Last updated: 28 October 2026
1. Who We Are
This policy explains how Oakleys Farm Ltd collects, uses and looks after your personal information when you use any of our websites, book tickets, place an order, contact us or sign up to hear from us.
Oakleys Farm Ltd is the controller of your information, which means we decide how it is used and are responsible for keeping it safe. We are a company registered in England and Wales (company number 12595919), with our registered office at Little Blakeley Lane Farm, Dilhorne, Stoke-on-Trent, Staffordshire ST10 2PT.
Our websites, including oakleysfarm.co.uk and staffordshiregardensupplies.co.uk, are part of the Oakleys Farm Group. They share one basket, one checkout and one customer system, so this one policy covers all of them. Each website also has its own cookie information, which lists exactly what that site stores on your device.
If you have any questions about this policy or your information, please contact the business you dealt with:
- Oakleys Farm, including events and tickets: by phone on 01782 550824 or by email at enquiries@oakleysfarm.co.uk.
- Staffordshire Garden Supplies: by phone on 01782 901058 or by email at enquiries@staffordshiregardensupplies.co.uk.
If you are not sure which to contact, use the Oakleys Farm details and we will pass your message on.
2. The Information We Collect
We only collect the information we need, and most of it comes from you directly.
- Contact details: your name, email address, phone number and, for deliveries, your delivery address and any access notes you give us.
- Orders and bookings: what you bought or booked, when and how much you paid, the event, date and session for any tickets, and the version of our terms you accepted at checkout.
- Free event registrations: your name, email address and the number of people in your party.
- Your account: if you create one, your login email, a securely scrambled version of your password that we can never read, your phone number, postcode and saved addresses.
- Payments: a record that you paid, how much and when. Your card details go straight to our payment provider, Stripe, and we never see or store them.
- Messages: anything you send us through a contact, enquiry or brochure form, by email or by phone, and our replies.
- Newsletter sign-ups: your email address and, if you choose to give them, your name, postcode, date of birth, interests and mobile number for text messages, together with your consent and when you gave it. We ask for your date of birth to check you are 16 or over and to send you a birthday treat.
- Phone orders: if you order by phone, the details we need to fulfil it, such as your name, contact details, delivery address and order. We never take card details over the phone; instead we email you a secure link so you can pay yourself.
- Ticket scans: when your ticket is scanned on arrival, so it can't be used twice.
- Emails we send you: whether each email reached you, and whether our marketing emails were opened and which links were clicked (see section 8).
- Anything else you choose to tell us: we don't ask for health information, but if you tell us about an allergy or dietary need, for example when booking an event, we use it only to look after you.
- Technical information: your IP address, which our websites pass to our systems when you send a form or use the basket, so we can stop spam and misuse; the IP address and browser used when you sign in to your account, to keep it secure; and standard information that our hosting providers record when you visit (see section 6).
- Website use: which pages are visited, counted without cookies, and more detailed statistics from Google Analytics if you allow them (see section 9).
3. How We Use Your Information
We use your information for the following purposes, each with a legal basis under UK data protection law.
- To take and deliver your order or booking, including sending your confirmation and tickets, arranging delivery and contacting you about it. The legal basis is our contract with you.
- To check that important emails, such as your tickets and order confirmations, have reached you, so we can help if one hasn't. The legal basis is our contract with you.
- To run your account, so you can sign in, see your orders and manage your details. The legal basis is our contract with you.
- To contact you on the day if something changes, which is why we ask for a phone number with every ticket booking. The legal basis is our contract with you.
- To answer your enquiries and deal with any complaints. The legal basis is our legitimate interest in helping our customers.
- To send you news and offers by email or, in future, text message, only if you have agreed. The legal basis is your consent, which you can withdraw at any time.
- To keep our records and accounts, including for tax and VAT. The legal basis is our legal obligation.
- To stop spam, fraud and misuse of our websites and checkout, including by checking how many requests come from one IP address. The legal basis is our legitimate interest in protecting our business and customers.
- To understand how our websites are used and improve them. Our own page counts use no cookies and are based on our legitimate interest; Google Analytics is used only if you accept it, and the legal basis for that is your consent.
- To deal with any complaint or legal claim, which is why we keep records for the periods in section 10. The legal basis is our legitimate interest in protecting our business.
We may group subscribers by what they have bought, booked or opened, so that the emails we send are relevant to them, for example a reminder to people who haven't visited for a while. We don't make any decisions about you by automated means alone that have legal or similarly significant effects.
4. On the Farm
When you visit an event, we scan your ticket at the entrance to check it is valid. We don't collect any other personal information about you on the day unless you give it to us, for example if you need help or want to tell us something.
Some events on our websites are run or ticketed by other organisations. If you book through another company's ticketing website, that company's privacy policy applies to your booking.
We use CCTV on parts of the farm to keep visitors, staff and animals safe and to prevent crime. Footage is kept only for as long as it is needed for those purposes, unless it is needed to investigate an incident.
5. One Customer Record Across Our Websites
Because our websites share one basket and one checkout, we keep a single customer record for each email address across the whole Oakleys Farm Group. This means your orders and bookings from different sites appear together, and our team can help you whichever site you used.
You sign in to each website separately, and we only use your information for the purposes set out in this policy.
6. Who We Share It With
We never sell your information. We only share it with trusted companies that help us run our business, and only what they need to do their job. Each of them must keep it safe and may not use it for anything else.
- Payments: Stripe, which takes your card payment securely and runs its own fraud checks.
- Delivery: anyone delivering an order on our behalf receives your name, delivery address, phone number and access notes, so they can deliver it and call you beforehand.
- Email: Resend, which sends our confirmations, tickets, account emails and, if you have agreed, our newsletters, tells us whether each email was delivered and, for newsletters, whether it was opened and clicked, and delivers copies of website enquiries to our team's inboxes.
- Hosting and security: Sevalla, which hosts our websites and operations system, and Cloudflare, which protects and speeds up our websites. Both handle your IP address and the pages you request, and keep standard technical logs.
- Analytics: Google Analytics, only if you accept it, on our websites and on our shared checkout. When you start a checkout, reach the payment step or complete an order, Google Analytics receives what is in your basket, the total and, for a completed order, its order number, so we can see how many people finish their order. It never receives your name, email address, phone number, delivery address or card details. We have switched off all of Google's advertising features, so it is never used for adverts or remarketing.
- Maps and videos: some pages show a Google map or a video from YouTube or Vimeo. When these load, those companies receive your IP address and may set their own cookies.
- Professional advisers: such as our accountants, where they need it to do their work.
We may also share information if the law requires it, for example with HMRC or the police.
7. Information Sent Outside the UK
Some of the companies we use, such as Stripe, Google, Resend and Cloudflare, may handle your information outside the UK, including in the United States. Where that happens, we make sure it is protected to UK standards, through the UK's data bridge with the United States or contracts approved by the UK government.
8. Marketing
We will only send you news and offers if you have agreed, for example by signing up on one of our websites, ticking the box at checkout or asking us when you place an order by phone. We keep a record of when and how you agreed.
Our marketing emails record whether they have been opened, using a tiny image that loads when you view the email, and which links you click, by passing each link through our own address (links.oakleysfarm.co.uk) before taking you to the page. We use this to see which emails are useful, to send fewer emails to people who never read them, and to keep our mailing list healthy. Emails about your orders, bookings and account are not tracked in this way. If you would rather your opens weren't recorded, you can set your email app not to load images automatically.
You can stop marketing at any time by clicking unsubscribe in any email, replying STOP to a text message, or contacting us. Stopping marketing does not affect messages about your orders or bookings, which we still need to send.
9. Cookies and Similar Technology
Cookies are small files saved on your device when you visit a website. Each of our websites lists its own cookies on its cookie information page; this section explains how they work across the group.
- Essential cookies keep your basket and keep you signed in to your account. They are only set when you use those features, are never used for tracking or advertising, and don't need your consent. Our shared checkout and Stripe use their own essential cookies to take your payment securely and prevent fraud.
- Analytics cookies from Google Analytics help us see which pages are read and how many people complete an order. They are the only optional cookies on our websites and our checkout. Nothing from Google Analytics loads until you press "Accept analytics", and if you choose not to, the website and checkout work exactly the same.
- Your choice is saved on your device for up to 12 months, after which we ask again. You can change it at any time from "Cookie preferences" at the foot of every page, including the checkout. If you withdraw consent, analytics stops from that point; cookies already set stay on your device until they expire or you clear them in your browser settings.
- One choice across the group: a choice you make on oakleysfarm.co.uk is also used by our checkout, so you aren't asked twice. When you go from staffordshiregardensupplies.co.uk to the checkout, the link carries your choice with it for the same reason. If you haven't chosen yet, the checkout asks you.
- Our shared checkout (checkout.oakleysfarm.co.uk) uses these cookies:
- oakleys_consent: remembers whether you accepted analytics. Set by us, kept for 6 months.
- _ga: tells one visitor's visits apart using a random number. Set by Google Analytics only after you accept, kept for 2 years.
- _ga_42EK1V7TNK (Oakleys Farm) or _ga_8PGWKTZK2Z (Staffordshire Garden Supplies): keeps track of the current visit for that shop. Set by Google Analytics only after you accept, kept for 2 years.
- Page counts: our websites count page visits without any cookies or identifiers, so we only ever see how many times each page was viewed on each day.
- Your device only: some choices, such as your favourite products, are saved on your own device and never sent to us.
- Email tracking: the open and click tracking in our marketing emails is explained in section 8.
Google maps and videos from YouTube or Vimeo can set their own cookies when they load (see section 6). You can also block or delete cookies in your browser settings, although parts of the websites may not work properly without the essential ones.
10. How Long We Keep It
We keep your information only for as long as we need it.
- Orders, bookings and payments, including the terms you accepted: six years after the end of the tax year they relate to, because the law requires us to keep financial records.
- Your account: for as long as you have it. If you ask us to close it, we delete your account details but keep the order records above.
- Enquiries and brochure requests: six years from our last contact with you, so we have a record if any question about them comes up later. Copies held on our website servers as a backup are deleted after 90 days. You can ask us to delete an enquiry sooner.
- Marketing consent: until you unsubscribe, after which we keep only enough to make sure we don't contact you again.
- Email addresses we must not contact: if you unsubscribe, an email to you bounces, or you mark one of our emails as spam, we keep your email address and the reason for as long as we send marketing, so we never email you again by mistake.
- Baskets: deleted when they have not been used for 30 days, unless they became an order.
- Sign-ins: you stay signed in for up to 30 days, and the record of each sign-in is deleted 30 days after it ends.
- IP addresses we keep to stop spam and misuse, or with a sign-in, are deleted within 90 days. Our hosting providers keep their technical logs for their own standard periods.
11. How We Keep It Safe
Your information is held on secure servers, sent over encrypted connections, and only available to staff who need it for their work, each with their own login. Passwords are scrambled so that nobody, including us, can read them, and card details are handled only by Stripe.
12. Children
Our tickets and products are bought by adults, and you must be 16 or over to sign up to our newsletter. Tickets for children are booked by the adult bringing them, and we don't ask for children's names.
13. Your Rights
Under UK data protection law, you have the right to:
- ask for a copy of the information we hold about you;
- ask us to correct anything that is wrong or incomplete;
- ask us to delete your information, where we don't need to keep it;
- ask us to limit how we use it, or object to us using it for our legitimate interests;
- ask us to send your information to you or another company in a common format;
- withdraw your consent to marketing or analytics cookies at any time.
To use any of these rights, contact the business you dealt with, using the details in section 1. We will reply within one month, and there is normally no charge.
14. Complaints
If you are unhappy with how we have handled your information, please contact us first so we can try to put it right. You also have the right to complain to the Information Commissioner's Office, the UK's data protection regulator, at ico.org.uk or on 0303 123 1113.
15. Changes to This Policy
We may update this policy from time to time, for example when we add a new service. The latest version is always on our websites, with the date it was last updated, and we will tell you about any important changes.
