Privacy Policy G Plan (“We“) are committed to protecting and respecting your privacy. This policy (together with our Cookie Policy) sets out the basis on which any personal data we collect from you, or that you provide to us, will be processed by us. We are committed to safeguarding the privacy of our website visitors and service users. Please read the following carefully to understand our practices regarding your personal data and how we will treat it. G Plan Upholstery Limited (Registered Company No. 00149073) of 1 Hampton Business Park, Melksham, Wiltshire, SN12 6GU, United Kingdom is the Controller for the purpose of the UK General Data Protection Regulation (GDPR) and any national implementing laws, regulations and secondary legislation, as amended or updated from time to time, in the UK and any successor legislation. You can contact us by emailing dataprotectionofficer@sofabrands.com Our website is not intended for children and we do not knowingly collect data relating to children. 1 What is Personal Data? “Personal Data” means any information relating to an identified or identifiable natural person, known as a “data subject”, who can be identified directly or indirectly. It may include names, addresses, email addresses, telephone numbers, IP addresses, location data and other similar information. It may also include “special categories of personal data” such as racial or ethnic origin, political opinions, religious or philosophical beliefs or trade union memberships, genetic data, biometric data for the purpose of uniquely identifying a data subject, data concerning health or data concerning a natural person’s sex life or sexual orientation. 2 The information we collect from you and how we collect it We will collect and process the following Personal Data about you: Identity Data. This type of data includes first name, maiden name, last name, username or similar identifier, marital status, title, date of birth and gender. Contact Data. This category of data includes your billing address, delivery address, email address and telephone numbers. Financial Data. This category of data includes bank account and payment card details. Transaction Data. This category of data includes details about payments to and from you and other details of products and services you have purchased from us. Technical Data. This category of data includes internet protocol (IP) address, your login data, operating system and platform, and other technology on the devices you use to access our site. Profile Data. This category of data includes your username and password for an online account, purchases or orders made by you, your interests, preferences, feedback and survey responses. Usage Data. This category of data includes [information about how you use our site, products and services. Marketing and Communications Data. This category of data includes your preferences in receiving marketing from us and our third parties and your communication preferences. 2.1 Information you give us Through direct interactions. This is usually identity, contact, transaction, profile, marketing and financial data and information about you that you give us, either about yourself or other data subjects e.g individuals whose details are included in any materials provided by you to us, by filling in forms on our site www.gplan.co.uk (our site), by creating an online account on our site, by corresponding with us by phone, e-mail or otherwise. It includes information you provide when you complete an order, enter a competition, prize draw or giveaway, complete an enquiry form, order a swatch, or click the chat function, correspond with us and if you report a problem with our site. The information you give us may include your name, address, e-mail address, phone number, gender, date of birth and financial and credit card information. 2.2 Information we collect about you Through automated technologies or interactions. As you interact with our site we will automatically collect technical and usage data about you and your equipment including the following information: • Technical information, including the Internet protocol (IP) address used to connect your computer to the Internet, your login information, browser type and version, time zone setting, browser plug-in types and versions, operating system and platform; • Information about your visit, including the full Uniform Resource Locators (URL), clickstream to, through and from our site (including date and time), products you viewed or searched for, page response times, download errors, length of visits to certain pages, page interaction information (such as scrolling, clicks, and mouse-overs), methods used to browse away from the page, and any phone number used to call our customer service number. 2.4 Aggregated Data Aggregated Data such as statistical or demographic data could be derived from your personal data but is not considered personal data in law as this data will not directly or indirectly reveal your identity. For example, we may aggregate your usage data to calculate the percentage of users accessing a specific website feature. However, if we combine or connect Aggregated Data with your personal data so that it can directly or indirectly identify you, we treat the combined data as personal data which will be used in accordance with this privacy policy. 2.3 Special categories of personal data We do not collect any special categories of personal data (defined in section1) about you nor do we collect any information about criminal convictions and offences. 3 Cookies Our Website uses cookies to distinguish you from other users of our site. This helps us to provide you with a good experience when you browse our site and also allows us to improve our site. For detailed information on the cookies we use, the purposes for which we use them, and how you can disable them, please see our Cookie policy. 4 Uses made of the information In this section we have set out: • The general categories of Personal Data that we may process; • The purposes for which we may process that Personal Data; and • The legal basis for the processing of that Personal Data. Purpose/Activity Type of data Lawful basis for processing We may process information contained in any enquiry you submit to us regarding our products and/or services. This data may be processed for the purposes of offering, marketing and selling relevant products and/or services to you. Identity, contact, profile and marketing data Necessary for our legitimate interests (to be able to correspond with you effectively to respond to any query or provide marketing materials requested by you). To process and deliver your orders of products from our site. The data may be processed for the purpose of processing, supplying and delivering your purchased products from our site. Identity, contact, technical, usage, profile and marketing data Performance of a contract between you and us and/or taking steps, at your request, to enter into such a contract and necessary for our legitimate interests (to recover debts due to us and to keep proper records of those transactions). To administer and protect our site (including troubleshooting, data analysis, testing, system maintenance, support, reporting and hosting of data). Identity, contact, technical, usage, profile and marketing data Necessary for our legitimate interests (to study how customers use our products/services, to develop them, to grow our business and to inform our marketing strategy) To deliver relevant website content and advertisements to you and measure or understand the effectiveness of the advertising we serve to you. Technical and usage data Necessary for our legitimate interests (to define types of customers for our products and services, to keep our site updated and relevant, to develop our business and to inform our marketing strategy) To use data analytics to improve Our Website, products/services, marketing, customer relationships and experiences. Please see our Cookies Policy for further details. Identity, contact, technical, usage, profile and marketing data Necessary for our legitimate interests (to develop our products/services and grow our business) To make suggestions and recommendations to you about our products that may be of interest to you. Identity, contact, technical, usage, profile and marketing data Necessary for our legitimate interests (to develop our products/services and grow our business) and/or you have provided your explicit consent to receive such marketing materials. To enable you to partake in a prize draw, giveaway, competition or complete a survey. Identity, contact, usage, profile and marketing data. Performance of a contract with you. Necessary for our legitimate interests (to study how customers use our products/services, to develop them and grow our business). In addition to the specific purposes for which we may process your Personal Data set out above, we may also process any of your Personal Data where such processing is necessary for compliance with a legal obligation to which we are subject, or in order to protect your vital interests or the vital interests of another natural person. 5 Disclosure of your information We may share your Personal Data with: 5.1 any member of our group, which means our subsidiaries, our ultimate holding company and its subsidiaries, as defined in section 1159 of the UK Companies Act 2006, insofar as is reasonably necessary for the purposes set out in this policy. 5.2 our insurers and/or professional advisers insofar as reasonably necessary for the purposes of obtaining and maintaining insurance cover, managing risks, obtaining advice and managing legal disputes. 5.3 our business partners, third party suppliers and sub-contractors for the performance of any contract we enter into with them or you; 5.4 analytics and search engine providers that assist us in the improvement and optimisation of our site; 5.5 third party review websites in order to obtain customer feedback on our products and services; 5.6 any prospective buyer of our business or assets, or any prospective seller of another business or business assets that we are interested in buying. We may transfer your Personal Data to a third party to process on our behalf in countries outside of the European Economic Area (EEA) in accordance with the purposes set out above. Such countries do not have the same data protection laws as the UK or EEA. If this is the case, we will ensure that your privacy rights are adequately protected by appropriate technical, organisational and contractual means and any such transfer is made in compliance with the GDPR (or any national implementing law) requirements for external transfer. Please contact us by emailing dataprotectionpolicy@sofabrands.com if you would like further details of the safeguards we have in place. 5.7 Where you would like to obtain finance for our products and we provide your personal data to third party finance providers they will carry out a credit check on you so that they can make credit decisions about you; and to prevent fraud and money laundering. Their search will be recorded on the files of the credit reference agencies and fraud prevention agencies. 5.8 In addition to the specific disclosures of Personal Data set out in this Section 5, we may also disclose your Personal Data where such disclosure is necessary for compliance with a legal obligation to which we are subject, or in order to protect your vital interests or the vital interests of another natural person. 5.9 A list of external third parties who may processed your personal data is set out in Section A of this policy. 6 Where we store your personal data The hosting facilities for our site are situated in the UK. All information you provide to us is stored on our secure servers. Any payment transactions will be encrypted using SSL technology. Where we have given you (or where you have chosen) a password which enables you to access certain parts of our site, you are responsible for keeping this password confidential. We ask you not to share a password with anyone. Unfortunately, the transmission of information via the internet is not completely secure. Although we will do our best to protect your Personal Data, we cannot guarantee the security of your data transmitted to our site; any transmission is at your own risk. Once we have received your information, we will use strict procedures and security features to try to prevent unauthorised access. 7 Your rights In this section we have summarised the rights that you have under data protection law. Some of the rights are complex, and not all of the details have been included in our summary. Accordingly, you should read the relevant laws and guidance from the regulatory authorities for a full explanation of these rights. Your principal rights under data protection law are: • the right to access your Personal Data; • the right to rectification of your Personal Data; • the right to erasure of your Personal Data; • the right to restrict processing of your Personal Data; • the right to object to processing of your Personal Data; • the right to data portability; • the right to request transfer of your Personal Data; You have the right to request information as to whether or not we process your Personal Data and, where we do, access to the Personal Data, together with certain additional information. That additional information includes details of the purposes of the processing, the categories of Personal Data concerned and the recipients of the Personal Data. Providing the rights and freedoms of others are not affected, we will supply to you a copy of your Personal Data. The first copy will be provided free of charge, but additional copies may be subject to a reasonable fee. Provision of such information will be subject to you supplying us with appropriate evidence of your identity. You have the right to ask us not to process your Personal Data for marketing purposes. You can exercise your right to prevent such processing by unsubscribing at any time. You can also exercise the right at any time by contacting us at online-orders@gplan.co.uk or telephone 01225 700880. We do not share your Personal Data with third parties for their marketing purposes. We try to respond to all legitimate requests within one month. Occasionally it could take us longer than a month if your request is particularly complex or you have made a number of requests. In this case, we will notify you and keep you updated. Our site may, from time to time, contain links to and from the websites of our partner networks, advertisers and affiliates. If you follow a link to any of these websites, please note that these websites have their own privacy policies and that we do not accept any responsibility or liability for these policies. Please check these policies before you submit any personal data to these websites. 8 Retention and deletion of Data This section sets out our data retention procedure, which is designed to help ensure that we comply with our legal obligations in relation to the retention and deletion of Personal Data. Personal data that we process is only retained for as long as reasonably necessary to fulfil the purposes we collected it for. We may need to hold onto your data for longer periods in the event of a complaint or if we reasonably believe there is a prospect of litigation in respect of our relationship with you. By law we have to keep basic information about our customers (including contact, identity, financial and transaction data) for six years after they cease being customers for tax purposes. We may keep an anonymised form of your Personal Data, which no longer refers to you, for statistical purposes without time limits, to the extent that we have a legitimate and lawful interest in doing so. We will hold information in relation to the order for the length of the guarantee period. Notwithstanding the other provisions of this section, we may retain your Personal Data where such retention is necessary for compliance with a legal obligation to which we are subject, or in order to protect your vital interests or the vital interests of another natural person. 9 Changes to our privacy policy and your duty to inform us of changes We keep our privacy policy under regular review and any changes we make to our privacy policy in the future will be posted on this page. Please check back frequently to see any updates or changes to our privacy policy . It is important that the personal data we hold about you is accurate and current. Please keep us informed if your personal data changes during your relationship with us. Contact We have appointed a data protection officer (DPO) who is responsible for overseeing questions in relation to this privacy policy. If you have any questions about this privacy policy, including any requests to exercise your rights, please use the following contact details: Email address: dataprotectionofficer@sofabrands.com Postal address: Peter Robinson Sofa Brands Group International Limited 1, Hampton Park West, Melksham, Wiltshire. SN12 6GU 10 Complaints You have the right to make a complaint at any time to the Information Commissioner’s Office (ICO), the UK regulator for data protection issues (www.ico.org.uk). We would, however, appreciate the chance to deal with your concerns before you approach the ICO so please contact us in the first instance. SECTION A: THIRD-PARTY PROCESSORS 1. Wincanton Holdings Limited. For the purposes of delivery your ordered Products to your home or chosen delivery site. 2. Adyen N.V. For the purposes of allowing your orders to be processed and payment being successfully made by you. 3. Trust Pilot. For the purposes of customer reviews and feedback. 4. Mailchimp. For the purpose of securely sending email communications when a customer has opted into receiving them.
