Data Controller (“the Company”): Gillies of Broughty Ferry Limited, 180 Brook Street, Broughty Ferry, Dundee, DD5 2AJ

Data Compliance Manager: Tom Rodgers (Contact: email: privacy@gillies.co.uk, tel: 01382 477281)

Privacy notice: Customers

Carpet King is a trading name of “Gillies Of Broughty Ferry Limited”

(Where we use “we”, “our”, “us”, “Gillies” or “the Company” in this statement we are referring to “Gillies Of Broughty Ferry Limited”)

Summary

We use your personal data to assist us in answering your enquiry and to provide you with information about our products/services. We also process your personal data in order to provide you with the goods or services that you have ordered.

• We respect your personal data and take its security very seriously.
• We only hold what data we need for the purpose for which we obtained it.
• We delete your data when it has reached the end of its retention period.
• You have privacy rights.
• We are happy to answer your questions. Our contact details can be found at the end of this notice.

What data we collect

For an enquiry or for a quote that you do not accept

we will process your name and contact details.

If you request samples

we will process your name, address and contact details.

If you make a purchase from us

we will process your name, address, contact details and payment information.

If you purchase a gift card

we will process your name, address, contact details and payment information.

If you make a complaint or give us a compliment

we will process your name, address, and contact details.

If you make a disabled VAT exemption

we will process your name, address, contact details and information regarding the VAT claim. This information will reveal details about your disability and health.

If you consent to receive our marketing by electronic means (email and/or SMS(text) message)

we will process your name, mobile telephone number and email address in order to send you marketing information.

If you visit our premises

                our CCTV cameras may record your image

If you visit our web-site

We will process technical information, including the Internet Protocol (IP) address used to connect your device to the Internet, browser type and version, time zone setting and the country where your device is located, browser plug-in types and versions, operating system and platform. We will process information about your visit, including the full Uniform Resource Locators (URL) clickstream to, through and from our websites (including date and time); products you viewed or searched for; page response times, download errors, length of visits to certain pages, page interaction information (such as scrolling, clicks and mouse-overs), methods used to browse away from pages.

How we use your personal data

References to the legal basis for processing of your personal data (e.g. "(Basis: Art. 6(f).)") are references to the article of the General Data Protection Regulation. Each piece of personal data that we process must have a legal basis.

To deal with enquiries or for a quote that you do not accept

If you call us or email us, we will follow up on your enquiry and see if there is a way in which we can help you. We keep a record of enquiries received, to help us plan our business strategy and check that we are offering what potential customers want.

If you provide us with information for a quote and then do not accept the quotation, we will keep a record of your enquiry.  We keep a record of enquiries received, to help us plan our business strategy and check that we are offering what potential customers want

 (Basis: Art. 6(b): we need to use your details to follow up with you and this processing is necessary in order to take steps at your request prior to entering into a contract.  Art. 6(f): business planning is a legitimate activity for a business.)

If you purchase from us

In order to process your order, we will need to process your data in order to send you the goods that you have ordered and to get the goods delivered to you. We need to process payment details in order to fulfil the contract, but never retain payment information such as card details. We will also process your data to allow us to provide customer services after your goods have been delivered.

(Basis: Art. 6(b): processing is necessary for the performance of a contract, Art. 6(f): processing information to assist in the company’s customer services standards is a legitimate activity for a business.)

Disabled VAT exemption Claim

We need to process information about you for your disabled VAT exemption.  This will reveal information about your health.

(Basis: Art. 6(1)(a): you have consented to the processing of your personal data for this purpose.)

(Art. 9(2(a): you have given explicit consent to the processing of your personal data that reveals your health.)

Marketing information

We would like to send you information about our products and services. If you purchased from us before 25^th May 2018 and have not unsubscribed from receiving marketing information we will send you emails, SMS (text) and postal marketing which relates to relevant promotions and offers that we feel will be of interest to you.

If you purchased from us after 24^th May 2018 we will only send you emails and SMS (text) marketing from us which relates to relevant promotions and offers that we feel will be of interest to you if you have actively consented to receiving it. We will send you postal marketing about relevant promotions and offers but you can opt out of receiving this at any time.

 (Basis: Art. 6(f): sending you information about products and services similar to those which you have purchased is a legitimate activity for a business, Basis: Art. 6(1)(a): you have consented to the processing of your personal data for the purpose of sending you information by email or SMS/Text message)

If you visit our premises

We use CCTV cameras to assist in managing and monitoring our properties for the purposes of crime prevention and prosecution of offenders, for identifying accidents and incidents and emergency situations and for internal training. Your image may be recorded by our cameras.

(Basis: Art. 6(f): Crime prevention and Business Planning are legitimate activities for a business.)

If you visit our website

We use the logs from our servers to help with our company's security as well as to look at visitor behaviour (e.g. which website pages get the most traffic or are the most popular). This information will be used to administer our website for internal operations, including troubleshooting, data analysis, testing, research, statistical and survey purposes. It allows us to improve our website to ensure that information is provided in the most effective manner for you (and for your device). It allows you to participate in the interactive features of our service if you choose to do so. It will also allow us to measure or understand the effectiveness of advertising we serve to you and others, and to deliver relevant advertising to you. Analytics: We process your personal information, collected as part of your purchases for the purposes of customer analysis, assessment, profiling and direct marketing, on a personalised or aggregated basis, to help us with our activities and to provide you with the most relevant information as long as this does not harm any of your rights and interests.

(Basis: Art. 6(c): we have a legal obligation to protect the data of our clients and our staff. Art. 6(f): strategy planning is a legitimate activity for a business.)

Your data and transfers outside of the EEA

We do not transfer or process these data outside the European Economic Area.

Your rights

You have rights in respect of our processing of your personal data which are:

• To access to your personal data and information about our processing of it. You also have the right to request a copy of your personal data (but we will need to remove information about other people).
• To rectify incorrect personal data that we are processing.
• To request that we erase your personal data if:

o              we no longer need it;

o              if we are processing your personal data by consent and you withdraw that consent;

o              if we no longer have a legitimate ground to process your personal data; or

o              we are processing your personal data unlawfully

• To object to our processing if it is by legitimate interest.
• To restrict our processing if it was by legitimate interest.
• To request that your personal data be transferred from us to another company if we were processing your data under a contract or with your consent and the processing is carried out by automated means.

If you want to exercise any of these rights, please contact us using the details at the end of this notice.

You also have the right to lodge a complaint about our processing to the UK's Information Commissioner's Office.

Third parties

As a prospective customer, we do not transfer your personal data to third parties at this stage except the following:

• Companies that provide services to us. Our telecommunication and network service providers will get to see your phone number if we call you and they will see your email address (but not the content of what you send us, if you encrypt it).
• In response to a court order. It is possible, though unlikely, that we might be forced to disclose your information in response to a court order.

As a customer, we transfer your data to the following third parties:

• Companies that provide services to us. Our telecommunication and network service providers will get to see your phone number if we call you and they will see your email address (but not the content of what you send us, if you encrypt it).
• Delivery services. Although we have our own delivery teams it is possible that we may use external delivery providers to get your products to you safely and quickly and in such cases we will transfer personal data to such third parties to enable delivery to be fulfilled.
• Customer service agencies. We use customer service agencies to assist with your complaints and compliments. We also use the Furniture Ombudsman.
• Suppliers who provide direct home delivery of your purchase.
• Payment providers. We use Sagepay to process payments and V12 Retail Finance for financing.
• Guardsman. If you choose Guardsman, we will pass your details onto them.
• Tradespeople. We work with a number of tradespeople who assist us with your goods, such as assembly and fitting.
• In response to a court order. It is possible, though unlikely, that we might be forced to disclose your information in response to a court order.
• If you do not pay your bills, we may choose to engage a third party to recover any money you owe us.

Technical security

We would like you to confident about ordering online with us. We use secure socket layer (SSL) technology to ensure that your details are safe and information you provide is fully encrypted so that it cannot be read by third parties. Your browser will confirm that you are shopping in a secure environment by showing a locked padlock icon or an image of a key in the bar at the base of your screen.

All our computers are full-disk encrypted, as are our phones and tablets.

"Normal" phone calls are not encrypted.

Retention periods

This is the length of time that we will continue to process or store your personal data.

Data about prospective clients: duration of enquiry, then one year in case you come back

Data about customers – the length of your warranty period for the warranty; 7 years for HMRC and accounting purposes.

Marketing purposes – for as long as you consent to receive marketing information by Email and/or SMS and for other methods of Marketing until you opt-out of receiving such Marketing

VAT Disability exemptions – 7 years for HMRC and accounting purposes

ICO registration

Gillies of Broughty Ferry Limited is registered with the Information Commissioner's Office (Registration number Z5953417).

Contact us:

Data Compliance Manager

Gillies of Broughty Ferry Limited

180 Brook Street

Broughty Ferry

Dundee DD5 2AJ

Tel: 01382 477281

Email: privacy@gillies.co.uk