension providers and insurance providers. They should provide you with their own privacy notice which is equivalent to this privacy notice to explain how your personal information will be used.

We will share your personal information with other entities in our group as part of our regular reporting activities on company performance, in the context of a business reorganisation or group restructuring exercise, for system maintenance support and hosting of data. All members of the Mamas & Papas Group are bound by this privacy notice.

We will share your personal information with other third parties where we are legally obliged or permitted to do so, for example tax authorities, law enforcement authorities, security authorities and other government agencies.

We may share your personal information with other third parties, for example in the context of the possible sale or restructuring of the business. We may also need to share your personal information with a regulator or to otherwise comply with regulatory requirements.

In certain cases the disclosure of your personal information to a third party as described in this paragraph 3 may involve your personal information being transferred outside of the United Kingdom. This may be to:

  • a country that is considered to have data protection rules that are equivalent to those in the United Kingdom; or
  • a country which is not considered to have the same standards of protection for personal data as those in the United Kingdom, in which case we will take all steps required by law to ensure sufficient protections are in place to safeguard your personal information, including where appropriate putting in place contractual terms approved under the Data Protection Act 2018.

For more information about the circumstances in which your personal information may be disclosed to third parties and the safeguards we put in place to protect your personal information when we do so, please contact us as described in paragraph 8.


Back to top


Do we transfer information outside the UK/EEA?

In certain cases the disclosure of your personal information to a third party as described in this paragraph 3 may involve your personal information being transferred outside of the United Kingdom. This may be to:

  • a country that is considered to have data protection rules that are equivalent to those in the United Kingdom; or
  • a country which is not considered to have the same standards of protection for personal data as those in the United Kingdom, in which case we will take all steps required by law to ensure sufficient protections are in place to safeguard your personal information, including where appropriate putting in place contractual terms approved under the Data Protection Act 2018.

For more information about the circumstances in which your personal information may be disclosed to third parties and the safeguards we put in place to protect your personal information when we do so, please contact us as described in paragraph 8.


Back to top


How do we keep your information secure?

We have put in place appropriate security measures to prevent your personal information from being accidentally lost, used or accessed in an unauthorised way, altered or disclosed. In addition, we limit access to your personal information to those employees, agents, contractors and other third parties who have a business need to know or where there is a legal obligation or permission for them to access your personal information. Any data processor acting for us will only process your personal information on our instructions and they are subject to a duty of confidentiality. Where a third party is a data controller, i.e. they control how your personal information is used, then they will be subject to compliance with data protection and privacy laws and should provide you with an equivalent privacy notice which sets out the bases and uses they will make of your personal information. Examples would be tax authorities, pension providers and insurance providers.

We have put in place procedures to deal with any suspected data security breach or data loss and will notify you and any applicable regulator of a suspected breach where we are legally required to do so.

Our security procedures mean that we may occasionally request proof of identity (we will only accept your driving licence, passport or utility bill) before we are able to disclose personal information to you. We will not keep copies of these documents.


Back to top


What are your rights?

The duration for which we retain your personal information will differ depending on the type of information and the reason why we collected it from you. We will not keep your personal information for longer than we need it for and pursuant to the purposes we have explained in this privacy notice. We will keep your personal information for the duration of the contract and for a period of 12 years after it has ceased. If a dispute arises between us, we will keep your personal information until the dispute has been resolved for the purposes of responding to and dealing with this dispute and this may mean that we keep your personal information for longer than is detailed above to enable us to deal with the dispute.

It is important to ensure that the personal information we hold about you is accurate and up-to-date, and you should let us know if anything changes. You can contact us using the details in paragraph 8.

Under certain circumstances, by law you have the right to:

  • the right to be informed about how your personal information is being used;
  • the right to access the personal information we hold about you;
  • the right to request the correction of inaccurate personal information we hold about you;
  • the right to request the erasure of your personal information in certain limited circumstances;
  • the right to restrict processing of your personal information where certain requirements are met;
  • the right to object to the processing of your personal information;
  • request the transfer of your personal information to another party; and
  • the right to object to certain automated decision making processes using your personal information (although this does not currently apply as we do not currently carry out automated decision making).

If you want to review, verify, correct or request erasure of your personal information, object to the processing of your personal data, object to automated decision making or request that we transfer a copy of your personal information to another party, please use the contact details in paragraph 8.

You will not have to pay a fee to access your personal information (or to exercise any of the other rights). However, we may charge a reasonable fee if your request for access is clearly unfounded or excessive. Alternatively, we may refuse to comply with the request in such circumstances.

We may need to request specific information from you to help us confirm your identity and ensure your right to access the information (or to exercise any of your other rights). This is another appropriate security measure to ensure that personal information is not disclosed to or amended by any person who has no right to receive it or amend it.


Back to top


How you can contact us

If you need to contact us about this notice or any matters relating to the personal information we hold on you, you can do so via our Data Protection Officer, at [email protected] or Mamas & Papas Limited, Colne Bridge Road, Huddersfield, HD5 0RH, UK.

This policy was last updated on 24 January 2022. We will update it from time to time, and if we make any changes that could affect you, we’ll let you know before they happen.


Back to top