Version 18.0, effective 25/05/2018.
|1. Important information and who we are|
1.2 Who we are
Maddocks is the data controller and is responsible for your personal data. All your personal data shall be held and used in accordance with the EU General Data Protection Regulation 2016/679 (‘GDPR’). We have appointed a data protection officer who is responsible for overseeing questions in relation to this privacy notice. If you have any questions about this privacy notice, including any requests to exercise your legal rights, please contact the data protection officer using the details set out below.
H.T. Maddocks & Son (Whitchurch) Ltd
Company Reg No: 00595445
Address: Unit E1-E6 Capital Point, Capital Business Park, Parkway, Cardiff, CF3 2PY
You have the right to make a complaint at any time to the Information Commissioner’s Office (ICO), the UK supervisory authority for data protection issues (www.ico.org.uk). We would, however, appreciate the chance to deal with your concerns before you approach the ICO so please contact us in the first instance.
1.3 Your duty to inform us of changes
It is important that the personal data we hold about you is accurate and current. Please keep us informed if your personal data changes during your relationship with us.
|2. The information we collect|
|2.1 What types of information do we collect about you?|
Maddocks requires a range of information in order to administer your account with us. This typically includes:
If you fail to provide certain information when requested or required, we may not be able to perform the contract we have entered into with you, or we may be prevented from complying with our legal obligations. In this case, we may have to cancel services you have with us, but we will notify you if this is the case at the time.
|3. How we collect your information|
|3.1 Direct Interactions|
Contact Details and Company Details will be provided to Maddocks by you during the process of setting up an account or placing orders with Maddocks. This will be done by completing application forms, or by correspondence via our website, by telephone, email, post, or otherwise.
3.2 Automated Technologies
3.3 Publicly Available Sources
It may be necessary for us to collect Contact Details, Company Details and Financial Information from publicly available sources such as Companies House, and credit reference agencies.
|4. How and why we process your information|
We will only use your personal data when the law allows us to. Most commonly, we will use your personal data in the following circumstances:
GDPR sets out the lawful bases for storing and processing personal data – Maddocks’ use of personal data falls under the following categories:
|5. How we share your information|
| We may have to share your personal data with the third parties set out below: |
|6. Data Security|
|Maddocks has put in place appropriate security measures to prevent your personal data from being accidentally lost, used or accessed in an unauthorised way, altered or disclosed. In addition, we limit access to your personal data to those employees, agents, contractors and other third parties who have a business need to know. They will only process your personal data on our instructions and they are subject to a duty of confidentiality. We have put in place procedures to deal with any suspected personal data breach and will notify you and any applicable regulator of a breach where we are legally required to do so.|
|7. Data Retention|
|We will only retain your personal data for as long as necessary to fulfil the purposes we collected it for, including for the purposes of satisfying any legal, accounting, or reporting requirements. To determine the appropriate retention period for personal data, we consider the amount, nature, and sensitivity of the personal data, the potential risk of harm from unauthorised use or disclosure of your personal data, the purposes for which we process your personal data and whether we can achieve those purposes through other means, and the applicable legal requirements. By law we have to keep basic information about our clients (including Contact, Company, and Financial Data) for six years after they cease being clients for regulatory purposes.|
|8. Your Legal Rights|
The GDPR outlines certain rights which you have in relation to the personal information we hold about you. You have the right to:
You can exercise any of the above rights by contacting us at the address or email address set out in section 1.2. You will not have to pay a fee to access your personal data, or to exercise any of the other rights. However, we may charge a reasonable fee if your request is clearly unfounded, repetitive or excessive.
Most of the above rights are subject to limitations and exceptions. Please note also, that we may not always be able to comply with your request of erasure for specific legal reasons which will be notified to you, if applicable, at the time of your request.
We may need to request specific information from you to help us confirm your identity and ensure your right to access your personal data (or to exercise any of your other rights). This is a security measure to ensure that personal data is not disclosed to any person who has no right to receive it. We may also contact you to ask you for further information in relation to your request to speed up our response.
|We may use your Technical and Usage data, as well as your sales history to form a view on what we think you may want or need, or what may be of interest to you. This is how we decide which services and offers may be relevant for you. You may receive marketing communications from us in these circumstances, or if you have requested information from us, previously purchased from us or provided us with your details and, in each case, you have not opted out of receiving marketing from us. You can ask us to stop sending you marketing messages at any time by following the unsubscribe or opt-out links on any marketing message sent to you or by contacting us at any time.|
|10. Change of Purpose|
|We will only use your personal data for the purposes for which we collected it, unless we reasonably consider that we need to use it for another reason and that reason is compatible with the original purpose. If you wish to get an explanation as to how the processing for the new purpose is compatible with the original purpose, please contact us. If we need to use your personal data for an unrelated purpose, we will notify you and we will explain the legal basis which allows us to do so. Please note that we may process your personal data without your knowledge or consent, in compliance with the above rules, where this is required or permitted by law.|