Privacy policy

We are established in the European Union, and we process personal data in accordance with the EU General Data Protection Regulation (GDPR) and the Estonian Personal Data Protection Act.

2. What this policy covers

This policy explains how we handle personal data when you visit this website, send us an enquiry, request product samples, or otherwise contact us in the course of business.

We sell to businesses, not to consumers. The personal data we handle is almost always business contact data, meaning the name, work email address, telephone number and employer of a person acting in a professional role.

This policy does not cover the websites of other organisations that we may link to. It also does not cover our processing of employee or job applicant data, which is handled separately.

3. The short version

We want to be direct, because most privacy policies are vague on the points that actually matter.

What we do

• We use Google Analytics to understand, in aggregate, how this website is used, so that we can improve it. Analytics cookies are only set after you agree to them.
• We process the business contact details you send us in a form or by email, so that we can reply, send samples and prepare offers.

What we do not do

• We do not use advertising, remarketing or social media tracking pixels, and we do not use analytics data to target ads at you.
• We do not carry out automated decision-making that has legal or similarly significant effects on you.
• We do not sell, rent or trade personal data. Ever.
• We do not load analytics before you consent, and you can change or withdraw that consent at any time.

4. Personal data we collect

Data you give us in a form

When you request samples or send an enquiry through this website, we collect the information you enter. Depending on the form, this is your name, work email address, telephone number, company name, and the business segment you selected. If you use the short contact form, it is only your name and email address.

Data you give us by email, telephone or at a trade fair

If you contact us directly, we process the contact details and the content of your message so that we can reply and, where relevant, prepare an offer. If you hand us a business card at a trade fair, we process the details on it for the same purpose.

Technical data in server logs

Like effectively every web server, the server hosting this site records limited technical information about requests it receives. This can include your IP address, the date and time of the request, the page or file requested, the response status, and your browser and operating system as reported by your browser.

These logs exist so that the site stays available and secure, for example so that we can investigate errors and abuse. They are not used to build a profile of you.

Usage data collected through Google Analytics

If you agree to analytics cookies, Google Analytics collects information about how you use this website. This includes the pages you view and when, how long you spend on them, the approximate location derived from your IP address at country or city level, the website or campaign that referred you, and technical details such as device type, browser, operating system, screen size and language.

Google Analytics also assigns a randomly generated identifier to your browser, stored in a cookie, so that repeat visits from the same browser can be recognised as one session and one returning visitor. That identifier is pseudonymous. It is not your name, and we do not attempt to link it to your name, your email address or any enquiry you send us.

We use this data in aggregate, to answer questions such as which product pages are read most and where visitors leave the site. We do not use it to identify individual visitors.

Data we do not ask for

We do not ask for special category data, meaning information such as health, political opinions, religious beliefs, trade union membership, genetic or biometric data, or data about your sex life or sexual orientation. Please do not send us such information. We also do not need your personal identification code or payment card details through this website.

5. Why we process it and our legal basis

Under the GDPR we must have a legal basis for each purpose. Ours are set out below.

Where we rely on legitimate interest, we have considered your interests and rights and concluded that the processing is limited, expected in a business context, and not intrusive. You can object to it at any time, as described under your rights below.

6. Cookies and your choices

A cookie is a small file that a website stores in your browser. We use two kinds.

Strictly necessary cookies

These are needed for the site to function and for security, and to remember the cookie choice you made. Under EU law they do not require consent, and they cannot be switched off.

Analytics cookies

These are set by Google Analytics and they require your consent. When you first visit, our cookie banner asks whether you accept them. Until you accept, no analytics cookies are set and no analytics data is sent to Google. If you decline, the site works exactly as it would otherwise.

How to change your mind

You can withdraw or change your cookie consent at any time using the cookie settings link in the footer of this website. You can also delete cookies in your browser settings, or block them entirely, in which case the informational parts of this site will still work normally.

Google also provides a browser add-on that prevents Google Analytics from collecting data on any website, available at tools.google.com/dlpage/gaoptout.

We do not use advertising or remarketing cookies, social media plug-in cookies, browser fingerprinting, or local storage for tracking.

7. Google Analytics in detail

We use Google Analytics 4, a web analytics service provided by Google Ireland Limited, Gordon House, Barrow Street, Dublin 4, Ireland. Google acts as our data processor for this purpose, under Google’s data processing terms, and processes the data on our instructions.

Two points that are commonly misunderstood, and that we think you should know:

• IP addresses. Google Analytics 4 uses your IP address to derive an approximate location, and then discards it. It does not log or store IP addresses in the analytics reports we see.
• We do not enable Google Signals, advertising personalisation or audience export to advertising products. The analytics data is used for measurement only, not to build advertising audiences.

Google may process this data on servers outside the European Economic Area, including in the United States. See the section on transfers below for the safeguards that apply.

Google’s own explanation of how it handles data from sites that use its services is published at policies.google.com/technologies/partner-sites, and its privacy policy at policies.google.com/privacy.

We deliver Google Analytics through Google Tag Manager, which is a tool for managing the tags on our site. Google Tag Manager does not itself set analytics cookies or collect personal data for its own purposes.

8. Who we share personal data with

We do not sell personal data and we do not share it for anyone else’s marketing. We do share it with a small number of service providers who process it on our behalf, under written data processing agreements, and only on our instructions:

• Google Ireland Limited, for website analytics through Google Analytics and Google Tag Manager, where you have consented to analytics cookies.
• Our website hosting and email service providers, who necessarily process form submissions and correspondence in order to deliver those services.
• Our IT support and software providers, where access to data is unavoidable in the course of maintenance.
• Our accountants and auditors, for accounting and statutory reporting.
• Transport and logistics partners, where a delivery address and contact person are needed to deliver samples or goods.
• Legal and professional advisers, where necessary to protect our rights.

We may also disclose personal data where we are legally required to do so, for example to a supervisory authority, a court, or a certification body carrying out an audit.

9. Transfers outside the EEA

We aim to keep personal data within the European Economic Area. There is one routine exception.

Google Analytics. Our contracting entity is Google Ireland Limited, inside the EU, but Google may process analytics data on servers in the United States and other countries. Two safeguards apply. Google LLC is certified under the EU-US Data Privacy Framework, which the European Commission recognised as providing an adequate level of protection in its adequacy decision of 10 July 2023. In addition, Google’s data processing terms incorporate the European Commission’s Standard Contractual Clauses, together with supplementary technical and organisational measures.

Because analytics only runs if you consent to it, you can avoid this transfer entirely by declining analytics cookies.

Where any other service provider processes personal data outside the EEA, we ensure an appropriate safeguard is in place, meaning either an adequacy decision by the European Commission or Standard Contractual Clauses with any additional measures required. You can ask us for information about the safeguards that apply to a specific transfer by writing to info@jpfoods.eu.

10. How long we keep personal data

We keep personal data only for as long as we need it for the purpose we collected it for, and then delete it or anonymise it.

11. How we protect personal data

We apply appropriate technical and organisational measures to protect personal data against unauthorised access, loss and misuse. These include encrypted connections to this website, access controls so that staff can only reach the data they need for their work, and confidentiality obligations for employees and service providers.

No system can be guaranteed to be completely secure. If a personal data breach occurs that is likely to result in a risk to your rights and freedoms, we will notify the Estonian Data Protection Inspectorate, and you where the law requires it.

12. Your rights

Under the GDPR you have the following rights in relation to your personal data:

• You can ask for a copy of the personal data we hold about you, and information about how we use it.
• You can ask us to correct data that is inaccurate, or to complete data that is incomplete.
• You can ask us to delete your data where we no longer have a valid reason to keep it. This right does not extend to records we must retain by law, such as accounting documents.
• You can ask us to limit our processing while a dispute about accuracy or lawfulness is resolved.
• You can object to processing that we base on legitimate interest. You can object to direct marketing at any time, and we will stop.
• Where we process data based on your consent or a contract by automated means, you can ask to receive it in a structured, commonly used, machine-readable format, or to have it sent to another controller.
• Withdrawing consent. Where we rely on your consent, such as for analytics cookies, you can withdraw it at any time using the cookie settings link in the footer, with no need to contact us. Withdrawing consent does not affect processing carried out before you withdrew it.
• Human decisions. We do not carry out automated decision-making that has legal or similarly significant effects, so you are not subject to decisions of that kind by us.

To exercise any of these rights, write to info@jpfoods.eu. We will respond within one month. If your request is complex, we may extend that period by up to two further months and will tell you if we do. We may need to ask you for information to confirm your identity, so that we do not disclose data to the wrong person. Exercising these rights is free of charge, unless a request is manifestly unfounded or excessive.

13. How to complain

If you are not satisfied with how we have handled your personal data, please contact us first at info@jpfoods.eu so that we can try to put it right.

You also have the right to lodge a complaint with the Estonian Data Protection Inspectorate, which supervises data protection in Estonia:

If you are located in another EEA country, you may also complain to the supervisory authority where you live or work.

14. Children

This is a business-to-business website and it is not directed at children. We do not knowingly collect personal data from children. If you believe a child has provided us with personal data, please contact us and we will delete it.

15. Changes to this policy

We may update this policy to reflect changes in our practices or in the law. The version in force is always the one published on our website, and the date it took effect is shown at the top. If we make a change that materially affects how we use your personal data, we will take reasonable steps to inform you, and where consent is required we will ask for it before the change takes effect.

16. How to contact us

For any question about this policy or about how we handle personal data, please write to us: