We use cookies to make your experience better. To comply with the new e-Privacy directive, we need to ask for your consent to set the cookies. Learn more.
Policies
Tibard is committed to ensuring the security of your information. To prevent unauthorised access, maintain data accuracy and ensure the appropriate use of information, we have put in place appropriate physical, electronic, and managerial procedures to safeguard and secure the information we collect.
Tibard provides this online privacy statement to make you aware of our privacy policy and practices and of the choices you can make about the way your personal data* is collected and used. To make this notice easy to find, we make it available on our homepage.
*Personal data means any information that may be used to identify an individual. This includes (although is not limited to) names, addresses, email addresses or other contact information.
Personal Information
You may provide us with personal data on an order form, online or over the telephone. This may include your name, address, email, telephone number and payment instructions. We use this information in order to manage your orders and purchase activity. We may also keep information contained in any correspondence with us, for example by email or post.
This provision of personal data is essential for us to be able to administer your account, for example to collect payments for your purchases and verify your identity when you contact us.
When you use our websites, we may collect, store and use the following kinds of data:
- information about your PC and your visits to this website such as your IP address, geographical location, browser type, referral source, length of visit and number of pages viewed.
- information relating to any transactions carried out between you and Tibard on or in relation to our websites, including information relating to any purchases you make of our goods and/or services.
- information that you provide to us for the purpose of registering with us and allowing us to send you email notifications and/or newsletters.
Tibard would like to emphasise that information of this nature is used only to enhance the customer shopping experience of the website.
Using Your Personal Information
Personal data submitted to us will be used (by Tibard as the controller and processor) for the purposes specified in this section or as found elsewhere in the relevant parts of the website. We may use your personal information to:
- administer the website and your account
- improve your browsing experience by developing and improving the design and layout of the website, through monitoring of your usage
- process your orders
- provide you with information such as news regarding the website, new services and special offers or promotions that may be of interest to you, with your consent (see also 'Keeping In Touch With You')
Data Protection
Tibard use SSL-128bit encryption Secure Server Technology to ensure that all of your personal and transactional information is protected to the highest standards. We never make your personal details available to companies other than Tibard for marketing purposes (see also ‘Third Parties’). ‘Tibard Limited’ is registered with the Information Commissioners Office as a Data Controller. We will comply with the standard, procedures and requirements as laid down in the General Data Protection Regulation 2018 and Data Protection Acts 1984 and 1998 to ensure that your personal data is kept secure and processed lawfully. Our full Data Protection policy can be found below.
Cookies
When you enter this website we will use cookies. Cookies are tiny text files that identify your computer to our server. These cookies in no way allow us access to your computer and do not store any details relating to you or your credit cards. They are used to record the areas of the site that you have visited and for how long, which provides us with useful usage information that helps us make our site more accessible to our customers in line with their needs. You may also see Tibard adverts and content on other websites. For these adverts, our third party providers may use cookies so that Tibard can monitor whether you see the adverts, click on them and buy from our website. Cookies are placed on your computer if your browser is set to allow these. If you wish to 'turn off' cookies, then please check your browser's help files for guidance on how to do so. The Help section is usually found in the Menu bar at the top of the browser. Some browsers provide help if the F1 key is pressed. However, you may lose some of the functionality of this website.
List of cookies we collect
The table below lists the cookies we collect and what information they store.
| COOKIE name | COOKIE Description |
|---|---|
| CART | The association with your shopping cart. |
| CATEGORY_INFO | Stores the category info on the page, that allows to display pages more quickly. |
| COMPARE | The items that you have in the Compare Products list. |
| CURRENCY | Your preferred currency |
| CUSTOMER | An encrypted version of your customer id with the store. |
| CUSTOMER_AUTH | An indicator if you are currently logged into the store. |
| CUSTOMER_INFO | An encrypted version of the customer group you belong to. |
| CUSTOMER_SEGMENT_IDS | Stores the Customer Segment ID |
| EXTERNAL_NO_CACHE | A flag, which indicates whether caching is disabled or not. |
| FRONTEND | You sesssion ID on the server. |
| GUEST-VIEW | Allows guests to edit their orders. |
| LAST_CATEGORY | The last category you visited. |
| LAST_PRODUCT | The most recent product you have viewed. |
| NEWMESSAGE | Indicates whether a new message has been received. |
| NO_CACHE | Indicates whether it is allowed to use cache. |
| PERSISTENT_SHOPPING_CART | A link to information about your cart and viewing history if you have asked the site. |
| POLL | The ID of any polls you have recently voted in. |
| POLLN | Information on what polls you have voted on. |
| RECENTLYCOMPARED | The items that you have recently compared. |
| STF | Information on products you have emailed to friends. |
| STORE | The store view or language you have selected. |
| USER_ALLOWED_SAVE_COOKIE | Indicates whether a customer allowed to use cookies. |
| VIEWED_PRODUCT_IDS | The products that you have recently viewed. |
Keeping In Touch With You
With your consent, we would like to keep you up to date with key information about new ranges, promotional offers and what's coming soon to the Tibard website. We may also use your details to send you information about other goods and services we sell or for our research purposes. If you have registered to receive email newsletters from us, you can remove your email address from our list by using the 'unsubscribe' links in the emails we send you.
Third Parties
The UK Data Protection Act and consumer legislation requires that we do not release your personal information to any external company for mailing or marketing purposes unless we have your prior approval. We will only disclose your information with other third parties with your express consent with the exception of the following categories of third parties:
- couriers so as to complete delivery of orders as per the contract entered into at the point of sale
- (for example FedEx and Royal Mail)
- reviewing companies in order to provide the customer with a method of giving company feedback
- regulatory authorities, to comply with any legal and regulatory issues and disclosures
- insurance companies / loss assessors / fraud prevention agencies for the purposes of fraud prevention
- mailing / printing agents and contractors / advisors that provide a service to us (on the understanding that they keep the information confidential)
- anyone to whom we may transfer our rights and duties under any agreement we have with you
- legal / crime prevention agencies to satisfy any regulatory request (including recognised practitioner bodies) if we have a duty to do so or if the law allows us to do so.
Transfer of personal data outside of the European Economic Area (EEA)
We do not currently transfer your personal data outside the EEA. In accordance with the terms of this Policy, if in the future we transfer your personal data outside of the EEA we will make sure that the receiver agrees to provide the same or similar protection as we do and that they will only use your personal data in accordance with our instructions.
Retaining personal data information
Retention periods are in line with the length of time we need to keep personal data information in order to manage and administer your account. This may include any claims or requests for assistance made to us and takes into account our need to meet any legal, statutory and regulatory obligations. Our need to use your personal data information will be reassessed on a regular basis; information no longer required will be disposed of.
Links to External Websites
Within our site there are links to third party websites which we feel may be relevant and interesting to our customers. Following these links will take you to external websites which Tibard do not have any control over. For this reason we cannot be held responsible or liable for any content on these sites.
Credit Card Security
Tibard accepts major credit and debit cards, including Visa and MasterCard, through our payment service provider SagePay. All credit card details are secured with 128bit encrypted sessions and all sensitive information is stored on a heavily encrypted database that is protected by multiple government approved firewalls.
Data subject rights
Subject access requests
The General Data Protection Regulation (GDPR) grants you (the "data subject") the right to access particular personal data held about you. This is known as a ‘subject access request’. We shall respond promptly, certainly within one month from the point of receiving the request and any necessary information from you. Our formal response shall include details of the personal data we hold about you, including the purpose for processing the personal data and the person or entity we may be sharing the information with.
Right to rectification
The data subject has the right to obtain the rectification of inaccurate personal data we may hold concerning them, without undue delay. The data subject has the right to have incomplete personal data completed, taking into account the purposes of the processing.
Right to erasure
The data subject has the right to obtain the erasure of personal data concerning them in certain circumstances (for example where the data held is no longer required for the purposes for which it was collected), without undue delay. (Please note that this may affect future product warranty rights if we are not able to verify the authenticity of a possible future claim).
Right to restriction of processing
The data subject has the right to obtain restriction of processing where one of the following applies:
- the accuracy of the personal data is contested by the data subject
- (and personal data is restricted until the accuracy has been verified)
- the processing is unlawful and the data subject opposes the erasure of the personal data and requests the restriction of its use instead
- the personal data is required by the data subject for a potential legal claims but is no longer required by us for the purposes of processing
- the data subject has objected to processing of their personal data, pending verification of whether there are legitimate grounds for us to override these objections.
We shall communicate any rectification, erasure or restriction of processing of personal data (as described above) to each recipient to whom the personal data has been disclosed, unless this proves impossible or requests are manifestly unfounded or excessive. The data subject shall be provided with information about these recipients if they request it.
Right to data portability
The data subject has the right to receive the personal data they have provided to us in a machine-readable format (for example CSV) and can request the transfer of this data to another controller.
Right to object
The data subject has the right to object, on grounds relating to their particular situation, to the processing of their personal data including any personal profiling, unless the processing is necessary for the performance of a task carried out in the public interest or exercise of official authority vested in us. There must be demonstrable compelling legitimate grounds to override the interests, rights and freedoms of the data subject, or for the establishment / exercise / defence of potential legal claims.
Right to not be subject to decisions based solely on automated processing
The data subject has the right not to be subject to automated processing based on their personal data and be able to obtain human intervention, express their point of view, obtain an explanation of the decision and challenge it.
Invoking your rights
Please contact us at [email protected] or write to us at Tibard House, Globe Lane Industrial Estate, Broadway, Dukinfield, SK16 4UU if you would like to invoke any of the data subject rights with us.
Accuracy of information
Please help us to maintain accurate records by informing us if changes occur, for example with names and addresses. We need to keep accurate personal data in order to provide a high level of customer service and reasonable steps are taken to ensure the accuracy of any personal data or sensitive information obtained. The source of any personal data or sensitive information should be clear and any challenges to the accuracy of the information will be carefully considered.
Complaints
If you have any complaints regarding the use of your personal data, please email [email protected] and we will try to resolve the issue. If you are unsatisfied with the outcome of your complaint, you can make a formal complaint to the Information Commissioner’s Office (ICO) by phone on 01625 545745 or 0303 123 1113.
Policy Amendments
We reserve the right, at all times, to update, modify or amend our Policies. Please check and review this Privacy and Cookies Policy from time to time to ensure you are aware of any changes we may have made.
Data Protection Policy – GDPR
|
POLICY NAME |
Data Protection Policy – Tibard Limited |
|
PURPOSE |
To ensure that data is dealt with appropriately, ethically, and in line with legislative requirements |
|
APPLIES TO |
All Employees, Casual Workers, Agency Staff, Volunteers, Apprentices, Agents, Sponsors and any other person associated with the Company or any of its subsidiaries. |
|
DATE REVIEWED |
April 2026 |
|
Document Reference: |
REF: 0126 V2 |
1 Introduction
1.1 Tibard Limited (“The Company”) takes the security and privacy of personal data seriously and ensures that personal data is processed in a transparent and lawful manner.
1.2 The gathering and processing of data is a fundamental requirement of our business activity in order to maintain relationships with individuals. However, at all times we will comply with our legal obligations under the Data Protection Act 2018 (‘the 2018 Act’) and the EU General Data Protection Regulation (‘GDPR’), and any other data protection legislation in force, in respect of data privacy and security. As part of our obligations and ongoing commitments to staff and other groups whose data we hold and process, we have a duty to openly communicate the information contained in this policy.
1.3 This policy applies to current and former employees, workers, volunteers, apprentices, contractors and consultants of the Company and any subsidiary, and also to any individual who has expressed or applied to work with the Company. If you fall into one of these categories, then you are a ‘data subject’ for the purposes of this policy. You should read this policy alongside your contract of employment (or contract for services agreement) and any other documentation we issue to you from time to time in relation to personal data.
1.4 The Company is a ‘data controller’ for the purposes of personal data. This means that we determine the purpose and means of the processing of personal information.
1.5 This policy explains how the Company will hold and process personal information and it explains individual rights as a ‘data subject’. It also explains the obligations on all staff (permanent and temporary employees, workers, contractors and volunteers) when obtaining, handling, processing or storing personal data in the course of working for, or on behalf of the Company.
1.6 The Company does have separate privacy notices in place in respect of job applicants, employee’s, customers/clients, suppliers and other categories of data subject in addition to this policy, and we will always communicate these notices clearly, and the notices alongside this policy, will outline the reason for processing data, and how the data will be processed, shared and stored.
1.7 This policy does not form part of a contract of employment (or contract for services if relevant) and can be amended by the Company at any time. It is intended that this policy is fully compliant with all legislation covering data protection obligations.
2 Data Protection Principles
2.1 Personal data must be processed in accordance with six ‘Data Protection Principles.’
It must:
· be processed fairly, lawfully and transparently.
· be collected and processed only for specified, explicit and legitimate purposes;
· be adequate, relevant and limited to what is necessary for the purposes for which it is processed;
· be accurate and kept up to date. Any inaccurate data must be deleted or rectified without delay;
· not be kept for longer than is necessary for the purposes for which it is processed; and
· be processed securely.
The Company is accountable for these principles and must be able to show compliance with these principles at all times.
3 How we define personal data
3.1 ‘Personal data’ means information which relates to a living person who can be identified from that data (a ‘data subject’) on its own, or when taken together with other information which is likely to come into our possession. It includes any expression of opinion about the person and an indication of the intentions of us or others, in respect of that person, but it does not include anonymised data.
3.2 This policy applies to all personal data whether it is stored electronically, on paper or on other materials.
3.3 This personal data might be provided to the Company, by you, or someone else (such as a former employer, your doctor, or a credit reference agency), or it could be created by the Company. It could also be provided or created during the recruitment process or during the course of the contract of employment (or services) or after its termination. It could be created by your Manager or other colleagues.
3.4 The Company may (where relevant and where a lawful reason for processing exists) collect and use the following types of personal data about you, and potential or current staff (including workers and contractors) working for the Company:
· recruitment information such as application forms and CV’s, references, qualifications and membership of any professional bodies and details of any pre-employment assessments;
· contact details and date of birth;
· the contact details of any emergency contacts;
· gender;
· pronouns;
· marital status and family details;
· information about contracts of employment (or services) including start and end dates of employment, role and location, working hours, details of promotion, salary (including details of previous remuneration), pension, benefits and holiday entitlement;
· bank details and information in relation to tax status including a national insurance number;
· identification documents including passport and driving licence, and information in relation to immigration status and right to work for us;
· information relating to disciplinary or grievance investigations and proceedings involving staff (whether or not you are the main subject of those proceedings);
· information relating to performance and behaviour at work;
· training records;
· electronic information in relation to the use of IT systems/swipe cards/Company telephone, mobile phone and IT systems;
· images (whether captured on CCTV, by photograph or video);
· information in relation to specific accreditation or recognition required to carry out workplace tasks;
· accident, incident, permits to work & health & safety records;
· information on Drug & Alcohol testing; and
· any other category of personal data which we may notify you of from time to time.
4 How we define special categories of personal data
4.1 ‘Special categories of personal data’ are types of personal data consisting of information as to:
· racial or ethnic origin;
· political opinions;
· religious or philosophical beliefs;
· trade union membership;
· genetic or biometric data;
· health;
· sex life and sexual orientation; and
· any criminal convictions and offences.
The Company may hold and use any of these special categories of your personal data in accordance with the law.
5 How we define processing
5.1 ‘Processing’ means any operation which is performed on personal data such as:
· collection, recording, organisation, structuring or storage;
· adaption or alteration;
· retrieval, consultation or use;
· disclosure by transmission, dissemination or otherwise making available;
· alignment or combination; and
· restriction, destruction or erasure.
This includes processing personal data which forms part of a filing system and any automated processing.
6 How will we process your personal data?
6.1 The Company will process personal data (including special categories of personal data) in accordance with our obligations under the GDPR.
6.2 In particular, personal data will be used:
· to perform the contract of employment (or services) between you and the Company, or when assessing your suitability for a contract of employment (or services);
· in complying with any legal obligation; or
· if it is necessary for the Company’s legitimate interests (or for the legitimate interests of someone else). However, the Company can only do this if the ‘data subject’s’ interests and rights do not override that of the Company (or that of someone else). The ‘data subject’ will also have the right to challenge the Company’s legitimate interests and request that it stop’s this processing. See details of rights as a ‘data subject’ in section 12 below.
The Company can process personal data for the above purposes without individual knowledge or consent, but will not use personal data for an unrelated purpose without telling the ‘data subject’ about it, and the legal basis that the Company intends to rely on for processing it.
If an individual chooses not to provide the Company with certain personal data, it is important that they are aware that we may not be able to carry out certain parts of the contract between both parties. For example, if an employee does not provide the Company with bank account details, the Company may not be able to pay the employee. It might also stop the Company from complying with certain legal obligations and duties.
7 When will the Company process your personal data?
7.1 The Company has to process personal data in various situations during recruitment, employment (or engagement) and even following termination of employment (or engagement).
7.2 For example (and see section 7.6 below for the meaning of the asterisks):
· to decide whether to employ (or engage) someone;
· to decide how much to pay someone, and decide on other terms applicable to a contract;
· to check a legal right to work in the UK;
· to carry out the contract between parties, including where relevant, its termination;
· training and reviewing of performance*;
· to decide whether to promote someone;
· to decide whether and how to manage performance, absence or conduct matters*;
· to carry out a disciplinary or grievance investigation or procedure in relation to an individual or someone else;
· to determine whether the Company needs to make reasonable adjustments to the workplace or a role because of a disability*;
· to monitor diversity and equal opportunities*;
· to monitor and protect the security (including network security) of the Company;
· to monitor and protect the health and safety of all those working or visiting our offices and labs, and third parties*;
· to pay and provide pension and other benefits in accordance with a contract in place*;
· paying tax and national insurance;
· to provide a reference upon request from another employer;
· to pay trade union subscriptions*;
· monitoring compliance by staff, the Company and others with our policies and contractual obligations*;
· to comply with employment law, immigration law, health and safety law, tax law and other laws which affect the Company*;
· to answer questions from insurers in respect of any insurance policies which relate to individual members of staff*;
· coordinating the Company’s business activity and planning for the future;
· the monitoring, prevention and detection of fraud or other criminal offences;
· to defend the Company in respect of any investigation or litigation and to comply with any court or tribunal orders for disclosure*; and
· for any other reason which the Company may notify ‘data subject’s’ of from time to time.
7.3 The Company will only process special categories of personal data (see above) in certain situations in accordance with the law. For example, the Company can do so if they have explicit consent from a ‘data subject’.
Also, if the Company has asked for consent from a ‘data subject’ to process a special category of personal data then the reasons for this would be explained, and consent does not need to be given. Furthermore, if consent is given, it can be withdraw at a later date by sending an email to [email protected]
7.4 The Company do not need your consent to process special categories of your personal data when processing it for the following purposes, which the Company may do:
· where it is necessary for carrying out rights and obligations under employment law;
· where it is necessary to protect a ‘data subjects’ vital interests or those of another person, where they are physically or legally incapable of giving consent;
· where data is made public;
· where processing is necessary for the establishment, exercise or defence of legal claims; and
· where processing is necessary for the purposes of occupational medicine or for the assessment of an employees working capacity.
7.5 The Company might process special categories of personal data for the purposes in paragraph 7.2 above which have an asterisk beside them. In particular, the Company will use information in relation to:
· race, ethnic origin, religion, sexual orientation or gender to monitor equal opportunities;
· sickness absence, health and medical conditions to monitor level of absences, assess fitness for work, to pay benefits, to comply with legal obligations under employment law, including to make reasonable adjustments and to look after the health and safety of staff on site; and
· trade union membership to pay any subscriptions and to comply with legal obligations in respect of trade union members.
7.6 The Company will not make automated decisions based on personal data, or data profiling of ‘data subjects’ where a potentially damaging decision is taken without human intervention.
8 Sharing personal data
8.1 Sometimes the Company might share personal data with group companies or contractors and agents to carry out obligations under a contract with a ‘data subject’ or to pursue the Company’s legitimate interests. For example;
· The Company employ the services of a HR consultancy company to provide advice and support in relation to HR and employment law.
· We do also engage with payroll, and pension providers. On occasion it will be necessary to share personal data with these third parties to seek advice in the interests of all parties involved in a contract of employment (or services), and to fulfil legal obligations.
8.2 The Company do require any third party named above to keep personal data confidential and secure and to protect the data in accordance with the law, and Company policies. Third parties are only permitted to process data for the lawful purpose for which it has been shared and in accordance with the Company’s instructions.
8.3 The Company does not send personal data outside of the European Economic Area. If this changes, affected staff will be notified and measures to protect the security of such data will be explained.
9 How are staff (permanent and temporary employees, workers, contractors and volunteers) required to process personal data on behalf of the Company?
9.1 Everyone who works for, or on behalf of the Company has a responsibility for ensuring data is collected, stored and handled appropriately, in line with this policy and to ensure the Company’s rules on data security and retention are complied with.
9.2 Employee personnel files and contract for services documentation will be held for 7 years post-employment/engagement.
9.3 CV’s and interview notes whether the candidate is successful or unsuccessful will be held for a period of 6 months following an interview.
9.4 You should only access personal data covered by this policy if it is needed for the performance of your workplace duties, and only if you have the authorisation to do so by a Manager. On this point, it is important to note that personal data should only be used for the specified lawful purpose for which it was obtained.
9.5 Personal data must not be shared informally.
9.6 You have a responsibility to keep personal data secure and not share it with unauthorised people.
9.7 You are required to regularly review and update personal data which you have to deal with for work. This includes telling the Company if your own personal details change.
9.8 You should not make unnecessary copies of personal data and you must dispose of any copies securely.
9.9 You are expected to use strong passwords for IT related systems which include 8+ characters that contain at least one character that is in upper and lower case.
9.10 You should lock your computer screens when not at your desk. Company mobile phones and other mobile devices should be password protected at all times.
9.11 Personal data should be encrypted before being transferred electronically to authorised external contacts.
9.12 Consider anonymising data or using separate keys/codes so that the ‘data subject’ cannot be identified.
9.13 Do not save personal data to your own personal computers or other devices.
9.14 Personal data should never be transferred outside the European Economic Area except in compliance with the law and only with written authorisation from a Director.
9.15 You should lock drawers and filing cabinets. Do not leave paper with personal data lying about.
9.16 You should not take personal data away from Company’s premises without authorisation from your Manager.
9.17 Personal data should be shredded and disposed of securely when you have finished with it.
9.18 You should ask for help from your line manager if you are unsure about data protection or if you notice any areas of data protection or security that the Company can improve upon.
9.19 Any deliberate or negligent breach of this policy by you may result in disciplinary action in accordance with the Company’s disciplinary procedure, and it is important that you are aware that any such deliberate or negligent actions may amount to Gross Misconduct, and could result in your dismissal. Other forms of remedial action can be taken where appropriate, such as is the case with contractors, workers and/or volunteers.
9.20 It is a criminal offence to conceal or destroy personal data which is part of a subject access request (see below). This conduct would also amount to Gross Misconduct under our disciplinary procedure, which could result in dismissal.
9.21 The Managing Director Ian Mitchell is responsible for reviewing this policy and updating the on the Company’s data protection responsibilities and any risks in relation to the processing of data. If you have any questions or concerns in relation to this policy or data protection in general, you should raise such matters by sending an email to [email protected].
10 How to deal with data breaches
10.1 The Company has robust measures in place to minimise and prevent data breaches from taking place. Should a breach of personal data occur then you must take notes and keep evidence of the breach. If the breach is likely to result in a risk to the rights and freedoms of a ‘data subject’ then the Company must also notify the Information Commissioner’s Office within 72 hours.
10.2 If you or anyone else is made aware of a data breach, then you must report this by sending an email to [email protected] and keep any evidence in relation to the breach. Ben Monks should also be made aware.
11 Use of CCTV
11.1 For reasons of personal security and to protect the Company’s premises and the property of employees and customers, close circuit television cameras are in operation in certain locations. This policy determines that personal data obtained during monitoring will be processed as follows:
· Any monitoring will be carried out only by a limited number of specified employees;
· The recordings will be accessed only by senior Managers and Directors;
· Personal data obtained during monitoring will be destroyed as soon as possible after any investigation is complete;
· Employees involved in monitoring will maintain confidentiality in respect of personal data.
12 Subject access requests
12.1 Data subjects can make a ‘subject access request’ (‘SAR’) to find out what information the Company holds about them. This request must be made in writing and such a request must be forwarded immediately by email to [email protected] so that it can be responded to accordingly.
12.2 The Company will respond within one month to a SAR unless the request is complex in which case, the period to respond can be extended by a further two months.
12.3 There is no fee for making a SAR. However, if a request is manifestly unfounded or excessive the Company may charge a reasonable administrative fee or refuse to respond to a request.
13 Rights of a ‘Data Subject’
As a data subject;
13.1 You have the right to know what personal data the Company does process, how it is processed and on what basis as set out in this policy.
13.2 You have the right to access your own personal data by way of a subject access request (SAR) (see above).
13.3 You have the right to correct any inaccuracies in your personal data.
13.4 You have the right to request that the Company erase your personal data where we were not entitled under the law to process it at that time, or the personal data is no longer necessary for the purpose it was collected.
13.5 You have the right to object to data processing where the Company is relying on a legitimate interest to do so and you think that your own rights and interests outweigh the Company’s own and you wish for the Company to stop its processing.
13.6 You have the right to object if we process your personal data for the purposes of direct marketing.
13.7 While you are requesting that your personal data is corrected or erased or are contesting the lawfulness of processing, you can apply for its use to be restricted while the application is made.
13.8 You have the right to receive a copy of your personal data and to transfer your personal data to another data controller. We will not charge for this and will in most cases aim to do this within one month.
13.9 With some exceptions, you have the right not to be subjected to automated decision-making.
13.10 You have the right to be notified of a data security breach concerning your personal data.
13.11 In most situations there will be a lawful reason for processing your personal data and therefore, we will not need to rely on your consent to do so. However, if we do process data which requires consent, steps will be made to obtain your consent and you will have the right not to consent, or to withdraw consent given at a later stage. If consent is required, no processing of personal data will take place until consent is obtained.
13.12 If you have any specific questions in relation to the above rights, or you are wanting to enforce any of the rights as outlined above, you should send an email to Vanessa Haddrell [email protected].
13.13 You also have the right to complain to the Information Commissioner if you are unhappy with the Company’s processing of personal information. You can do this by contacting the Information Commissioner’s Office directly. Full contact details including a helpline number can be found on the Information Commissioner’s Office website (www.ico.org.uk). This website has further information on your rights and our obligations.
Signed:
Position: Managing Director
Date: 7th April 2026
To be reviewed April 2027