This notice explains how We collects personal data from you and why we collect it, how we process it and where we may disclose it to other entities. We are committed to complying with the Data Protection Act 1998 and the EU General Data Protection Regulation for the purposes of data protection and privacy.
SUPERVISORY AUTHORITY
We are registered as a data controller under the terms of the Data Protection Act 1998 and the EU General Data Protection Regulation with the UK Information Commissioner’s Office.
YOUR RIGHTS
As from the 25 May 2018, the EU General Data Protection Regulation replaces the Data Protection Act 1998. This gives you new rights in relation to the privacy of your personal information. Below you can find a brief explanation of how you can use those rights.
In the case of any request involving one of your rights, we will respond to your request without delay – and at most within one month of receipt of your request. We are permitted to extend this time period by up to two months if your request is particularly complex.
THE RIGHT OF ACCESS
Subject access requests allow your right to obtain a copy of the information that we hold about you. You have the right to ask us to provide you with this information free of charge. However, should the request be deemed to be manifestly excessive, manifestly unfounded or repetitive, then we are permitted to charge a reasonable fee for providing the information. In such circumstances, and as an alternative, we can refuse to comply with the request. If this is the case then we shall let you know the reasons for us refusing to comply. You have a right to appeal such a decision via the UK Information Commissioner’s Office. For further information visit The Information Commissioner’s website. Subject access requests may be sent to [email protected]
THE RIGHT TO RECTIFICATION
You are entitled to have the information that we hold about you rectified if it is inaccurate or incomplete. If you believe that the information that we hold about you is inaccurate, incomplete or out of date then please let the customer service team know via [email protected]
THE RIGHT TO ERASURE
You have the right to request that we delete personal information that we hold about you where we have no compelling reason for its continued processing. This right will apply:
Where retention of the data is no longer necessary for the purposes that it was originally collected or processed
You have withdrawn consent from marketing communications
You object to us processing the data and there is no overriding legitimate interest for us to continue to do so
When personal data has to be erased for us to comply with a legal obligation
When data has been unlawfully processed
When data relates to child
This right shall not apply:
When we are exercising the right of freedom of expression and information
When we are complying with a legal obligation
When we are archiving data in the public interest, for scientific research or for statistical purposes
When data is needed to exercise or defend a legal claim
We will also inform any third parties of the request in order that they can erase their records too. Erasure requests may be sent to the customer team [email protected].
THE RIGHT TO RESTRICT PROCESSING
You can request that we restrict the processing of your information. This means that you may have requested one of your other rights, where until the request is concluded that we suspend the processing of your data. If we have passed your data to a third party, we will also inform them that they must restrict the processing of your data. This right will apply:
When you contest the accuracy of the information that we hold about you and you request that we restrict processing while we investigate
You object to us processing your personal data, but we believe that processing is in the public interest or the performance of our legitimate interests and that these are legitimate grounds to override your interest
When you believe that processing is unlawful and you request restriction instead of deletion
When we no longer need that data, but you require the data stored in order to pursue a legal claim
Restriction requests may be sent to [email protected]
THE RIGHT TO DATA PORTABILITY
You have the right to request the information that we hold on you be supplied to you in a portable format. This allows you to take your information from our IT environment to another organisation’s IT environment. The format in which we supply your data will be a structured and machine-readable CSV file. Portable data requests may be sent to the [email protected]
THE RIGHT TO OBJECT
You have the right to object to your personal information being processed by us. This means:
If you object to us processing your data for marketing purposes then we will stop sending you marketing material
If you object to us processing your data at all (i.e. where you have an account with us) we will completely remove your personal information from our systems
If you choose the second option and then change your mind at a later date, then you will need to set up a new account to resume shopping with us. Requests for either of these options may be sent to [email protected]
INFORMATION WE MAY COLLECT FROM YOU
We use the EU General Data Protection Regulation definition of personal data. This is any information relating to an identified or identifiable natural person (‘data subject’). An identifiable natural person is one who can be identified, directly or indirectly, by reference to an identifier such as: a name, identification number, location data, online identifier or to one or more factors specific to the physical, physiological, genetic, mental, economic, cultural or social identity of that natural person.