GDPR: DATA PRIVACY NOTICE FOR CLIENTS AND SUPPLIERS

1. Definitions

Data controller - A controller determines the purposes and means of processing personal data.

Data processor - A processor is responsible for processing personal data on behalf of a controller.

Data subject – Natural person

Categories of data - Personal data and special categories of personal data

Personal data - The GDPR applies to ‘personal data’ meaning any information relating to an identifiable person who can be directly or indirectly identified in particular by reference to an identifier (as explained in Article 6 of GDPR). For example name, passport number, home address or private email address. Online identifiers include IP addresses and cookies.

Special categories personal data - The GDPR refers to sensitive personal data as ‘special categories of personal data’ (as explained in Article 9 of GDPR). The special categories specifically include genetic data, and biometric data where processed to uniquely identify an individual. Other examples include racial and ethnic origin, sexual orientation, health data, trade union membership, political opinions, religious or philosophical beliefs.

Processing - means any operation or set of operations which is performed on personal data or on sets of personal data, whether or not by automated means, such as collection, recording, organisation, structuring, storage, adaptation or alteration, retrieval, consultation, use, disclosure by transmission, dissemination or otherwise making available, alignment or combination, restriction, erasure or destruction.

Third party - means a natural or legal person, public authority, agency or body other than the data subject, controller, processor and persons who, under the direct authority of the controller or processor, are authorised to process personal data.

2. Who are we?

The Firm of Gordon Bannerman trading as Bannerman Decorators/Bannermans Colour Studio is the data controller. This means we decide how your personal data is processed and for what purposes. Our contact details are: 18 Dunkeld Road, Perth, PH1 5RW, Phone Number 01738 622591. For all data matters contact our Data Protection Representative, on 01738 622591 or email jackie@bannermandecorators.co.uk.

3. What personal data do we process?

We may collect and process information about you, including your name, date of birth, address, contact details (including email address and mobile phone number), payment card details, bank details, product selections and details of your purchases and purchasing habits. This information is referred to in this Privacy Policy as personal data.

In particular, we may collect and process the following personal data about you:

• Information that you provide by filling in forms, including those on our Website. This includes information provided by you if you enter any competition or promotion sponsored by us. This information could include your name, date of birth, address, contact details and information about you and products you have bought.
• When you place order(s) for goods or services, we collect personal data to process and fulfil your order(s), including your payment card details and delivery address.
• Details about the transactions you carry out with us.
• In the event that you have an accident while on our premises that you bring to our attention, we may record details of that accident and any injury you suffer in the relevant store's accident log.
• Information contained in and records of communications between us.
• Information that we receive from third parties (including third parties who provide services to you or us, and credit reference, fraud prevention or government agencies);
• Information that we gather from publicly available sources, such as the press, the electoral register, company registers and online search engines.
• Details of your visits to our Website, including, but not limited to, traffic data, location data (including the country and telephone area code where your computer is located) and the resources that you access (including the pages of our Website that you view).
• We may also collect information concerning your marketing preferences.

If you provide us with personal data about another person, you must ensure that before you provide us with their personal data, you have their agreement to do so and that they are aware of the ways in which we use personal data as set out in this Privacy Policy.

4. How do we use your personal data?

We use your personal information in connection with our business activities. In particular, we may use your personal information in the following ways:
• to carry out our obligations arising from any contracts entered into between you and us; for example, we will use your payment card details and delivery address to process and fulfil your order(s);
• in the event that you do not complete your order, we may use any contact information you have provided us to follow-up on your partial order;
• to manage and administer any other arrangements between you and us (or one or more of our affiliates);
• to notify you about changes to our services and to otherwise communicate with you; for example, we will use your contact details in order to respond to any queries that you submit to us;
• at or following any purchase or order you make, we may carry out security checks to protect against fraudulent transactions and to prevent and detect criminal activity; for example, we may undertake verification checks to identify any discrepancies with your payment details;
• to carry out market research; for example, we use details of your purchases to understand market trends and to identify popular products;
• to address any claims made against us; for example, we may share details of our accident logs with our claims handlers and insurers in connection with any claim made or likely to be made against us.

Your personal information may also be used by us, our employees, contractors or agents, and disclosed to third parties, in order to comply with any legal obligation (including in connection with a court order), or in order to enforce or apply our terms and conditions of sale or other agreements we have with or otherwise concerning you (including agreements between you and us (or one or more of our affiliates)), or to protect our rights, property or safety or those of our customers, employees or other third parties.

5. What is our legal basis for processing your personal data?

Processing necessary for the performance of a contract with the data subject or to take steps to enter into a contract. More information on lawful processing can be found on the ICO website.

6. With whom do we share your personal data?

In connection with the above uses of your personal information, we may share your personal information with third parties as described below.

We may disclose your personal information to third parties, including in the following circumstances:

• We use third parties to carry out certain activities on our behalf that involve the processing of personal information. For example, we may engage third party service providers to fulfil orders, deliver packages, send postal mail and email, maintain, update and back up our databases of customer details, analyse data, process card payments, provide customer service and handle claims. These third parties have access to personal information needed to perform their functions, but may not use it for other purposes.
• We may pass personal information to external agencies and organisations (including the police and other law enforcement agencies) for the purpose of preventing and detecting fraud (including fraudulent transactions) and criminal activity. These external agencies may check the information we give them against public and private databases and may keep a record of such checks to use in future security checks. We may also disclose personal information to the police and other law enforcement authorities in connection with the prevention and detection of crime.
• We may pass personal information to our insurers in the event that a claim is made or could be made against us. For example, we may send information contained in our accident logs to our insurers.
• In the event that we sell or buy any business or assets, we may disclose personal information held by us about our customers to the prospective seller or buyer of such business or assets. If we or substantially all of our assets are acquired by a third party, personal information held by us about our customers will be one of the transferred assets.
• We may pass your personal information to third parties if we are under a duty to disclose or share your personal information in order to comply with any legal obligation (including in connection with a court order), or in order to enforce or apply our terms and conditions of sale or other agreements we have with or otherwise concerning you (including agreements between you and us (or one or more of our affiliates)); or to protect our rights, property or safety or those of our customers, employees or other third parties.

7. How long do we keep your personal data?

By providing you with products or services, we create records that contain your information, such as customer account records, activity records, tax records and credit account records. Records can be held on a variety of media (physical or electronic) and formats.

We manage our records to help us to serve our customers well (for example for operational reasons, such as dealing with any queries relating to your account) and to comply with legal and regulatory requirements. Records help us demonstrate that we are meeting our responsibilities and to keep as evidence of our business activities.

Retention periods for records are determined based on the type of record, the nature of the activity, product or service, the applicable legal or regulatory requirements. We normally keep customer account records for up to six years after your relationship with us ends, whilst other records are retained for shorter periods. Retention periods may be changed from time to time based on business or legal and regulatory requirements.

We may on exception retain your information for longer periods, particularly where we need to withhold destruction or disposal based on an order from the courts or an investigation by law enforcement agencies.

If you would like more information about how long we keep your information, please contact us on 01738 622591.

8. Providing us with your personal data

We may process your information where it is necessary to enter into a contract with you for the provision of our products or services or to perform our obligations under that contract. Please note that if you do not agree to provide us with the requested information, it may not be possible for us to continue to operate your account and/or provide products and services to you.

9. Your rights and your personal data

Unless subject to an exemption under the GDPR, you have the following rights with respect to your personal data:

• The right to request a copy of the personal data which we hold about you;
• The right to request that we correct any personal data if it is found to be inaccurate or out of date;
• The right to request your personal data is erased where it is no longer necessary to retain such data;
• The right to request that we provide you with your personal data and where possible, to transmit that data directly to another data controller, (known as the right to data portability), (where applicable i.e. where the processing is based on consent or is necessary for the performance of a contract with the data subject and where the data controller processes the data by automated means);
• The right, where there is a dispute in relation to the accuracy or processing of your personal data, to request a restriction is placed on further processing;
• The right to object to the processing of personal data, (where applicable i.e. where processing is based on legitimate interests (or the performance of a task in the public interest/exercise of official authority); direct marketing and processing for the purposes of scientific/historical research and statistics).

10. Transfer of Data Abroad
We do not transfer personal data outside the EEA.

11. Automated Decision Making
We do not use any form of automated decision making in our business.

12. Further processing
If we wish to use your personal data for a new purpose, not covered by this Data Privacy Notice, then we will provide you with a new notice explaining this new use prior to commencing the processing and setting out the relevant purposes and processing conditions.

13. Changes to our privacy policy
Any changes we may make to our privacy policy in the future will be posted on this page and, where appropriate, notified to you by e-mail. Please check back frequently to see any updates or changes to our privacy policy.

14. Privacy on our Website

14 i: Website Compliance
We regularly review the bannermandecorators.co.uk website for GDPR compliance and makes updates as appropriate. The website uses the HTTPS protocol and is in addition otherwise currently compliant.

14 ii: Cookies
Like most websites, we use cookies. Cookies are small pieces of data that websites store in their visitors' web browsers. Other technologies, including data we store on your web browser or device, identifiers associated with your device, and other software, are used for similar purposes. In this policy, we refer to all of these technologies as "cookies". Cookies help to improve our services and give you a better experience. For example, they can show us which pages people visit most often, and which are not getting as much attention. If you wish to block cookies you can do this in your browser settings; you can learn more about cookies and how to block them here.

14 iii: Emails
If you provide us with your email address we may send you emails, either in reply to specific enquiries (such as one made using a contact form) or if you have opted in to our email newsletters. You have the ability to opt out of any of this communication at any time. We will never provide your personal information or email address to any third parties except where they are specifically employed to help deliver our own services.

14 iv: Facebook, Twitter and other social networks
These services provide social buttons and similar features which we use on our website - such as the "Like" and "Tweet" buttons. To do so we embed code that they provide and we do not control ourselves. To function, their buttons generally know if you're logged in; for example Facebook uses this to say "x of your friends like this". We do not have any access to that information, nor can we control how those networks use it. Social networks therefore could know that you're viewing this website, if you use their services (that isn't to say they do, but their policies may change). As our website is remarkably inoffensive we imagine this is not a concern for most users.

14 v: Google Analytics
We measure visitors to our website using Google Analytics. This records what pages you view within our site, how you arrived at our site and some basic information about your computer, such as the web browser you use and the screen resolution. All of that information is anonymous - so we don't know who you are; just that somebody visited our site. The information we collect from analytics helps us understand what parts of our sites are doing well, how people arrive at our site and so on. Like most websites, we use this information to make our website better. Any data collected by Google Analytics that is associated with cookies, user identifiers or advertising identifiers is retained for a period of up to 26 months. You can learn more about Google Analytics or opt out if you wish.

15. How to make a complaint

To exercise all relevant rights, queries or complaints please in the first instance contact our Data Representative on 01738 622591. If this does not resolve your complaint to your satisfaction, you have the right to lodge a complaint with the Information Commissioners Office on 03031231113 or via email https://ico.org.uk/global/contact-us/email/ or at the Information Commissioner's Office, Wycliffe House, Water Lane, Wilmslow, Cheshire, SK9 5AF, England.