Mr Corn Ltd · Last updated: 28/05/2026 · Version 1.0
Short version. We only collect the personal data we need to take and fulfil your order, keep our records straight for HMRC, send you the marketing you’ve asked for, and keep the site working. You can ask us at any time what we hold about you, and you can ask us to delete it (subject to our legal record-keeping obligations).
1. About this notice
This privacy notice explains how Mr Corn Ltd (“we”, “us”, “our”) collects and uses personal data when you visit mrcorn.uk.com, place an order, contact us, sign up to our newsletter, or use any of the other features of our site. It applies to all visitors to the site and to all customers of Mr Corn Ltd.
The notice is written to comply with the UK General Data Protection Regulation (UK GDPR), the Data Protection Act 2018, the Privacy and Electronic Communications Regulations 2003 (PECR), and — where you are in the EU — the EU General Data Protection Regulation (Regulation (EU) 2016/679).
2. Who we are (the data controller)
- Trading name: Mr Corn
- Legal entity: Mr Corn Ltd
- Companies House registration: 16948849
- Registered address: 24 Curtis Farm Business Park, Curtis Farm, Fobbing, Essex, SS17 9JJ, United Kingdom
- ICO data-protection registration: Application submitted — registration number will be added to this notice as soon as the ICO confirms.
- VAT registration: Mr Corn Ltd is not currently VAT-registered.
- Privacy contact: privacy@mrcorn.uk.com
- Phone: 07983 667783 (Mon–Fri 9am–5pm UK time)
We are the data controller for personal data collected through mrcorn.uk.com under UK GDPR Article 4(7).
Data Protection Officer (DPO): we have not appointed a DPO. UK GDPR Article 37 only requires a DPO for public authorities, organisations whose core activities involve large-scale regular and systematic monitoring of individuals, or large-scale processing of special-category data. None of these apply to Mr Corn Ltd. The primary privacy contact is the email address above.
EU representative (Article 27 EU GDPR): we are in the process of appointing an EU-based representative for our EU customers. Until that appointment is in place, EU customers can contact us directly using the details in §12.
3. Personal data we collect
| Category | Examples |
|---|---|
| Identity & contact | Name, billing address, delivery address, email, phone number |
| Order data | Items ordered, order date, order total, delivery method, order notes, invoice references |
| Payment data | Card payment is processed by our payment provider Takepayments (a UK card-payment processor). We do not store full card numbers on our servers — only a payment-provider token plus the last four digits. |
| Account data | Username, password (stored as a one-way hash), order history, wishlist, saved addresses |
| Communications | Messages you send through the contact form, by email, on the phone, or on our social channels |
| Marketing preferences | Whether you have opted in to our newsletter; the topics you’ve indicated interest in |
| Technical data | IP address (truncated where possible), browser type, device type, pages viewed, referrer |
| Cookies | See §10 below |
We do not intentionally collect special-category data (as defined in UK GDPR Art 9 — health, race, religion, sex life, sexual orientation, political opinions, trade-union membership, biometric or genetic data). Please don’t include special-category data in messages to us through the contact form.
4. How we collect it
- Directly from you when you place an order, create an account, contact us, sign up to the newsletter, leave a review, or fill in any form on the site.
- Automatically through cookies, server logs, and any tracking scripts in use at the time (see §10) when you use the site.
- From third parties — Takepayments confirms successful payments to us; if you log in through a social provider we may receive your basic public profile (only if you choose that login method).
5. Why we use it (lawful bases under UK GDPR Art 6)
| Purpose | Lawful basis |
|---|---|
| Taking and fulfilling your order, sending confirmations, dispatch notes, delivery updates | Contract — Art 6(1)(b) |
| Keeping records for tax / accounting | Legal obligation — Art 6(1)(c). HMRC requires us to keep transactional records for 6 years. |
| Customer service, complaints, returns | Contract — Art 6(1)(b) and Legitimate interests — Art 6(1)(f) (resolving disputes) |
| Fraud prevention and order screening | Legitimate interests — Art 6(1)(f) |
| Marketing to existing customers about similar goods we sell (newsletter) | Legitimate interests — Art 6(1)(f) under the PECR Reg 22(3) “soft opt-in” — you can opt out at any time |
| Marketing to newsletter subscribers who have not yet bought | Consent — Art 6(1)(a). You can withdraw consent at any time. |
| Cookies that aren’t strictly necessary (if any are set) | Consent — Art 6(1)(a), captured through the cookie banner under PECR Reg 6. At the time of writing we believe only strictly-necessary cookies are set on the site; this row covers any non-essential cookies introduced in the future. |
For each “legitimate interest” basis above, we have carried out a balancing test (a Legitimate Interests Assessment, or LIA) and concluded that our interest does not override your rights and freedoms. You can ask for a copy of any LIA by emailing the privacy contact in §2.
6. Who we share your data with
We share personal data only with the processors and partners we need to in order to run the shop. We have written data-processing agreements (UK GDPR Art 28) in place with each of them.
- Payment provider: Takepayments (a UK card-payment processor). Takepayments handles your card details directly through their PCI-compliant checkout — we never see your full card number.
- Web hosting and email infrastructure: 20i Limited (United Kingdom) — provides the web hosting for mrcorn.uk.com and the email mailbox infrastructure used for our customer-service and transactional emails.
- Delivery: we deliver orders ourselves using our own vehicles, so your delivery address is not routinely shared with any third-party courier. Where we have to use a third-party courier for an exceptional delivery (e.g. an unusually large order or a destination outside our normal delivery area), we will tell you at checkout and only share the address details needed for delivery.
- Cookie consent platform: CookieYes — configured to ask for your consent before setting any non-essential cookies.
- Law-enforcement / regulators: if legally required (court order, HMRC inquiry, ICO investigation, etc.).
We do not currently use a third-party email-marketing platform, affiliate-programme platform, analytics provider, or external accountant / bookkeeping service. If we introduce any of these we will update this notice before the new processor starts handling your personal data.
We do not sell personal data to advertisers, data brokers, or any other party.
7. International data transfers
At the time of writing, all of the processors listed in §6 are based in the United Kingdom, and your personal data is not routinely transferred outside the UK by us.
Limited international processing happens as part of normal card-payment processing — when you pay by card, the card-scheme partners (Visa, Mastercard, American Express, etc.) handle authorisation messages through their international networks. This is covered by the card schemes’ and Takepayments’ own data-transfer safeguards under UK GDPR Chapter V, including UK Standard Contractual Clauses and the UK Extension to the EU–US Data Privacy Framework where relevant.
If we ever introduce a new processor based outside the UK, we will rely on one of the safeguards permitted under UK GDPR Chapter V (UK adequacy regulations for the EEA and other adequate jurisdictions, the UK International Data Transfer Agreement, the UK Addendum to the EU SCCs, or the UK Extension to the EU–US Data Privacy Framework), and we will update this notice before that processor starts handling your personal data. You can ask for a copy of any safeguards we have in place by emailing the privacy contact in §2.
8. How long we keep it
| Data | Retention | Why |
|---|---|---|
| Order records (name, address, items, payment ref, totals) | 6 years from the end of the relevant tax year | HMRC record-keeping requirement |
| Customer account data | While your account is active, plus 12 months after last login, then deleted | Customer convenience & fraud prevention |
| Newsletter subscriber data | Until you unsubscribe, then anonymised within 30 days | Your consent |
| Customer-service correspondence | 2 years from the last contact | Customer service & complaint handling |
| Cookie data | Per cookie — see §10 and the cookie banner | Varies by cookie |
We will delete or anonymise data earlier if you ask us to and we are not required to keep it for a legal reason.
9. Your rights
Under UK GDPR (and EU GDPR if you are in the EU) you have the following rights, free of charge:
- Right to be informed — this notice covers it
- Right of access — request a copy of the personal data we hold about you (“subject access request” / SAR)
- Right to rectification — correct anything that’s wrong or incomplete
- Right to erasure (“right to be forgotten”) — subject to our legal obligation to keep tax records for 6 years
- Right to restrict processing
- Right to data portability — receive your data in a structured, machine-readable format
- Right to object — particularly to direct marketing (which is an absolute right) and to processing based on legitimate interests
- Rights related to automated decision-making and profiling — we do not currently use solely automated decisions to refuse orders, set prices, or assess risk; if you believe we do, tell us
- Right to withdraw consent — for any processing we do based on consent
To exercise any of these, email privacy@mrcorn.uk.com or write to the registered address in §2. We aim to respond within one calendar month per UK GDPR Art 12(3).
You also have the right to complain to the regulator:
- Information Commissioner’s Office (ICO) — ico.org.uk · 0303 123 1113 · Wycliffe House, Water Lane, Wilmslow, Cheshire SK9 5AF, UK
- EU customers — your local data-protection supervisory authority (the full list is at edpb.europa.eu)
We’d appreciate the chance to put things right first — please contact us before going to the regulator, but you don’t have to.
10. Cookies and similar technologies
We use only strictly-necessary cookies at the time of writing — these are needed for the site to work (login session, cart contents, checkout, CSRF protection). They are set without consent under PECR Reg 6(4)(b).
If we ever introduce non-essential cookies (functional, analytics, or marketing), we will:
- Install a cookie consent platform (CMP) that asks for your consent before those cookies are set, in line with PECR Reg 6;
- List every cookie, its purpose, the third party setting it, and its lifetime in the cookie banner;
- Let you withdraw consent at any time using the cookie banner’s preferences link;
- Update this notice to reflect the change before it goes live.
You can clear cookies at any time through your browser settings.
11. Children
Our shop is not directed at children. We do not knowingly collect personal data from anyone under 16. If you believe we hold personal data about a child, tell us and we will delete it as quickly as we reasonably can.
12. How to contact us
- Email: privacy@mrcorn.uk.com
- Post: Mr Corn Ltd, 24 Curtis Farm Business Park, Curtis Farm, Fobbing, Essex, SS17 9JJ, United Kingdom
- Phone: 07983 667783 (Mon–Fri 9am–5pm UK time)
13. Changes to this notice
We will post any changes here with a new “Last updated” date at the top. Where the change is material (a new processor, a new purpose, a longer retention period, a change to the lawful basis), we will email active customers in advance.