Last updated: 7 October 2026.
Buy From Farmers Direct (BFFD) is operated by BLACKPEAKSOLUTIONS LTD, a company registered in England and Wales under company number 16819956. Our registered office is 17 High Street, Corby Glen, Grantham, England, NG33 4LU. Our VAT number is GB513280522.
We are the controller responsible for the personal information described in this notice. For privacy questions, requests or complaints, email assistance@buyfromfarmersdirect.co.uk or write to our registered office, marking your correspondence for BFFD privacy.
This notice covers visitors, account holders, members, supplier listings, payment administration, enquiries and our website tools. Our Cookie Policy explains cookies and similar technologies. Agreeing to our terms does not mean agreeing to optional marketing or tracking.
Accounts and memberships. We collect information entered into registration and account forms, including your name, username, email address, account credentials, postcode, county, selected plan, preferences and communication choices. We also process account activity and membership status.
Supplier profiles. We process the business name, address and location, business contact details, website, products, opening times, facilities, images and other details submitted for a listing or verification. Business information can be personal information when it identifies a sole trader or an individual contact.
Payments and support. We process billing details, orders, invoices, subscription status, transaction and refund references, payment status and correspondence. Stripe processes payment details through its payment interface. We receive the payment information needed to administer the order and account; payment records are separate from public supplier profiles. Please do not send complete card details in an email or contact form.
Technical information. Our website and service providers process information such as IP addresses, browser and device details, security and access events, page interactions and cookie or similar identifiers. Optional analytics and marketing technologies are controlled through the cookie settings. An online identifier can still be personal information even when it does not contain your name.
Recipe and location tools. The recipe tool processes the ingredients, timing and dietary selections you submit to generate a response. These are included in a prompt sent through our website to the AI service. A location search processes the place, postcode or location supplied for that search. Please use general recipe requirements and do not include names, medical histories or other sensitive personal details. If you contact us about a health or accessibility need, include only the information necessary for us to respond.
Providing paid services. We use information needed to administer a paid membership, listing, order, payment or cancellation on the basis that it is necessary for our contract with you, or to take steps you request before entering that contract. Where you act for a business rather than as the customer personally, we rely on our legitimate interests in administering that business relationship.
Free accounts and requested tools. We use the information needed to provide and secure free accounts, maintain their settings and operate tools you request. Our basis is our legitimate interests in providing those services, taking account of your expectations and rights, including the additional protection due to younger users. Where a valid contract with you applies and the processing is necessary for it, the contract basis may apply instead.
Enquiries, security and disputes. We use information to answer questions and provide support, relying on our contract with you where relevant, or our legitimate interests in responding to correspondence. Our legitimate interests also include protecting the website, preventing fraud and abuse, maintaining accurate records, enforcing fair terms and establishing or defending legal claims. These interests do not override your rights automatically: processing must be necessary and proportionate.
Legal obligations. We process records needed to comply with tax, accounting and other applicable legal obligations, and to respond to lawful requests from authorities.
Public directory. We use information to provide the supplier listing you or your business request. The basis is our contract with an individual supplier, or our legitimate interests in providing the requested business directory service where the person concerned is a business representative. We do not currently import supplier details from other directories.
Marketing. When you choose to receive marketing, we rely on your consent for the communications described when you subscribe. You can unsubscribe using the link in a marketing email or by contacting us. Opening an account does not itself subscribe you to marketing. We may still send necessary account, payment, security and service messages.
Analytics and marketing tracking. We rely on consent for the optional Google analytics and ActiveCampaign tracking enabled through our cookie settings. Consent can be changed or withdrawn through those settings. Tracking information may be associated with an ActiveCampaign contact where that visitor has been identified. See the Cookie Policy for the technologies and controls.
Before using information for a new purpose, we assess whether that use is permitted by data protection law and provide any required information. Where fresh consent or another legal condition is needed, we obtain or satisfy it before proceeding. Withdrawing consent does not affect processing that was lawful before withdrawal.
Information comes from you, the person or business submitting a supplier listing, interactions with our website and service providers such as our payment processor. We do not currently obtain supplier details from other directories. If we introduce external listing sources, we will first assess the permitted use, lawful basis and privacy information required.
Supplier information submitted for publication appears in the directory and may be indexed by search engines or copied by other people. Please use appropriate business contact details and ensure you are authorised to submit information about another person. Contact us if a profile contains inaccurate information or personal contact details that should not be published.
Where we obtain personal information indirectly, we provide the required privacy information within the applicable period, normally no later than one month, or sooner if we first communicate with the person or disclose their information. The fact that information is available publicly does not make all further uses lawful.
Suppliers independently handle information you give them when contacting them or buying their products. Their own privacy notices apply to those activities. BFFD remains responsible for the personal information it controls.
People working for BFFD and providers supporting the service may access information relevant to their work. Our main provider categories are website hosting and maintenance, email delivery, account administration, payments, customer communications, security, analytics and AI processing. Providers acting on our instructions are processors; some providers also act as independent controllers for their own legal, security or service purposes.
Payments. Stripe receives relevant billing, payment and transaction information to process payments and help prevent fraud. Stripe has its own responsibilities for some of this processing. See Stripe’s privacy notice.
Customer communications. ActiveCampaign supports account contact administration and marketing where you have subscribed. The current account connection uses first name, last name and email address. ActiveCampaign website tracking is a separate optional technology controlled through our cookie settings. See ActiveCampaign’s privacy notice.
Email and website services. Hostinger provides the email service used to send website messages. Hosting, maintenance and security providers process the website information needed to deliver, protect and support the service. Google provides the optional analytics service and anti abuse checks where its reCAPTCHA service is used. See Hostinger’s privacy notice and Google’s privacy notice.
Recipe generation. Anthropic provides the AI service used to generate recipes from the prompt submitted through our website. Anthropic’s published commercial API terms describe processing on its customers’ behalf. Its published default is not to use commercial inputs and outputs for model training; exceptions, such as information deliberately submitted as feedback, are explained in its commercial data guidance. Do not submit personal or medical information to the recipe tool. Generated recipes can be inaccurate: check ingredients, allergens and food safety independently.
International processing. Some of these services involve processing outside the United Kingdom, including in the European Economic Area and the United States. The protection required depends on the recipient and transfer. UK adequacy regulations recognise the European Economic Area. ActiveCampaign states that its US processing is covered by its participation in the UK Extension to the EU US Data Privacy Framework. Stripe also states that it relies on that framework for covered US transfers and incorporates the UK International Data Transfer Addendum into its contractual arrangements. Anthropic’s commercial Data Processing Addendum incorporates standard contractual clauses and a UK addendum. Hostinger’s Data Processing Addendum also contains international transfer provisions.
You can read the providers’ published arrangements here: ActiveCampaign data transfers, Stripe Data Transfers Addendum, Anthropic Data Processing Addendum and Hostinger Data Processing Addendum. Contact us for further information about transfers relevant to your information and copies or details of applicable safeguards.
We may also share relevant information with professional advisers, authorities where lawfully required, or parties involved in a proposed business transfer where appropriate confidentiality and legal protections apply.
Retention depends on the type of information and why it is held. We use the following criteria to decide when information should be deleted or irreversibly anonymised. Closing an account, ending a subscription and removing a public listing do not necessarily remove the payment, complaint or legal records associated with them.
Accounts and supplier listings. Information is kept while it is needed to operate the account or requested listing. When an account closes or a listing is removed, we consider any outstanding service, payment, complaint, fraud prevention or legal issue before deleting the information associated with it. A copy held by a search engine or another website is outside our direct control.
Payment and accounting records. Records needed for company accounting and tax purposes are generally required for six years from the end of the last company financial year to which they relate. A longer period can apply, for example where a transaction spans more than one accounting period, a return is late or an HMRC enquiry is open. The relevant legal obligation and any unresolved dispute determine which records must remain.
Enquiries, complaints and disputes. We consider whether the matter is resolved, whether further correspondence is reasonably expected, and whether information remains necessary for a relevant limitation period, regulatory enquiry or legal claim. We do not retain all account information merely because a limited record is needed for a dispute.
Marketing and preferences. We use marketing contact information while the subscription remains active and justified. After an unsubscribe or objection, a limited suppression record may remain so that we can respect your choice. Evidence of a consent or withdrawal is retained where needed to demonstrate and honour the choice.
Technical records and backups. Retention is determined by the period needed to investigate security events, diagnose faults, maintain the service and recover it from a failure. Copies in backups may remain until the relevant backup is replaced or expires; a restored backup must not be used to disregard a deletion or suppression request.
Recipe processing. Anthropic’s published standard API policy is to delete inputs and outputs within 30 days, with exceptions for legal obligations, safety investigations, particular services and separate contractual arrangements. Its policy permits longer retention for flagged misuse and related safety records. See Anthropic’s commercial retention information. This provider policy does not set the retention period for separate website access, security or support records. Cookie and browser storage durations are described in our Cookie Policy.
Where information is necessary to provide a service or meet a legal obligation, we may be unable to provide that service without it. Optional marketing and tracking remain separate choices.
We are responsible for taking appropriate technical and organisational measures to protect personal information, taking account of the information and the risks involved. No online service can promise absolute security. If you believe an account or personal information has been compromised, contact us promptly.
Depending on the circumstances, you may request access and a copy, correction, erasure, restriction or portability of your information, and object to processing based on legitimate interests. You have an absolute right to object to direct marketing, including related profiling. You can withdraw consent at any time. Some rights have legal exceptions, which we will explain where relevant.
Email assistance@buyfromfarmersdirect.co.uk to exercise a right. We may ask for proportionate information to verify your identity. We normally respond within one month, explaining any lawful extension or permitted adjustment. Account closure, subscription cancellation and erasure of personal information are separate actions; tell us what you would like to achieve and we will help identify the appropriate request.
Younger users. Free accounts are available from age 16. Anyone entering a paid contract must be at least 18. Sixteen and seventeen year old users still have the additional protections that apply to children’s personal information. Please contact us if you believe we hold information about a child who has opened an account below the permitted age, or if a young person needs help understanding or exercising their rights.
Complaints. If you are concerned about our handling of personal information, contact us using the email or postal address above. We will acknowledge a data protection complaint within 30 days, investigate without undue delay and communicate the outcome. Please tell us if you need reasonable support to make a complaint. You may also complain to the UK Information Commissioner’s Office at ico.org.uk/make-a-complaint/. This does not affect other legal remedies.
We date updates to this notice and explain material changes where appropriate. Updating this notice does not retrospectively create consent or authorise an incompatible new use of information.
Want to get food independence, support your local grower, get better prices and shop more privately?
Local food isn’t just something you find. It’s something you protect. A free account helps keep local supply visible, supported, and resilient.
….it takes 30 seconds for food lovers and 5 minutes for suppliers
We built this for people who care where their food comes from. For people who want to remain food secure. For Farmers to get to the local people, who deserve a better income and to deliver a better price for you. For the environmentally conscious and the privacy-conscious. An account simply helps us make the map and supplier reach more useful to you, without changing how open it is. You’re always in control.
Find local food. Stay connected to it. Create a free account to support local producers and be part of a growing food network.
