Privacy Notice

WHY DO WE HAVE THIS PRIVACY NOTICE?

We are BOXRAW and treating individuals and their personal information with respect reflects our core values and the values of our brand(s). So, we want you to know as much as possible about what we do with your personal information. Also, you and your personal information are protected by various laws and guidance and BOXRAW is committed to upholding these and respecting your privacy and keeping your information safe. So, whilst this privacy notice is quite long, we want you to be fully informed.

In this privacy notice any reference to "us", "we", "our" or "ourselves" is a reference to BOXRAW, and the particular part of the BOXRAW group that you have a relationship with and any reference to "you", "your" and "yourself" is a reference to you as an individual who has a relationship with us or is in contact with us.

This privacy notice applies to everyone who interacts with us as a customer who has purchased any of our products or services (whether in store or online), a user of any apps we provide, anyone who has signed up to receive marketing materials from us, anyone who enters any of our promotions/competitions and anyone who applies to attend any of our events or who interacts on social media with us, except to the extent that the reason you interact with us is already covered by another of our privacy notice(s). For example, our Non-Customer and Non-Employee privacy notice will apply to your general use of our website(s). A copy can be found here.

Please note that we have a separate privacy notice that relates to personal information captured by our CCTV and Access Control systems. A copy can be found here.

We also have a separate privacy notice that applies generally to individuals who apply to work for us, a copy of which will be provided to you during the recruitment/ interview process.

Finally we have a separate Non-Customer and Non-Employee privacy notice that applies to any other individuals that may interact with us, a copy of which can be found here. You should also read these privacy notices to the extent that they may apply to your activities/ interaction with us in addition to this privacy notice.

This privacy notice provides details in accordance with applicable data protection laws about how we collect and use personal information about you during and after your relationship with us.

As this privacy notice covers a range of individuals and different types of relationships and interactions with us, not all aspects of this privacy notice will apply to you. The aspects of this privacy notice that will apply to you will depend upon the nature of your relationship and interactions with us. If you are unsure, then you can always ask us by contacting [email protected].

THE CONTROLLER OF YOUR PERSONAL INFORMATION

For the purposes of data protection laws and this privacy notice, the controller of your personal information is whichever part of the BOXRAW group is processing your personal information. This will usually be the part of the BOXRAW group that you interact with or have a relationship with. Being a controller of your personal information means that we are responsible for deciding how we hold and use your personal information. Our main trading entity is BOXRAW Limited (Reg No 10118084) which is incorporated in England and Wales. If you are based in the UK, then this company will be the controller of your personal information. If you are based outside of the UK then the controller of your personal information may be another part of our group, but in most cases for the interactions covered by this privacy notice it will be BOXRAW Limited that is the controller of your personal information. Sometimes we may pass personal information to different parts of our group, so this privacy notice covers our whole group, and more than one part of our group may be a controller of your personal information. However, regardless of where you are based in the world, any queries you have regarding your personal information will be dealt with by BOXRAW Limited, who can be contacted at [email protected].

YOUR DUTY TO INFORM US OF CHANGES

It is important that the personal information we hold about you is accurate and current. Please keep us informed if your personal information changes during the period of your interactions with us.

WHAT IF YOU DO NOT PROVIDE PERSONAL INFORMATION?

Failing to provide some of the personal information we require may have an adverse impact on our ability to interact with you, for example we may not be able to provide you with products or services you would like to receive. However generally you are not obliged to provide us with any of your personal information.

IF YOU HAVE QUERIES OR CONCERNS JUST ASK!

We have appointed a data protection officer (DPO) to oversee our compliance with the data protection laws. If you have any questions about this privacy notice or how we handle your personal information, please contact our DPO on [email protected].

CHANGES TO THIS NOTICE

We keep all of our privacy notices under regular review, and we may update this privacy notice at any time. The current version of this notice is available on our website at https://uk.boxraw.com/pages/privacy-policy or by requesting a copy from [email protected]. If there are any material changes to this privacy notice in the future we will let you know, usually by updating the version on our website.

DATA PROTECTION PRINCIPLES

We are committed to being transparent about how we collect and use your personal information and in meeting our data protection obligations. Data protection laws say that the personal information we hold about you must be:

• Used lawfully, fairly and in a transparent way.
• Collected only for valid purposes that we have clearly explained to you and not used in any way that is incompatible with those purposes.
• Relevant to the purposes we have told you about and limited only to those purposes.
• Accurate and kept up to date.
• Kept only as long as necessary for the purposes we have told you about.
• Kept securely.

To make sure this happens we are required under applicable data protection laws to notify you of the information contained in this privacy notice. It is important that you read this document before you begin interacting with us so that you understand how and why we will process your personal information.

WHAT PERSONAL INFORMATION DO WE COLLECT?

In connection with your relationship or interactions with us, we may collect and process a wide range of personal information about you. This includes:

• Personal contact details such as name, title, address (including billing address and delivery address), email address and telephone number(s).
• Information about your date of birth, age, gender, marital status, and the name of any delivery recipient.
• Details regarding or connected to products or services that you have ordered from us.
• Details of apps that you have licensed from us to use and usage information relating to those apps, where it was downloaded from, traffic and communications data and resources accessed.
• Device data where you use our apps or website which may include information about the device you use and the unique device identifier for example your device’s IMEA number, the MAC address of the device’s wireless network interface, or the mobile phone used by the device, mobile network information, your mobile operating system, the type of mobile browser you use, time zone setting, the IP address, device type, usernames and account details, location data which may include your current location disclosed by your own software. However, we do not use separate location tracking software.
• Profile data including your username, purchase history, your interests, preferences, feedback and responses and any inferences drawn from any of personal data to create a profile about you to reflect your preferences, characteristics, psychological trends, predispositions, behaviour, attitudes, intelligence, abilities, and aptitudes.
• Content data which includes information stored on your device, including login information, videos, photographs and audio recordings or other digital content, check-ins, or your workout data that you input and upload and your social media handles, posts and information about your followers that you tag us in.
• Payment details, payment card details, bank account details, financial transactions, and refunds.
• Any terms and conditions relating to your relationship with us.
• Any communications between ourselves and you.
• Your social media handles, social media posts, information about your social media followers, information about any product/services endorsements by you and other aspects of your social media activity.
• Publicly available personal information, including any which you have shared via a public platform, online or on social media.
• Details of your sporting or athletic achievements and activity and related plans and progress where you tell us about them.
• Personal history and information including hobbies, interests, and your preferences.
• Responses and results of surveys.
• Fraud prevention-related information which may include details of other transactions you have been involved in.
• Applications to enter or attend competitions, promotions or events, attendance at events and promotions and any results or other related personal information.
• How you use our website as we collect information about the pages you look at and how you use them, usernames, account details and passwords, entry and exit data when you look at or leave our website, details of products, events and materials that may be interest to you, online subscription information, for example, when you subscribe to one of our updates, blogs or other materials, browser related information, cookies that are set on your device by our website (for more details see our separate cookie policy at here.
• Your usage of the IT systems we make available to visitors to our premises such as any visitor internet facilities at our premises.
• IP address information which allows us to track your usage of our website.
• Identification information including your driving license and/or passport and background checks.
• Gym training records, professional details.
• Size measures which allow us to pre-select suitable products for you where you have booked a personal shopping appointment at our retail store, or where you have won or been gifted a product.
• Vehicle registration number, make and model if you are driving to visit us at our premises or an event.
• Details of any queries, complaints, claims and cases involving both us and you including any related communications.
• CCTV footage and other information obtained through electronic means such as swipe card records and access control systems if you visit our premises (see our separate CCTV and Access Control privacy notice at here.
• Photographs, video footage, audio recordings and other content, for example any created as part of our marketing or promotion campaigns, which are taken at events we hold, when you enter a competition, posts made on social media or when you are on our premises or which you provide to us.
• Any other personal information you provide to us.

We do not actively collect or use special category data (e.g., health or ethnicity) unless absolutely necessary and only with your explicit consent or where otherwise permitted by law. Any such processing is rare and limited to specific, relevant purposes (e.g., inclusive event planning or health-related disclosures during training).

If you are providing us with details of any other individuals, for example a friend of yours that you ask us to deliver our products to where you have ordered them as a present, they have a right to know and to be aware of what personal information we hold about them, how we collect it and how we use and may share that information. Please share this privacy notice with them. They also have the same rights as set out in this privacy notice in relation to their personal information that we collect.

WE AIM NOT TO COLLECT PERSONAL INFORMATION ABOUT CHILDREN

We offer products for children; however, you must be at least 18 years old and authorised to use the payment method used to place an order. If you are under 18, you may only place an order with the consent and supervision of a parent or guardian.

While we do not knowingly collect data directly from minors under 18, we may collect limited information from parents/guardians placing an order on a child's behalf.

WHERE DO WE COLLECT YOUR PERSONAL INFORMATION FROM?

BOXRAW collects your personal information in a variety of ways and from a variety of sources as set out below:

Most of your personal information is collected directly from you, for example through contact with you, through information you input into your account on our website, through information you input into our app, from orders placed by you, from correspondence with you, through your applications, entries to competitions/promotions, entries to events, attendance at events or promotions, subscriptions, memberships, from correspondence with you or through other interactions with us, when you visit our premises or other personal information you provide to us.

• From other individuals known to you who may have given us your personal information so that we can send you any of our products as a gift.
• From websites, the internet, social media or other platforms including public sources of information.
• From our website, apps and information technology and communications systems, access control systems and CCTV and suppliers we use in connection with them.
• From third parties appointed by you, for example any financial or legal advisors.
• From third parties appointed by us, for example legal advisors appointed by us, identity or background check providers, fraud prevention organisations, data cleansing service providers or market/data research and analysis service providers.
• From government or government related bodies, regulators, the police, law enforcement authorities or the security services.

We store personal information relating to you in our information technology systems (including our email system and our in-store monitoring and CCTV systems).

ON WHAT BASIS DO WE USE YOUR PERSONAL INFORMATION?

We will only use your personal information when the law allows us to. This means we must have one or more legal basis to use your personal information. Most of these will be self-explanatory. The most common legal basis which will apply to our use of your personal information are set out below:

• Contractual necessity – To fulfil a contract with you or take steps at your request (e.g. processing your order, delivering goods).
• Legal obligation – To comply with applicable law (e.g. tax or consumer protection).
• Legitimate interests – For our business purposes, unless overridden by your rights (e.g. fraud prevention, analytics, marketing where consent is not required).
• Consent – For direct marketing by email or SMS and for collecting any special category data. You can withdraw consent at any time.
• Vital interests/Public interest – Rare circumstances where we need to protect you or another person (e.g. safety incidents at events).

In some cases, more than one legal basis may apply to our use of your personal information.

HOW WILL WE USE YOUR PERSONAL INFORMATION?

There are many ways we will need to use your personal information in the context of your relationship with us. We have set out the main uses below and indicated the main applicable legal basis of processing, but there may be other specific uses which are linked to or covered by the uses below.

• We will process your personal information to perform our relationship with you. As well as relating to the entry into or performance of a contract with you either directly or indirectly, this will also be in our legitimate interests. We may also in some limited cases rely on your consent.
• We will process your personal information to handle any order you (or an individual known to you where the delivery is to be made to you) has placed with us, and to pick, pack, despatch, ship and track that order to make sure it arrives safely. As well as relating to the entry into or performance of a contract with you either directly or indirectly, this will also be in our legitimate interests. We may also in some limited cases rely on your consent.
• We will process your personal information to provide any services you have asked to receive from us. As well as relating to the entry into or performance of a contract with you either directly or indirectly, this will also be in our legitimate interests. We may also in some limited cases rely on your consent.
• We will need to process your personal information to send to you any direct marketing materials about our products or services that you have asked to be sent to you. As well as relating to the entry into or performance of a contract with you either directly or indirectly, this will also be in our legitimate interests. We also need you to give consent if we are going to market to you by electronic channels such as email or SMS/MMS.
• We will process your personal information to build and develop a profile for you as a customer or potential customer of our products, services, apps and to aim to send or show you content, advertisements or marketing materials which are most likely to be of interest to you. As well as relating to the entry into or performance of a contract with you either directly or indirectly, this will also be in our legitimate interests. We also need you to give consent if we are going to market to you by electronic channels such as email or SMS/MMS.
• We also need to monitor and manage our relationship with you, which may involve communications with you, decisions regarding your relationship with us and in some cases meeting with you. As well as relating to the entry into or performance of a contract with you either directly or indirectly, this will also be in our legitimate interests.
• We may need to process your personal information in order to hold or conduct events, promotions or campaigns. This will be in our legitimate interests, and in some cases, we may rely on your consent to do this, for example if you provide us with a photograph to use.
• We may need to process your personal information to manage our social media or online relationship with you. This will be in our legitimate interests, and in some cases, we may rely on your consent to do this, for example if you provide us with a video, photograph or content to use.
• We may need to process your personal information in order to hold or conduct events, promotions, campaigns and visits to our premises and manage your involvement in them. This may relate to the entry into or performance of a contract with you either directly or indirectly, it may also be in our legitimate interests, or we may have a legal obligation to do so.
• We may need to process your personal information to help train our staff, and make sure they deliver the high standards expected in relation to our brand. This will be in our legitimate interests.
• In some cases, we may need to carry out background, identity, fraud prevention or other checks in relation to you to decide whether to enter into or to enforce a relationship we have with you. This will be in our legitimate interests, and in some cases, we may have a legal obligation to do so. An example of this, is the personal identification information and Government Identification Information that we require in order to assess an applicant’s eligibility for Amateur Boxer Discount.
• As a business we may have many legal obligations connected to our relationship with you or connected to visiting our premises which we need to comply with, for example, to comply with consumer protection laws or to comply with data protection laws or to comply with health and safety laws so we can ensure it is safe for you to visit our premises.
• We will also need to keep and maintain proper records relating to your relationship with us and information about you which is relevant to that relationship. As well as relating to the entry into or performance of a contract with you either directly or indirectly, this will also be in our legitimate interests, and we may also have legal obligations to do this.
• In some cases, we may need to process your personal information to prevent, detect or prosecute criminal activity. This will also be in our legitimate interests; we may also have legal obligations or be exercising a legal right to do this and it will also be in the public interest.
• You may have contacted us about a query, compliant or enquiry and we need to be able to respond to you and deal with the points you have raised. This will also be in our legitimate interests; we may also have legal obligations or be exercising a legal right to do this.
• We may need to gather evidence for and be involved in possible legal cases. As well as relating to the entry into of a contract with you either directly or indirectly, this will also be in our legitimate interests, we may also have legal obligations or be exercising a legal right to do this and it may also be needed to establish, bring or defend legal claims.
• To manage and keep a record of our relationship with you and any associated information It may relate to the entry into or performance of a contract with you either directly or indirectly, it will also be in our legitimate interests, and we may also have legal obligations or be exercising a legal right to do this.
• To ensure effective general business administration and to manage our business. As well as relating to the entry into or performance of a contract with you either directly or indirectly, this will also be in our legitimate interests, and we may also have legal obligations or be exercising a legal right to do this.
• To monitor any use you make of our website, apps and information and communication systems and social media accounts to ensure network and information security, including preventing unauthorised access to our computer and electronic communications systems and preventing malicious software distribution and also to protect your personal information. As well as relating to the entry into or performance of a contract with you either directly or indirectly, this will also be in our legitimate interests, and we may also have legal obligations or be exercising a legal right to do this. In relation to social media you may also have already made the personal information public.
• To conduct data analytics and analysis studies to review and better understand trends and improve our business, use of our website, apps and social media which relates to us, and those same things in relation to our competitors. This will also be in our legitimate interests, and we may also have legal obligations or be exercising a legal right to do this. We may sometimes anonymise and aggregate personal information for insight and research purposes, but this information will not identify you.
• We may be carrying our market and/or product research, for example so that we can improve our offering and range of products or improve our use of our website, apps or social media. This will be in our legitimate interests.

We always aim to use your personal information in an ethical and non-intrusive way. Your security as a BOXRAW customer or potential BOXRAW customer is very important to us. We will not use your personal information to target, segment, or profile individuals based on their health (including pregnancy), negative financial status or condition, political affiliation or beliefs, racial or ethnic origin, religious or philosophical affiliation or beliefs, sex life or sexual orientation, data relating to an alleged or actual commission of a crime, for any unlawful or discriminatory purpose or in any other manner that would be inconsistent with your reasonable expectation of privacy.

CHANGING MARKETING PREFERENCES

You have the right to opt out of receiving marketing communications from us at any time by:

• Updating your preferences in your account on our website.
• Informing us that you wish to change your marketing preferences by contacting our customer support team at [email protected]
• Making use of the simple “unsubscribe” link in emails or any other electronic marketing materials we send to you.
• Contacting us via email at [email protected] or by post to My Data Queries, BOXRAW, Herbert Art Gallery, Coventry, CV1 5QP.

The measures listed above do not apply to service messages such as order updates/ tracking and other non-marketing communications from us. They also don’t apply to advertising that may appear on our website, other websites or our apps. Please see the section below entitled 'Automated Decision Making' for more information on how we use cookies to advertise to you.

CHANGE OF PURPOSE

We will only use your personal information for the purposes for which we collected it, unless we reasonably consider that we need to use it for another reason and that reason is compatible with the original purpose. If we need to use your personal information for an unrelated purpose, we will notify you by updating this privacy notice on our website, so please check back regularly for any updates.

Please note that we may process your personal information without your knowledge or consent, in compliance with the above rules, where this is required or permitted by law. We will rarely need to rely on your consent to process any of your personal information.

AUTOMATED DECISION-MAKING

Automated decision-making takes place when an electronic system uses personal information to make a decision about that person without any human intervention which produces legal effects concerning them or similarly significantly affects them. We do not currently use this type of automated decision making in our business in relation to you.

You will not be subject to decisions that will have a significant impact on you based solely on automated decision making unless we have a lawful basis for doing so and we have notified you.

However, we do use automated processing so that we can show you personalised advertisements whilst browsing our website or those of other companies and to build a customer profile for you. Any advertisements you see may relate to your browsing activity on our website from your computer or other devices.

These advertisements are provided by us via external market leading specialist providers using techniques such as pixels, web beacons, ad tags, mobile identifiers and ‘cookies’ placed on your computer or other devices (some of which are subject to your prior consent). For further information on the use of cookies, or for details of how you can remove or disable cookies at any time - see our Cookie Policy.

We may analyse your browsing and purchasing activity online and your responses to marketing communications. The results of this analysis, together with other demographic data, allow us to decide what advertisements are suitable for you and to ensure that we draw to your attention products, services, events and offers that are tailored and relevant to you. To do so, we use software and other technology for automated processing. This allows us to provide a more personalised services and experience.

We may review personal information held about you by external social media platform providers, such as the personal information available on social media platforms such as Twitter, Instagram, YouTube, Twitter and Facebook.

We aim to update you about products and services which are of interest and relevance to you as an individual. To help us do this, we process personal information by profiling and segmenting, identifying what our customers like and ensuring advertisements we show you are more relevant based on demographics, interests, purchase behaviour, online web browsing activity and engagement with previous communications.

WHO HAS INTERNAL ACCESS TO YOUR PERSONAL INFORMATION?

Your personal information may be shared internally with our staff (including with our customer support, order fulfilment, loyalty and retention, customer relationship management, media, insights, events, campaign, technical and legal teams) where access to your personal information is necessary for the performance of their roles. We only provide access to your personal information to those of our staff who need to have access to your personal information.

WHO DO WE SHARE YOUR PERSONAL INFORMATION WITH EXTERNALLY?

We may share your personal information with external third parties, but only when it is necessary, appropriate, and where we have a valid lawful basis to do so under applicable data protection laws.

Third parties we work with fall into two categories:

• Processors: These are third parties who process personal information on our behalf and under our strict instructions. They do not make any independent decisions about your personal information. Examples include IT support providers, warehousing and logistics partners, and marketing service agencies.
• Joint Controllers: In limited circumstances, we and a third party may jointly determine the purposes and means of processing your personal data. In such cases, the third party may also use your data for their own purposes under their own privacy policy. Examples include third-party payment platforms such as Klarna and Sezzle.

We ensure that any third party with whom we share personal information is subject to appropriate data protection obligations and contractual safeguards.

We may share your personal information with the following categories of recipients:

• Service Providers: This includes information technology providers (e.g. Shopify), order fulfilment and delivery services, warehousing and logistics partners, customer service providers, marketing and public relations firms, market research agencies, and data cleansing services. These are generally processors.
• Payment Platforms: We may share limited personal data (e.g. contact and order details) with payment providers such as Klarna Bank AB, Afterpay, Sezzle, Mollie, and Clearpay, so they can determine your eligibility for payment options. These platforms operate as joint controllers. Please refer to their respective privacy policies for more information.
• Internal Group Companies: Personal data may be shared within the BOXRAW group for legitimate internal business purposes, including customer service, order fulfilment, analytics, and reporting.
• Professional Advisors: This includes our legal advisors, accountants, and auditors, as well as advisors appointed by you, such as solicitors or agents.
• Regulators and Law Enforcement: Where required by law or regulation, we may share your data with HMRC, police authorities, courts or tribunals, or regulatory bodies.
• Corporate Transactions: If we sell or restructure all or part of our business, we may share your information with prospective purchasers, investors, or funders and their advisers as part of the due diligence process or execution of a transaction.
• Social Media and Online Platforms: Where relevant to our marketing or engagement with you, we may share or process information via platforms such as Facebook, Instagram, or YouTube.

Our website and e-commerce platform are hosted by Shopify Inc. Shopify acts as a data processor, storing your data securely on servers protected by firewalls. Where you complete purchases via Shopify’s payment gateway, your payment details are processed in compliance with PCI-DSS standards. Shopify’s full terms and privacy policies can be accessed at:

• Shopify Terms of Service
• Shopify Privacy Policy

Boxing is Love (UK Charity Number: 1200384) is a registered charitable foundation established and supported by BOXRAW. From time to time, we may share limited personal data with Boxing is Love where:

• You have registered for or attended a charity-led event;
• You have made a donation or purchased a product where proceeds go to the charity;
• You have expressed interest in volunteering, supporting, or participating in charitable initiatives;
• There is a need to facilitate administration and fulfilment of collaborative projects between BOXRAW and the charity.

Lawful Basis: The legal basis for this sharing is our legitimate interest in supporting charitable programmes aligned with our brand’s social impact values, managing shared projects and events, and improving participant experience. We will not share personal information with Boxing is Love for marketing purposes without your explicit consent.

Safeguards: Boxing is Love is contractually bound to protect personal data in accordance with UK data protection law and may only use such data for the purposes described above.

Payment:

If you choose a direct payment gateway to complete your purchase, then Shopify stores your credit card data. It is encrypted through the Payment Card Industry Data Security Standard (PCI-DSS). Your purchase transaction data is stored only as long as is necessary to complete your purchase transaction. After that is complete, your purchase transaction information is deleted.

All direct payment gateways adhere to the standards set by PCI-DSS as managed by the PCI Security Standards Council, which is a joint effort of brands like Visa, MasterCard, American Express and Discover.

PCI-DSS requirements help ensure the secure handling of credit card information by our store and its service providers.

For more insight, you may also want to read Shopify’s Terms of Service (https://www.shopify.com/legal/terms) or Privacy Statement (https://www.shopify.com/legal/privacy)

We also use Google Analytics which sets cookies to collect information about how visitors use our website. See our Cookie Policy here. We use the information to compile reports and to help us improve the website. The cookies collect information in an anonymous form, including the number of visitors to the website and blog, where visitors have come to the website from and the pages they visited. To opt out of being tracked by Google Analytics across all websites visit http://tools.google.com/dlpage/gaoptout.

We also work with Awin Limited who may collect information when you interact with our site. The collection and use of this information is subject to Awin’s privacy policy which can be found at https://www.awin.com/gb/privacy.

We also work with third party payment systems, such as Afterpay, Klarna Bank (AB), Clearpay, Mollie and Sezzle (subject to availability and jurisdiction).

In order to be able to offer you the third party’s payment options, we will pass on certain personal information, such as contact and order details, in order for the third party to assess whether you qualify for their payment options and to tailor the payment options for you. Your personal data is handled in accordance with applicable data protection law and in accordance with the third party’s information in their privacy policy.

Afterpay’s privacy policy can be found here: https://www.afterpay.com/en-nz/privacy-policy

Klarna’s privacy policy, can be found here: https://www.klarna.com/uk/privacy/

Clearpay’s privacy policy can be found here: https://www.afterpay.com/en-nz/privacy-policy

Mollie’s privacy policy can be found here: https://www.mollie.com/privacy

Sezzle’s privacy policy can be found here: https://legal.sezzle.com/privacy

We do not disclose personal information to anyone else except as set out above unless we are legally entitled to do so. We may provide third parties with aggregate statistical information and analytics about users of our products and services but we will make sure no one can be identified from this information before we disclose it.

INTERNATIONAL TRANSFERS

It is sometimes necessary to share your personal information outside of the UK and the European Economic Area (the EEA) or it will be collected outside of the UK and the EEA. This will typically occur when service providers to our business are located outside the EEA or if you are based outside the EEA. These transfers are subject to special rules under applicable data protection laws.

Where personal information is transferred outside the UK or EEA, we rely on the EU Standard Contractual Clauses (SCCs) with the UK Addendum as approved by the ICO. We also conduct risk assessments and ensure equivalent safeguards are in place.

Our directors and other key staff working for us may in limited circumstances access personal information from outside of the UK and/or the EEA if they are outside of the UK or EEA. If they do so they will be using our security measures and the same legal protections will apply that would apply to accessing personal information from our premises.

In limited circumstances, the people to whom we may disclose personal information may be located outside of the UK and/or the EEA and we will not have an existing relationship with them, for example a foreign police force outside of the UK and/or the EEA. In these cases we will impose any legally required protections to the personal information as required by law before it is disclosed.

If you would like any more details about how we protect your personal information in relation to international transfers then please contact our DPO at [email protected].

HOW DO WE PROTECT YOUR PERSONAL INFORMATION?

We are committed to keeping your personal information safe and secure and so we have numerous security measures in place to protect against the loss, misuse, and alteration of information under our control. We will always aim to use best in class security systems implemented across our networks and hardware to ensure access and information are protected. Our security measures include:

• Encryption of personal information where appropriate.
• Regular cyber security assessments of all service providers who may handle your personal information.
• Regular planning and assessments to ensure we are ready to respond to cyber security attacks and data security incidents.
• Regular penetration testing of systems.
• Security controls which protect our information technology systems infrastructure and our premises from external attack and unauthorised access.
• Regular backups of information technology systems data with functionality to correct errors or accidental deletion/modification to data.
• Internal policies setting out our information security rules for our staff.
• Regular training for our staff to ensure staff understand the appropriate use and processing of personal information.
• Where we engage third parties to process personal information on our behalf, they do so on the basis of our written instructions, they are under a duty of confidentiality and are obliged to implement appropriate technical and organisational measures to ensure the security of personal information.

We take information security very seriously and will use all reasonable endeavours to protect the integrity and security of the personal information we collect about you.

FOR HOW LONG DO WE KEEP YOUR PERSONAL INFORMATION?

We retain your personal information only for as long as necessary to fulfil the purposes for which it was collected, or as required by law.
In particular:

• Customer support data is typically retained for up to 6 years from the end of our relationship with you, based on our legitimate interests, performance of a contract, or other lawful bases.
• Financial records (including those relating to payments, transactions, or shareholder data) are retained until withdrawn, subject to legal requirements and our ongoing business needs.
• Consent-based data (such as marketing preferences or campaign participation) is retained until you withdraw your consent or it is no longer needed for the original purpose.
• Legal, regulatory, or dispute-related data may be retained for longer where necessary to comply with legal obligations or to establish, exercise, or defend legal claims.

Once data is no longer required, we will either anonymise it (so it no longer identifies you) or delete it securely.

For more information or to request a copy of our Data Retention Policy, please contact our DPO at [email protected].

YOUR RIGHTS

As an individual whose personal information we collect and process, you have a number of rights. You may:

• Withdraw any consent you have given to us, although this will only be relevant where we are relying on your consent as a lawful basis to use your personal information, but it is an absolute right. Once we have received notification that you have withdrawn your consent, we will no longer process your personal information for the purpose or purposes for which you originally gave your consent, unless we have another lawful basis for doing so.
• Request details about how your personal information is being used. This right is linked with the right of access mentioned below.
• Request access and obtain details of your personal information that we hold (this is commonly known as a “data subject access request”). This enables you to receive a copy of the personal information we hold about you and to check that we are lawfully processing it.
• Request correction of the personal information that we hold about you. This enables you to have any incomplete or inaccurate information we hold about you corrected.
• Request erasure of your personal information. This means that you can ask us to delete or stop processing your personal information, for example where we no longer have a reason to process it. You also have the right to ask us to delete or remove your personal information where you have exercised your right to object to processing (set out below). The right to have data erased does not apply in all circumstances.
• Object to the processing of your personal information where we are relying on a legitimate interest (ours or that of a third party) and there is something about your particular situation which makes you want to object to processing on this ground.
• Object to direct marketing where we are processing your personal information for direct marketing purposes, for example contacting you about products that might interest you. This is an absolute right.
• Request the restriction of processing of your personal information. This enables you to ask us to stop processing your personal information for a period if data is inaccurate or there is a dispute about whether or not your interests override our legitimate grounds for processing data.
• Request the transfer of your personal information to another party in certain circumstances.
• Object to certain automated decision-making processes using your personal information.

You should note that some of these rights, for example the right to require us to transfer your personal information to another service provider or the right to object to automated decision making, may not always apply as they have specific requirements and exemptions which apply to them, and they may not apply to personal information recorded and stored by us. Also, for example we do not use automated decision making in relation to your personal information which has legal or other significant effects for you, but we do use automated processing to show you relevant advertisements. However, some of your rights have no conditions attached, so your right to withdraw consent or object to processing for direct marketing are absolute rights.

If you would like to exercise any of these rights, please contact our DPO at [email protected].

We may need to request specific information from you to help us confirm your identity and ensure your right to access the information (or to exercise any of your other rights). This is another appropriate security measure to ensure that personal information is not disclosed to any person or dealt with by a person who has no right to do so.

Whilst this privacy notice sets out a general summary of your legal rights in respect of personal information, this is a complex area of law. More information about your legal rights can be found on the ICO’s website at https://ico.org.uk/for-the-public/.

COMPLAINTS

We hope you don’t have any reason to complain, and we will always try to resolve any issues you have.

If you are based in the UK, you have the right to make a complaint at any time to the ICO (the UK data protection regulator) about how we deal with your personal information or your rights in relation to your personal information.

You can make a compliant in writing to the ICO, Wycliffe House, Water Lane, Wilmslow, SK9 5AF, United Kingdom or you can go to https://ico.org.uk/make-a-complaint/.

If you are based outside of the UK, you may have the right to complain to your local data protection regulator – we recommend checking your rights on the website of your local data protection regulator.

CONTACTING US

If you have any queries regarding our use of your personal information or this privacy notice then please contact our DPO at [email protected] or write to DPO, BOXRAW, Herbert Art Gallery, Coventry, CV1 5QP. You can use these details regardless of which of our group companies you have a relationship with.