Data Processing Statement

This Data Processing Statement supplements our Privacy Policy. It describes how Waynes Trading (“we”, “us”) collects, processes and protects personal data submitted through this website, in accordance with the EU General Data Protection Regulation (Regulation (EU) 2016/679, “GDPR”).

It applies to personal data provided by visitors, prospective commercial partners, suppliers and applicants using our digital forms.

Waynes Trading acts as the data controller for personal data collected through this website. We determine the purposes and means of processing.

Where we engage service providers (such as hosting or analytics providers) that process personal data on our behalf, those providers act as data processors under our instructions and bound by written agreements that meet the requirements of Article 28 of the GDPR.

We process the following categories of personal data: identification and contact details (name, email, telephone); company and role information; commercial details provided in inquiries or applications (product, origin, quantity, packaging, target markets); and technical data collected automatically (IP address, browser and device information).

We do not process special categories of personal data (Article 9) unless you voluntarily include such information in a message, in which case we will process it only with your explicit consent.

We process personal data to: respond to inquiries and commercial requests; assess supplier, brand and distribution-partner applications; coordinate qualification and sample processes; communicate regarding potential collaboration; operate and secure the website; and comply with legal obligations.

The lawful bases are consent (Article 6(1)(a)), performance of pre-contractual steps (Article 6(1)(b)), and legitimate interests (Article 6(1)(f)), as described in our Privacy Policy.

We process personal data in accordance with the principles of Article 5 of the GDPR: lawfulness, fairness and transparency; purpose limitation; data minimisation; accuracy; storage limitation; and integrity and confidentiality.

We collect only the data necessary for the stated purposes and keep it only as long as needed, as described in our retention policy.

We implement appropriate technical and organisational measures, including: encryption of data in transit; role-based access controls limiting access to authorised personnel; secure hosting environments; and regular review of processing activities.

In the event of a personal data breach likely to result in a risk to your rights and freedoms, we will notify the competent supervisory authority without undue delay and, where required, communicate the breach to you.

Personal data is retained only for as long as necessary to fulfil the purposes for which it was collected, including to meet legal or regulatory obligations. Inquiry and application data is kept for the evaluation period and a reasonable time thereafter.

You may request deletion of your data where no legal basis for retention remains, subject to applicable record-keeping requirements.

As an international business, we may transfer personal data outside the European Economic Area. Where this occurs, we ensure an adequate level of protection through Commission adequacy decisions, Standard Contractual Clauses or other lawful transfer mechanisms under Chapter V of the GDPR.

A copy of the safeguards applied is available on request.

You have the rights of access, rectification, erasure, restriction, objection, portability and the right to withdraw consent, as set out in the GDPR and detailed in our Privacy Policy. You may also lodge a complaint with a supervisory authority.

To exercise these rights, contact us at hareton@waynestrading.com. We respond within one month, extended where necessary for complex requests.

Where a formal commercial relationship is established and we act as a processor of personal data on behalf of a partner, we enter into a Data Processing Agreement reflecting the requirements of Article 28 of the GDPR before any processing begins.

Such agreements define subject matter, duration, nature and purpose of processing, data categories, obligations of the parties and the technical and organisational measures applied.

For any questions about this Data Processing Statement or your personal data, contact us at hareton@waynestrading.com.