4. LAWFUL BASIS
4.1 We will only use your personal data where we have a lawful basis to use it:
- Contract: In order to allow us to fulfil our contractual obligations with you, we may need to contact you regarding purchases or sale orders and will therefore process your name and contact details. If you contact us, we may keep a record of that correspondence.
- Legitimate Interest: It is in our legitimate business interest to process your personal data in ways which might reasonably be expected as part of running our business and which do not materially impact your interests, rights or freedoms, such as:
- business development;
- marketing to you by telephone and letter; and
- personalising and/or tailoring the communications that we may send you by profiling, as explained further in the ‘Profiling’ section below.
- Legal Obligation: We may sometimes need to use data to comply with our legal obligations (for example to report an accident).
- Consent: Where we use your email or telephone number to communicate marketing information via email and SMS, we will seek your prior consent to do so
4.2 As a user of our website we may process your personal data for the following purposes:
- To enroll you into our original factory shop Club card or email programme, to receive promotional materials
- Our website may contain links to other websites of interest. However, once you have used these links to leave our site, you should note that we do not have any control over the external website(s) and these website(s) will have their own privacy notices, for which we do not accept any responsibility for. You should exercise caution and look at the privacy notice applicable to the website in question
5. HOW WE SOURCE YOUR PERSONAL DATA
5.1 We may collect this information in a variety of ways, e.g.: data might be collected through application for an original factory shop Club card, signing up to our email programme, updating your details in store/online/via customer services, through returning an item into store or vendors expressing interest to supply us goods or services.
6.1 We use your purchase history and demographic information (such as your home address and date of birth) to build a picture of your preferences and interests, which we use where it is in our legitimate interests to tailor the marketing that we provide to you by email, SMS, telephone and post to you and your shopping habits.
6.2 If you would like any further information about the information that we use to create this profile please contact our Chief Privacy Officer – [email protected].
7. ONLINE ADVERTISEMENTS
7.1 When you are browsing on apps and other websites, such as Facebook, we will display advertising about products and services which we think will be of interest to you based on your use of our website (such as the content you read on the website) and your shopping habits. We do this using services offered by sites and social networks, for example, Facebook’s Custom Audiences, and using pixels on our website.
8. WHO HAS ACCESS TO YOUR DATA?
8.1 In the below circumstances the data will be subject to confidentiality arrangements with our selected third parties:
- Tell tofs – your data is processed by our data management agency in the USA, the comments/feedback that you provide us helps us to make improvements to our products and services.
- Accident reporting / CCTV / Third party vendors – this information is generally not shared with any external bodies unless we are required to do so by law.
8.2 Your information may be shared internally if access to the data is necessary for performance of their roles.
8.3 Where the parties we engage with are located outside the European Economic Area, in particular the United States, these transfers are governed by the EU Commission-approved Standard Contractual Clauses, GDPR-compliant Data Processor clauses where the US vendor is certified under the EU-US Privacy Shield Programme Framework, or Binding Corporate Rules for Processors.
9. HOW DO WE PROTECT DATA?
9.1 We take the security of your data seriously. We have internal policies and controls in place to try to ensure that your data is not lost, accidentally destroyed, misused or disclosed, and is not accessed except by our colleagues in the performance of their duties. This includes using individual passwords and restricted access to folders and systems on our IT network.
9.2 Where we engage third parties to process personal data on our behalf, we do so on the basis of written instructions, are under a duty of confidentiality and are obliged to implement appropriate technical and organisational measures to ensure the security of data.
10. FOR HOW LONG DO WE KEEP DATA?
10.1 We will hold your personal data for the following duration/s:
- original factory shop club card and email programme
- name, contact details and, where you are a club card holder, transaction information – up to 7 years
- customer queries/complaints and returns
- name, email, telephone number – 400 days
- tell tofs
- name, email, transaction details and ip address – 400 days
- Accident reporting
- name, address, date of birth and telephone number – 3 ½ years
- Images are over written each month unless we are required to keep them to deal with a particular issue
- name, email, telephone number – kept for as long as we have supplier/retailer relationship
- visitor book – name, company & car registration – 6 months
11. YOUR RIGHTS
11.1 The GDPR provides you with certain rights in relation to the Processing of your Personal Data, including to:
- Request access to Personal Data about you (commonly known as a “data subject access request”). This enables you to receive a copy of the Personal Data we hold about you.
- Request rectification, correction, or updating to any of the Personal Data that we hold about you. This enables you to have any incomplete or inaccurate information we hold about you corrected.
- Request erasure of Personal Data. This enables you to ask us to delete or remove Personal Data where there is no good reason for us continuing to Process it. You also have the right to ask us to delete or remove Personal Data where you have exercised your right to object to Processing (see below).
- Request the restriction of Processing of your Personal Data. This enables you to ask us to suspend the Processing of Personal Data about you (e.g. if you want us to establish its accuracy or the reason for Processing it).
- Request the transfer of Personal Data provided by you (“data portability”).
11.2 Object to the Processing of your Personal Data in certain circumstances.
Where we are processing your personal data on the basis of our legitimate interests, you can ask us to stop processing it and we must do so unless we believe we have an overriding legitimate reason to continue processing your personal data or we need to process your personal data to deal with a legal claim. This includes where we are carrying out profiling activities using your personal data.
11.3 The exercise of these rights is not absolute and may be subject to certain pre-conditions and exemptions under the GDPR. Should you wish to exercise the rights accorded by the GDPR, please contact our Chief Privacy Officer – [email protected]
12.1 We strive to process your personal data in accordance with the applicable legal obligations but if you have any complaint(s) in that regard, please address your complaint(s) to [email protected]
12.2 You also have the right to lodge a complaint with the UK Information Commissioner’s Office (“ICO”) if you are not happy with how TOFS processes your personal data and we cannot provide you with a satisfactory resolution to your request.
This Notice may be amended from time to time. We will post any change to this Notice on our website.
This Notice was last updated on 10th October 2019.