Privacy Policy | Sourced Meals

Privacy

1. WHO WE ARE
Sourced Meals is a trading name of Dyvine Ltd, a company registered in England and Wales under company number 14288561. Our registered office is 12 Alston Road, Hellesdon, Norwich, Norfolk, NR6 5DS.
Under UK data protection law, Dyvine Ltd is the "data controller" for the personal data described in this policy. That means we decide how and why your personal data is used, and we are responsible for looking after it.
We are registered with the Information Commissioner's Office under registration number [DYVINE LTD ICO NUMBER].
If you have any questions about this policy or about how we use your personal data, you can contact us at:
Email: hello@sourcedmeals.co.uk
Post: Data Protection, Dyvine Ltd, 12 Alston Road, Hellesdon, Norwich, Norfolk, NR6 5DS

2. WHAT THIS POLICY COVERS
This policy explains what personal data we collect when you visit sourcedmeals.co.uk, contact us, sign up to our emails or interact with us on social media. It explains why we collect it, who we share it with, how long we keep it and the rights you have over it.
We have written it in plain English. If anything is unclear, please ask us.
This policy does not cover our Trade Account Portal, which is a separate online service hosted away from this website. When you follow the link to the portal you will be covered by the privacy information published there. See section 14 for more on links to other sites.
We comply with the UK General Data Protection Regulation (UK GDPR), the Data Protection Act 2018 (as amended by the Data (Use and Access) Act 2025) and the Privacy and Electronic Communications Regulations 2003 (PECR).

3. THE PERSONAL DATA WE COLLECT
3.1 Information you give us directly
When you use our contact or stockist enquiry form, we collect your name, email address, telephone number (if you provide it), the name of your business or shop (if you are enquiring about stocking our meals) and whatever you write in your message.
When you sign up to our newsletter, we collect your email address, your name if you choose to give it, and a record of when and how you subscribed.
When you email us, phone us, write to us or message us on social media, we keep a record of that correspondence.
Please do not send us sensitive information through the website unless you need to. If you tell us about an allergy, intolerance or other dietary or health matter so that we can answer a question about our meals, we will treat that information as given with your explicit consent and will use it only to respond to your enquiry.
3.2 Information we collect automatically
When you visit our website, certain technical information is collected automatically by our website platform and, if you agree to it, by analytics and advertising tools. This can include your IP address, browser type and version, device type and operating system, screen size, the website that referred you to us, the pages you view, how long you spend on them, the links you click and your approximate location (city or country level, worked out from your IP address).
Some of this information is collected by cookies and similar technologies. Which tools run on your device depends on the choices you make in our cookie banner. Our Cookie Policy explains this in detail.
3.3 Information from other sources
If you interact with us on Facebook or Instagram (for example by commenting on or sharing a post), we receive the information that the platform makes available to us under your own privacy settings.
If we approach your business about stocking our meals, we may have found your business contact details from your company website, a trade directory, LinkedIn or another public source. We only collect the business contact details we need to get in touch, and you can ask us to stop at any time.

4. WHY WE USE YOUR PERSONAL DATA AND OUR LAWFUL BASIS
The law requires us to have a valid reason, known as a lawful basis, for everything we do with your personal data. The table below sets out each purpose and the lawful basis we rely on.
Purpose: Responding to your enquiries, questions and requests.
What we use: Contact details, business name, the content of your message and our correspondence with you.
Lawful basis: Our legitimate interests in running our business and dealing with the people who contact us. Where your enquiry is about becoming a stockist or entering into an agreement with us, we also rely on the need to take steps at your request before entering into a contract.
Purpose: Sending you our email newsletter and news about our meals, suppliers and offers.
What we use: Email address, name, subscription record and information about whether our emails are opened.
Lawful basis: Your consent, which you give by opting in and can withdraw at any time (see section 5).
Purpose: Understanding how our website is used so that we can improve it.
What we use: Technical and usage information collected by Google Analytics 4, and simple aggregated statistics (such as visitor numbers and popular pages) that Wix compiles for us from the cookies it needs to run the website.
Lawful basis: For Google Analytics, your consent, which you give or refuse through our cookie banner and can change at any time. For Wix's aggregated statistics, our legitimate interests in understanding how the website performs. Wix produces these statistics on our behalf only, they cannot identify you, and you can object at any time.
Purpose: Measuring the effectiveness of our advertising on Facebook and Instagram and showing our adverts to people who have shown an interest in us.
What we use: Technical and usage information collected by the Meta Pixel and Meta Conversions API.
Lawful basis: Your consent, which you give or refuse through our cookie banner and can change at any time.
Purpose: Keeping our website secure, preventing fraud and misuse, and diagnosing technical problems.
What we use: IP address, device and browser information, security logs.
Lawful basis: Our legitimate interests in protecting our website, our business and our visitors.
Purpose: Building and managing relationships with stockists, retailers and other trade contacts, including approaching businesses that may wish to stock our meals.
What we use: Business contact details, business name and role, and our correspondence with you.
Lawful basis: Our legitimate interests in promoting and growing our business. Where we enter into an agreement with your business, the performance of that contract.
Purpose: Complying with our legal obligations, including accounting and tax rules, responding to regulators and handling data protection requests and complaints.
What we use: Whatever information is relevant to the obligation in question.
Lawful basis: Compliance with a legal obligation.
Purpose: Establishing, exercising or defending legal claims.
What we use: Whatever information is relevant to the claim.
Lawful basis: Our legitimate interests in protecting our legal position.
Where we rely on legitimate interests, we have considered the impact on you and are satisfied that our interests are not overridden by your rights. You have the right to object to any processing based on legitimate interests (see section 11).
We do not use your personal data to make automated decisions that have a legal or similarly significant effect on you.\

5. MARKETING EMAILS AND HOW TO OPT OUT
We will only send you marketing emails if you have opted in to receive them. Every email we send includes an unsubscribe link, and you can also opt out at any time by emailing hello@sourcedmeals.co.uk. We will act on your request promptly and will keep a minimal record of your email address on our suppression list so that we do not contact you again by mistake.
We will never sell or rent your contact details. We do not share our newsletter list with other companies for their own marketing, and we do not upload subscriber details to social media platforms to target advertising.
If you are a business contact, we may email you about stocking our meals on the basis of our legitimate interests. You can ask us to stop at any time and we will.

6. COOKIES AND SIMILAR TECHNOLOGIES
Our website uses cookies and similar technologies. We use a consent management tool provided by Usercentrics to ask for your permission before any non-essential cookies are set.
When you first visit our website you will see a cookie banner. You can accept all cookies, decline all non-essential cookies, or choose which categories you are happy with. The categories are:
Essential: needed to make the website work and keep it secure. These are set automatically and cannot be switched off.
Functional: remember settings that change how the website looks or behaves for you.
Analytical: help us understand how the website is used (Google Analytics 4).
Marketing: used to measure our advertising and show you relevant adverts on other platforms (Meta Pixel).
Analytical and marketing tools do not run until you have agreed to them. You can change or withdraw your choices at any time by clicking the fingerprint icon in the bottom left corner of any page, which reopens the banner. Your new choices take effect straight away.
Usercentrics keeps a record of the choices you make, including the time you made them, the categories you accepted or declined and technical information about your browser, so that we can respect your preferences and show that consent was given. Your IP address is used to work out which rules apply to you and is not kept. Consent records are deleted after one year.
Where we embed content from Instagram on our pages, that content is provided by Meta and may set cookies or collect information about your visit when it loads. Meta's own privacy policy applies to that processing.
Full details of the cookies we use, how long they last and how to manage them are set out in our Cookie Policy.

7. WHO WE SHARE YOUR PERSONAL DATA WITH
We share personal data with the following types of organisation, and only to the extent needed for the purposes described in this policy.
Our website platform: Our website is built and hosted on Wix, provided by Wix.com Ltd. Wix stores the information you submit through our forms, holds our contact records and sends our newsletter through Wix Email Marketing. Wix processes this data on our behalf and under our instructions.
Consent management: Usercentrics GmbH, Sendlinger Strasse 7, 80331 Munich, Germany, provides the cookie banner on our website and stores the record of your cookie choices on our behalf. Usercentrics processes this data under our instructions.
Analytics provider: Google Analytics 4, provided by Google Ireland Limited and Google LLC, processes website usage data on our behalf so that we can see how the site is used. Google Analytics is only active if you accept analytics cookies.
Advertising and social media platforms: Meta Platforms Ireland Limited provides the Meta Pixel, the Meta Conversions API and the Instagram content embedded on our site. For the collection and transmission of Pixel data, we and Meta are joint controllers. Meta is independently responsible, under its own privacy policy, for how it uses that data within its own services. The Meta Pixel is only active if you accept advertising cookies.
Our marketing agency: Pollard Media (pollard-media.co.uk) manages our website, advertising and email marketing on our behalf. Pollard Media acts on our instructions and may access the systems described above to carry out that work.
Professional advisers and service providers: Our accountants, solicitors, insurers and IT support providers, where necessary for them to provide their services to us.
Authorities and regulators: The police, courts, HMRC, the Information Commissioner's Office or other public bodies where we are required by law to do so or where it is necessary to protect our rights or the safety of others.
Business transfers: If we sell, transfer or merge all or part of our business, personal data may be passed to the new owner, who will be required to use it in line with this policy.
We do not sell personal data to anyone.

8. INTERNATIONAL TRANSFERS
Some of the organisations we work with store or process personal data outside the United Kingdom.
Wix.com Ltd is based in Israel, a country the UK Government has recognised as providing an adequate level of data protection. Wix also uses data centres and group companies in the United States and elsewhere.
Google and Meta are headquartered in the United States and process data there.
Usercentrics is based in Germany and stores consent records on servers in Germany and Belgium. The UK Government recognises all countries in the European Economic Area as providing an adequate level of data protection.
Whenever personal data leaves the UK we make sure it is protected in a way the law recognises. Depending on the recipient this will be one or more of the following: UK adequacy regulations (which cover Israel and the European Economic Area); the UK Extension to the EU-US Data Privacy Framework, under which Wix.com Inc, Google LLC and Meta Platforms Inc are certified; and the UK International Data Transfer Addendum to the European Commission's Standard Contractual Clauses. In every case we are satisfied that the standard of protection for your personal data is not materially lower than it would be in the UK.
If you would like more information about the safeguards that apply to a particular transfer, please contact us.

9. HOW LONG WE KEEP YOUR PERSONAL DATA
We keep personal data only for as long as we need it for the purpose it was collected, and then we delete it or anonymise it securely. Our usual retention periods are:
Enquiries and correspondence: 12 months after our last contact with you. If your enquiry leads to a trade relationship with us, we keep the related records for 6 years after that relationship ends, which is the period within which legal claims can normally be brought.
Newsletter subscribers: For as long as you remain subscribed. When you unsubscribe we delete your details, keeping only your email address on our suppression list so that we honour your choice, together with a record of when you subscribed and unsubscribed.
Cookie consent records (Usercentrics): One year from the date of your choice, after which they are deleted. Your IP address is not stored.
Website analytics (Google Analytics 4): User-level data is kept for a maximum of 14 months. Aggregated statistics that cannot identify anyone may be kept for longer.
Advertising data (Meta Pixel): The audiences we build from website visits expire within 180 days of your last visit. Meta's own retention periods apply to the data it holds under its privacy policy.
Security and technical logs: Kept by our website platform for a limited period in line with its security practices.
Records needed for legal, accounting or regulatory reasons: For as long as the law requires, typically 6 years.
Records relating to a dispute, complaint or legal claim: Until the matter is fully resolved and any period for appeal has passed.

10. HOW WE KEEP YOUR PERSONAL DATA SECURE
We take appropriate technical and organisational measures to protect your personal data against loss, misuse and unauthorised access. Our website is served over an encrypted connection (HTTPS), access to our systems is restricted to the people who need it, and the providers we use maintain their own recognised security standards.
No method of transmission over the internet is completely secure, so we cannot guarantee absolute security. If a security incident affecting your personal data occurs and the law requires us to notify you, we will do so without undue delay.

11. YOUR RIGHTS
You have the following rights over your personal data. They are free to exercise and we will respond within one month. If your request is particularly complex, we may extend this by up to two further months, and we will tell you if this is the case. If we need to confirm your identity or ask you to clarify your request, the time for responding may be paused until we receive what we need.
The right to be informed: to know how we use your personal data, which is the purpose of this policy.
The right of access: to receive a copy of the personal data we hold about you and information about how we use it.
The right to rectification: to have inaccurate or incomplete personal data corrected.
The right to erasure: to ask us to delete your personal data in certain circumstances, for example where we no longer need it or where you withdraw your consent.
The right to restrict processing: to ask us to limit what we do with your personal data in certain circumstances, for example while we check its accuracy.
The right to data portability: to receive the personal data you have given us in a structured, commonly used, machine-readable format, where we process it by automated means on the basis of your consent or a contract.
The right to object: to object at any time to our use of your personal data for direct marketing, in which case we will stop. You can also object to processing based on our legitimate interests, and we will stop unless we can show compelling grounds that override your interests.
The right to withdraw consent: where we rely on your consent, you can withdraw it at any time. This will not affect the lawfulness of anything we did before you withdrew it.
Rights relating to automated decision-making: we do not make decisions about you using automated means alone that produce legal or similarly significant effects.
To exercise any of these rights, email hello@sourcedmeals.co.uk or write to us at the address in section 1. Please tell us which right you want to exercise and give us enough information to find your records.

12. HOW TO MAKE A COMPLAINT
If you are unhappy with how we have handled your personal data, please tell us so that we can put it right.
You can complain by emailing hello@sourcedmeals.co.uk with "Data protection complaint" in the subject line, or by writing to Data Protection, Dyvine Ltd, 12 Alston Road, Hellesdon, Norwich, Norfolk, NR6 5DS. Please tell us what has happened, when, and what you would like us to do.
We will acknowledge your complaint within 30 days of receiving it, look into it properly, keep you informed of our progress and let you know the outcome without undue delay.
You also have the right to complain to the UK's data protection regulator, the Information Commissioner's Office (ICO), which from 30 September 2026 is formally known as the Information Commission. You can do this at any time, although the ICO generally expects you to have raised your concern with us first.
Information Commissioner's Office
Wycliffe House, Water Lane, Wilmslow, Cheshire, SK9 5AF
Helpline: 0303 123 1113
Website: ico.org.uk/make-a-complaint
You may also have the right to seek a remedy through the courts.

13. CHILDREN
Our website and our marketing are aimed at adults and businesses. We do not knowingly collect personal data from anyone under the age of 13. If you believe a child has given us personal data, please contact us and we will delete it.

14. LINKS TO OTHER WEBSITES AND OUR TRADE ACCOUNT PORTAL
Our website contains links to other websites, including our Trade Account Portal, our social media profiles and the websites of our suppliers and stockists. These sites are operated separately from sourcedmeals.co.uk and have their own privacy policies. We are not responsible for how they handle your personal data, and we encourage you to read their privacy information before providing any details.

15. CHANGES TO THIS POLICY
We review this policy regularly and will update it when our practices or the law change. The date at the top shows when it was last updated. If we make a significant change, we will draw your attention to it on our website or, where appropriate, by email.

16. HOW TO CONTACT US
Dyvine Ltd trading as Sourced Meals
12 Alston Road, Hellesdon, Norwich, Norfolk, NR6 5DS
Email: hello@sourcedmeals.co.uk
Company number: 14288561