Privacy Policy

Last updated: 28/02/24

PRIVACY POLICY

Welcome to the privacy policy for the Topps Tiles Group and its associated companies (we, our or us). A full list of the companies to which this notice relates, together with their contact and legal information is set out in the first section of this policy below.

We respect your privacy and are committed to protecting your personal information.

This policy explains why and how we will use the personal information that we have obtained from you or others, with whom we share it and the rights you have in connection with the information we use. Please read the following carefully.

This policy was last updated on the date that appears at the beginning of it.

We have set out this policy in a layered format so you can click through to the specific areas set out below.

1. IMPORTANT INFORMATION AND WHO WE ARE

2. PERSONAL INFORMATION WE COLLECT ABOUT YOU AND HOW WE COLLECT IT

3. HOW WE USE YOUR PERSONAL DATA

4. DISCLOSURES OF YOUR PERSONAL INFORMATION BY US

5. OUR USE OF SOCIAL MEDIA

6. INTERNATIONAL TRANSFERS OUTSIDE OF EUROPE

7. DATA SECURITY AND LINKS TO OTHER WEBSITES

8. THE PERIODS FOR WHICH WE RETAIN YOUR PERSONAL INFORMATION

9. YOUR RIGHTS IN RELATION TO YOUR PERSONAL INFORMATION

1. IMPORTANT INFORMATION AND WHO WE ARE

1.1 PURPOSE OF THIS POLICY

This policy describes the way we handle and use the personal information that we obtain from all the different interactions you may have with us, including when you visit our stores, websites (Sites), social media pages or when you contact us or take part in any of our competitions or promotions.

This policy also provides details regarding your legal rights in relation to your personal information and important information about the sources and recipients of your information, and how long with retain it.

1.2 COMPANIES TO WHICH THIS POLICY APPLIES

We operate our business through numerous individual companies (each a "Topps Company"), as follows:

Topps Company	Company Details	Site
Topps Tiles plc	Registered office address: Topps Tiles Thorpe Way, Grove Park, Enderby, Leicestershire, LE19 1SU Company number: 03213782	www.toppstiles.co.uk
Topps Tiles (UK) Limited	Registered office address: Topps Tiles Thorpe Way, Grove Park, Enderby, Leicestershire, LE19 1SU Company number: 04781209	www.tilewarehouse.co.uk
Parkside Ceramics Limited	Registered office address: Parkside Barnsdale Way, Enderby, Leicester, England, LE19 1SN Company number: 01732302	www.parkside.co.uk
Pro Tiler Limited	Registered office address: Topps Tiles Thorpe Way, Grove Park, Enderby, Leicestershire, LE19 1SU Company number: 07154275	www.protilertools.co.uk www.premiumtiletrim.co.uk www.northantstools.co.uk www.warmfloorstore.co.uk www.flooringmaterials.co.uk

Whenever providing personal information or interacting with us, the relevant Topps Company with whom you are dealing is the ‘controller’ in relation to the personal information processing activities described below. A ‘controller’ is an organisation that decides why and how your personal information is processed and is legally responsible to you for such processing.

Where this policy refers to "we", "our" or "us" below, unless it mentions otherwise, it is referring to the particular Topps Company that is the controller of your personal information.

If you have any questions about this privacy policy, including any requests to exercise your data subject rights, further explained below in section 9 to this policy ‘Your Legal Rights’, please contact us using the details set out below.

Full name of organisation : Topps Tiles Group

F.A.O: Data Protection Team

Email address: gdpr@ToppsTiles.co.uk

Postal address: Topps Tiles, Grove Park, Thorpe Way, Enderby, Leicester, LE19 1SU

You have the right to make a complaint at any time to the Information Commissioner’s Office (ICO), the UK data protection regulator (www.ico.org.uk). We do encourage you to first raise any concerns with our data protection team that you may have so we can seek to resolve these with you directly.

1.3 CHANGES TO THIS POLICY AND YOUR DUTY TO INFORM US OF CHANGES

We may review this policy from time to time and any changes will be notified to you by posting an updated version on our Sites and/or by contacting you by email. Any changes will take effect 7 days after we post the modified terms on our Sites or after the date we notify you by email. We recommend you regularly check this page for changes and review this policy each time you visit our Sites.

It is important that the personal information we hold about you is accurate and current. Please keep us informed if your personal information changes during your relationship with us.

2. PERSONAL INFORMATION WE COLLECT ABOUT YOU AND HOW WE COLLECT IT

Personal information, often referred to as personal data, means any information relating to an individual that has been identified or could be identified. It does not include data where the identity has been removed (anonymous data).

When we collect it from you

You may collect your personal information when you are filling in forms on our Sites, purchasing a product from us online or in store, by corresponding with us by post, phone, email, SMS or by the filling in of data capture forms in store or by a member of our staff on your instruction. This includes personal information you provide when you:

visit our stores, Sites or social media pages;
buy, place an order for or receive a quotation for our products or services;
receive a refund on our products;
create an account on our Sites;
subscribe to our services or publications;
request to receive marketing;
participate in a competition, promotion or survey;
give us some feedback;
use an online service (e.g. our visualiser feature);
request an e-receipt;
request information following a sample purchase or quote;
sign up to receive press releases or investor alerts;
contact our customer services team;
make an enquiry direct to our store (e.g. via phone);
leave an online customer review of our products or service
arrange an in-store consultation;
sign up for a credit account or apply for interest free credit; or
request a quotation.

For trade customers and trade/ business users only, we will also collect your data in the following ways when you:

give us business cards to be displayed in store;
where applicable, register for a trade account for discount purposes;
join our trade loyalty scheme; or
attend an in store event or training day (such as a trade roadshow).

How we receive information about you

We receive information from you in a variety of ways, as follows:

Personal information that you give to us

We collect the following information if you choose to give it to us:

Account information including your username and password, purchases or orders made by you, your interests, preferences, feedback and survey responses;

Biographical information including your date of birth, job title and employer details;

Business information including, for trade account holders we will also keep a record of your business name, business email address, telephone numbers, business or elected postal address, website address, focus of work, nature of business, logo, skills and training, and VAT Registration number, business type, industry sector, number of employees and credit limit;

Communication information including service messages, enquiry details, your opinion of our products and services and your comments on them and any personal information you include in any correspondence with us, including any complaints or legal claims;

Contact information including your name, title and contact details (email address, telephone number, postal address, delivery address, change of address information, social media handle);

Credit information including credit scores and reports and supporting information;

Financial information including your payment and gift card information and amount spent in-store or on line and, in relation to certain refunds, your bank account details;

Identity information including information in any passport, driving licence or other formal identity documents;

Monitoring information including any CCTV footage or telephone recordings containing your voice or visual image; and

Preferences information including details regarding your marketing preferences, when and how you consented to receive marketing communications from us (including the time and date you provided your consent).

If you do not provide this information to us we may not be able to fulfil your orders for our products and services, contact or communicate with you or resolve your queries or requests effectively.

Personal information that we collect about you

When you visit our Sites we automatically collect:

Device information including the internet protocol (IP) address of your device and details regarding the type of device and browser software you use to access our Sites, time zone setting and location, browser plug-in types and versions, page information, operating system and platform and other technology on the devices you use to access our Sites and information we collect or use from cookies used on our Sites, (for more information please see our Cookie Policy).

Usage information including details of your use of our Sites, namely traffic data, weblogs and statistical data, including where and when you clicked on certain parts of our Sites and details of the webpage from which you visited it;

If you do not provide this information, you may be unable to access some or all of the Site or its features.

Personal information we may receive from other sources

We obtain certain personal information about you from other sources (including those outside of our business) which may include other Topps Companies, our suppliers and our customers. The sources that may send to us personal information about you are as follows and each company name listed includes a link to their privacy policy:

Source of personal information	The categories of personal information (defined above) that we obtain about you from this source
Other Topps Companies	All categories
Data providers (including Glenigan Limited)	Contact
Events companies (including Media 10 Limited and NTWK Media Ltd)	Contact
Credit referencing agencies and credit assessment providers as well as providers of scoring and reporting services (including Creditsafe, Experian, Klarna and Two)	Business, Credit, Contact and Financial
Our customers	All categories
Social media platforms and business directories (see Our use of social media below)	All categories
Police and other law enforcement bodies, courts and legal and professional service providers	All categories
Your employer or the company that has engaged you to provide services	All categories

Aggregated data

We also collect or create and then use and share aggregated data such as statistical or demographic data for a variety of purposes. Aggregated data may be derived from your personal information but is not considered personal information in law as it does not reveal your identity and cannot readily be linked to you. For example, we may aggregate your usage data relating to our Sites to calculate the percentage of users accessing a specific online feature.

3. HOW WE USE YOUR PERSONAL DATA

We use your personal information for a variety of reasons. We rely on different legal grounds (known as ‘lawful bases’) to process your personal information, depending on the purposes of our use and the risks to your privacy.

3.1. PURPOSES FOR WHICH WE WILL USE YOUR PERSONAL DATA

We have set out below, in a table format, a description of all the ways we plan to use your personal information, and which of the lawful bases we rely on to do so. Where we rely on the existence of a legitimate interests to process your personal information, we have also identified the specific legitimate interests on which we rely.

We may reply on more than one lawful basis depending on the specific purpose for which we are using your personal information. Please Contact us if you need further details about the specific lawful basis we are relying on to process your personal information.

3.2. MARKETING

We strive to provide you with choices regarding certain personal information uses, particularly around marketing and advertising.

If we specifically request your permission to send (or you specifically ask us to send) you newsletters, marketing material or to notify you of special events, offers, promotions, competitions or new products and services by email, SMS, post or phone (as you indicate), we rely on your consent to do so. Our requests for your marketing permissions may cover one or more Topps Companies. Otherwise we process your personal information for direct marketing purposes on the basis that it is necessary for us to pursue our legitimate interests as a business (see the section at the end of this policy for further details).

If you do not wish to receive communications from us, please inform us by using the unsubscribe link at the foot of the email by using the STOP code within the SMS, by using any preference portal features (where available on a particular Site) or by contacting us in store.

We try to tailor and personalise any marketing communications that we send to you, for example, by notifying you of products, services, offers or promotions that apply to your interests, purchases, location and previous engagement with us.

Existing or prospective customers may receive marketing via phone call; in this case the processing is on the basis of our legitimate interests to promote our business. Customers may however, update their phone marketing preference in store or using the relevant online preference portal (if available for a particular Site).

If you opt-out of receiving marketing communications from us, we keep your contact details on our suppression list for a defined period to ensure that we comply with your wishes.

After opting out of marketing communications, please note that you may still receive communications for up to 28 days due to marketing campaigns which are already in progress (e.g. being printed).

Where you opt out of receiving these marketing messages, this will not apply to email receipts or account communications (such as important information about your trade account or loyalty scheme account including points statements and updates to terms and conditions).

3.3 COOKIES

Our Sites uses cookies to distinguish you from other users of our Sites. This helps us to provide you with a good experience when you browse our Sites and also allows us to improve them.

You can set your browser to refuse all or some browser cookies, or to alert you when websites set or access cookies. If you disable or refuse cookies, please note that parts of our Sites may become inaccessible or not function properly. For more information about the cookies we use, please see our Cookie Policy.

4. DISCLOSURES OF YOUR PERSONAL INFORMATION BY US

We only disclose your personal information outside our business in limited circumstances and we do not sell your information to third parties. We work with other Topps Companies, services providers and certain other parties who may receive your personal information from us, as follows:

Other Topps Companies

There are also circumstances where we share your information with Topps Companies or companies in our corporate group in order to understand you as a customer, fulfil orders, transactions, handle complaints or provide you with a service or information that you have requested or for audit or business administration purposes. Any Topps Companies that receive your personal information from us will handle it in the ways described in this policy.

Our Suppliers

We may disclose your information to our trusted third party service providers, agents and subcontractors (Suppliers) for the purposes of providing services to us or directly to you on our behalf, including the operation and maintenance of our Sites, and social media pages. All Suppliers are subject to thorough security checks, and will only hold the minimum amount of personal information needed in order to fulfil the orders you place or provide a service on our behalf. We will put in place a contract with each of our Suppliers that requires them to protect your personal information, unless we are legally required to share that information. Any Suppliers that work for us will be obliged to follow our instructions.

Our Suppliers can be categorised as follows:

Recipient / relationship to us	Industry sector (& sub-sector)	Location
Advertising, PR, digital and creative agencies	Media (Advertising & PR)	UK & EEA
Banks, payment processors and financial services providers (e.g. Stripe)	Finance (Banking & Payment Processing)	UK & EEA
CCTV administration and monitoring service providers	Surveillance (CCTV)	UK & EEA
Cloud software system providers, including database, email and document management providers	IT (Cloud Services)	UK & EEA & USA
Customer care/services providers	Customer Services (Support)	UK & EEA
Delivery and mailing services providers	Logistics (Delivery Service)	UK & EEA
Events services and venues	Leisure (Events)	UK
Facilities and technology service providers including scanning and data destruction providers	IT (Data Management)	UK & EEA
Gift card service providers	Customer Services (Support)	UK & EEA
Health and safety claims administrators and consultants	Health & Safety (Claims)	UK & EEA
Insurers and insurance brokers	Insurance (Underwriting & Broking)	UK & EEA
Legal, security and other professional advisers and consultants	Professional Services (Legal & Accounting)	UK & EEA
Market and customer research providers	Media (Market Research)	UK & EEA
Social media platforms	Media (Social Media)	UK, EEA & USA
Website and data analytics platform providers	IT (Data Analytics)	UK, EEA & USA
Website and App developers	IT (Software Development)	UK & EEA
Website hosting services providers Website hosting services providers	IT (Hosting)	UK & EEA
Wifi and other communication service providers	IT (Telecommunications)	UK & EEA

Other third parties

We may disclose the personal information to other third parties as follows:

social media platforms (see further the section below);

any third party who is restructuring, selling or acquiring some or all of our business or assets or otherwise in the event of a merger, re-organisation or similar event;

if we are under a duty to disclose or share your information in order to comply with any legal or regulatory obligation or where we receive a valid request, including by the police, courts, tribunals or regulators.

5. OUR USE OF SOCIAL MEDIA

We use a number of different social media platforms to communicate with you and to promote products and services. We process your personal information using these platforms in a variety of ways, as follows:

Pages/accounts. We use your personal information when you post content or otherwise interact with us on our official pages and accounts on Facebook, Instagram, Pinterest, LinkedIn, YouTube, TikTok and other social media platforms. We also use the Page Insights service for Facebook, Instagram and LinkedIn to view statistical information and reports regarding your interactions with the pages and accounts we administer on those platforms and their content. Where those interactions are recorded and form part of the information we access through these Page Insights services, we and the relevant platform are joint data controllers of the processing necessary to provide that service to us. Please see the beginning of this privacy policy for more information about our joint data controller arrangements.

Cookies. We use cookies and similar technologies in our Sites to collect and send information to Meta, LinkedIn and Pinterest about actions you take on our Sites. In particular:

Meta (who operates the Facebook and Instagram platforms) and Pinterest use this information to provide services to us and also for further processing for their own business purposes. We and each of these platforms are joint data controllers of the processing involved in collecting and sending your personal information to these platforms using cookies and similar technologies as each of us has a business interest in the platforms receiving this information. You can find out more about these technologies by visiting our Cookie Policy.
The services we receive from Meta that use the information above are delivered to us through Meta Business Tools, which include Meta Pixel, Social Plugins, Website Custom Audiences and Conversions API (CAPI). The services we receive from Pinterest that use the information above are delivered to us through Pinterest’s Ad Services including Pinterest Tag and Pinterest API. These tools allow us to target advertising to you within Meta’s and Pinterest’s respective social media platforms by creating audiences based on your actions on our Sites and allow these platforms to improve and optimise the targeting and delivery of our advertising campaigns for us.
We use LinkedIn Insight Tag, a small piece of code that we embed in our Sites that allows us to perform in-depth campaign reporting and unlock insights about users that may visit our Sites via our LinkedIn campaigns (e.g. by allowing us to discover business demographics by layering LinkedIn data on data about our Sites’ visitors). LinkedIn Insight Tag enables the collection of metadata such as IP addresses, timestamps, and events such as page views. You can find out more about these technologies by visiting our Cookie Policy.
You can opt-out of online behavioural advertising by using the AdChoices tool at optout.aboutads.info or by adjusting your mobile ad identifier settings, or your personalisation settings within your account on the relevant social media platform.

Our relationship with Meta, LinkedIn and Pinterest. As we are joint controllers with these platforms for certain processing, we and each platform have:

entered into agreements in which we have agreed each of our data protection responsibilities for the processing of your personal information described above;
agreed that we are responsible for providing to you the information in this policy about our relationship with each platform; and
agreed that each platform is responsible for responding to you when you exercise your rights under data protection law in relation to that platform’s processing of your personal information as a joint controller.

Meta and LinkedIn also process, as our processor, contact information that we submit for the purposes of matching, online targeting, measurement, reporting and analytics purposes. These services include the processing those platforms carry out when they display our advertisements to you in your news feed at our request after matching contact details for you that we have uploaded to a platform operated by those platforms. These advertisements may include forms through which we collect contact information you give to us.

Further information. The Meta company that is a joint controller of your personal information is Meta Platforms, Inc., 1601 Willow Road, Menlo Park, CA 94025, USA. The LinkedIn company that is a joint controller of your personal information is LinkedIn Ireland Unlimited Company, Wilton Place, Dublin 2, Ireland. The Pinterest company that is a joint controller of your information is Pinterest Europe Ltd., Palmerston House, 2nd Floor, Fenian Street, Dublin 2, Ireland. For further information regarding Meta and its use of your personal information, please see:

Meta’s Controller Addendum for Page Insights and UK Controller Addendum for Business Tools,LinkedIn’s Page Insights Joint Controller Addendum and Pinterest’s Advertising Services Agreement, including Data Sharing Addendum and Joint Controller Addendum which include information regarding how our and those platforms’ responsibilities to you are allocated as controllers of your personal information;
Meta’s Privacy Center including its Privacy Policy, LinkedIn’s Privacy Policy and Pinterest’s Privacy Policy which include details of the legal grounds (known as ‘lawful bases’) on which each platform relies to process your personal information, together with details regarding your data protection rights; and
Meta’s help pages regarding its Page Insights and Business Tools and its terms and conditions relating to those tools.
LinkedIn’s help pages regarding its Page Insights and its terms and conditions relating to its advertising services, including LinkedIn Insight Tag.

Our relationship with Tiktok. To find out more about our relationship with TikTok, please see the terms of the data sharing arrangement we have with TikTok and the TikTok Privacy Policy.

6. INTERNATIONAL TRANSFERS

Except in a limited number of cases, we do not transfer your personal information outside of Europe. Where we do, we take measures to protect your personal information.

Some of the information you provide to us may be transferred to countries outside the UK and European Economic Area (EEA), usually because some of our Suppliers are based outside of these areas. These countries may not have similar data protection laws to the UK these countries are listed in the table under Disclosure of your personal information by us. For example, we transfer your personal information to the USA when using our email marketing services provider, certain data analytics providers and some social media platforms.

Where we transfer your information outside of Europe in this way, we take steps to ensure that appropriate security measures are taken with the aim of ensuring that your privacy rights continue to be protected in the ways required by data protection law as outlined in this policy. These steps include imposing contractual obligations on the recipient of your personal information using standard clauses issued by the UK Information Commissioner’s Office (or other relevant body) and relying on decisions issued by the relevant UK Secretary of State (or other relevant person) declaring that a recipient or country is adequately protective of personal information to a degree that allows us to safely transfer your personal information to that recipient or country. This includes any international frameworks that allow recipients to certify that they can receive your personal information safely and process it in a manner that is protected to an equivalent standard as that under UK laws. Please contact us using the details at the end of this policy for more information about the protections that we put in place and to obtain a copy or access to the relevant documents.

If you use our services whilst you are outside the UK, your information may be transferred outside the UK in order to receive those services.

7. DATA SECURITY AND LINKS TO OTHER WEBSITES

We take the security of your personal information seriously and use a variety of measures based on good industry practice to keep it secure. Nonetheless, transmissions over the internet and to our Sites may not be completely secure, so please exercise caution. When accessing links to other websites, their privacy policies, not ours, will apply to your personal information.

We employ security measures to protect the personal information you provide to us, to prevent access by unauthorised persons and unlawful processing, accidental loss, destruction and damage. When we have provided (or you have chosen) a password or pin allowing you access to certain parts of our Sites, you are responsible for safeguarding it and keeping it confidential and must not allow it to be used by third parties.

Our Sites and social media pages may contain links to other websites run by other organisations which we do not control. This policy does not apply to those other websites‚ so we encourage you to read their privacy policies. We are not responsible for the privacy policies and practices of other websites (even if you access them using links that we provide) and we provide links to those websites solely for your information and convenience. We specifically disclaim responsibility for their content, privacy practices and terms of use, and we make no endorsements, representations or promises about their accuracy, content or thoroughness. Your disclosure of personal information to third party websites is at your own risk.

In addition, if you linked to our Sites from a third party website, we cannot be responsible for the privacy policies and practices of the owners and operators of that third party website and recommend that you check the policy of that third party website.

8. THE PERIODS FOR WHICH WE RETAIN YOUR PERSONAL INFORMATION

We will not hold your personal information in an identifiable format for any longer than is necessary for the purposes for which we collected it.

Except where the circumstances below apply, we retain your personal information for 6 years from the end of the year in which your account closes. This is so we can comply with our legal and contractual obligations, establish, bring and defend legal claims and use your information for analytics and business planning purposes.

The only exceptions to the period mentioned above are where:

we collect CCTV footage (which we retain for 30 days), device and usage information (which we retain for 2 years) or user information on our social media pages (which we retain indefinitely);

you exercise your right to have the information erased (where it applies) and we do not need to hold it in connection with any of the reasons permitted or required under the law;

you exercise your right to require us to retain your personal information for a period longer than our stated retention period;

we bring or defend a legal claim or other proceedings during the period we retain your personal information, in which case we will retain your personal information until those proceedings have concluded and no further appeals are possible;

we archive your personal information, in which case we will delete it in accordance with our routine deletion cycle based on good industry practice; or

in limited cases, existing or future law or a court or regulator requires us to keep your personal information for a longer or shorter period, or we are reasonably requested to do so by law enforcement authorities.

9. YOUR RIGHTS IN RELATION TO YOUR PERSONAL INFORMATION

You have a number of rights in relation to your personal information under data protection law. In relation to certain rights, we may ask you for information to verify your identity and, where applicable, to help us to search for your personal information. Except in rare cases, we will respond to you within 1 month after we have received this information or, where no such information is required, after we have received full details of your request. Please see the sections below to find out more about these rights

to be informed about the processing of your personal information (this is what this policy aims to do)

to have your personal information corrected if it is inaccurate and to have incomplete personal information completed

to object to processing of your personal information

to withdraw your consent to processing your personal information

to restrict processing of your personal information

to have your personal information erased

to request access to your personal information and information about how we process it

to electronically move, copy or transfer your personal information in a standard, machine-readable form (known as portability)

rights relating to automated decision making, including profiling (see below)

If you wish to exercise any of the rights set out above, please contact us atgdpr@ToppsTiles.co.uk.

You have the right not to be subject to purely automated decisions (including profiling) where this has a significant effect on you. We do not envisage that any decisions will be taken about you in this way, however we will update this statement if this changes.

You also have the right to complaint to the UK data protection regulator (see section 1.2 above for further information).

LAWFUL BASES AND PROCESSING PURPOSES

The purposes for which we use your personal information and the lawful basis under data protection laws on which we rely to do this are explained below.

Where you have provided CONSENT

We may use and process your personal information for the following purposes where you have consented for us to do so:

• to contact you via email SMS, post and phone (as you have indicated) with marketing information about our products and services (see Marketing for further details); and

• to supply brochures, marketing or other material you have specifically requested from us.

We also process personal information we obtain from optional cookies that we set on our Sites based on your consent. For more information, please review our Cookie Policy.

You may withdraw your consent for us to use your information in any of these ways at any time. Please see Your rights in relation to your personal information for further details.

Where it is necessary for us or a third party to pursue a LEGITIMATE INTEREST

We may use and process your personal information where it is necessary for us or a third party to pursue our legitimate interests as a business for the following purposes:

Processing necessary for us to promote our business and products and services and measure the reach and effectiveness of our campaigns

• for analysis and insight conducted to inform our marketing strategies, and to enhance and your visitor experience;

• to tailor and personalise our marketing communications based on your attributes;

• to contact you with targeted advertising delivered online through social media, search engines, third party websites and applications and other platforms operated by other companies, such as Google (see business.safety.google/privacy), unless you object. You may receive advertising based on information about you that we have provided to the platform, matched with information it already holds about you or allowed it to collect using cookies on our Sites (or a combination of the two). You may also receive advertising because, at our request, the platform has identified you as falling within a group whose attributes we have selected or a group that has similar attributes to the individuals whose details it has received from us (or a combination of the two). We, or an agency acting on our behalf, may also ask platforms to display our advertisements to groups of people with certain interests or attributes and those platforms may use information that they have collected from you directly, independently of any request from us. In these cases, we may never receive that information or know that our advertisement has been seen by you specifically. The information used to display an advertisement to you online may also be used to avoid displaying an advertisement (for example, to avoid showing you an advert for a product you have already purchased). You may see our advertisements in your social media feed or when you use search engines, view videos or visit other websites. To find out more, please refer to the information provided in the help pages of the platforms on which you receive advertising from us. Please also see Our use of social media above for further information regarding our use of social media platforms specifically;

• to identify and record when you have received, opened or engaged with our Sites or electronic communications (please see our Cookie Policy for more information);

• to contact you by email SMS post or phone with marketing information about our products and services. We will use your personal information to tailor or personalise the marketing communications you receive to make them relevant to you. Please see further the Marketing section below;

• to conduct credit checks using credit agencies and service providers to ensure the affordability of credit we offer to you/your business where you have requested a credit account. Where you have an existing credit account we may use your personal information to periodically review the credit amount we extend to you;

• in some cases we may use automated methods to analyse, combine and evaluate information that you have provided to us. We collect and analyse this information in this way so that we can deliver the most appropriate customer experience to you by tailoring and making relevant all our service and communications; and

• for trade account holders, in order to create a web login to our Sites for the purpose of you accessing trade discount.

Processing necessary for us to support our users with any enquiries

• to respond to correspondence you send to us.

Processing necessary for us to respond to changing market conditions and the needs of our customers and users

• to analyse, evaluate and improve our products and services so that your visit and use of our Sites, social media pages, in store services (we will generally use data amalgamated from many people so that it does not identify you personally); and

• to undertake market analysis and research (including contacting you with customer surveys) so that we can better understand you as a Customer.

Processing necessary for us to operate the administrative and technical aspects of our business efficiently and effectively

• to administer our Sites and our social media pages and for internal operations, including troubleshooting, training, testing, statistical purposes;

• for the prevention of fraud and other criminal activities;

• to maintain the security of our staff, customers, venues, systems, premises or property and to investigate any actual, suspected or threatened breach of that security;

• to contact you with service and other important messages, including product recall information which does not affect your vital interests;

• to verify the accuracy of data that we hold about you and create a better understanding of you as an account holder or customer;

• for network and information security in order for us to take steps to protect your information against loss or damage, theft or unauthorised access;

• to comply or support a third party’s compliance with a request from you in connection with the exercise of your rights (for example where you have asked us not to contact you for marketing purposes, we will keep a record of this on our suppression lists in order to be able to comply with your request);

• for the purposes of corporate restructure or reorganisation or sale or purchase of businesses or assets;

• to facilitate the processing of payments made by you to us. When you make a credit or debit card purchase with us we will process your payment card information. We do not hold your long card number. It is used by our payment processing provider to process your payment. We retain for our records your payment method, card type and the last 4 digits of your payment card;

• for efficiency, accuracy or other improvements of our products, services, business processes, databases and systems, for example, by combining systems or consolidating records we hold about you;

• to enforce or protect our contractual or other legal rights or to bring or defend legal proceedings;

• for cookies that are essential for our Sites to function properly (please see our Cookie Policy for more information);

• to inform you of updates to our terms and conditions and policies including trade loyalty scheme related communication;

• to aggregate or otherwise anonymise your information, and to permit our suppliers to do the same, for our or those suppliers’ use of the anonymised information for operational, administrative or business improvement purposes; and
• for other general administration including managing your queries, complaints, or claims, and to send service messages to you.

Where necessary for us to carry out PRE-CONTRACTUAL STEPS you have requested or for the performance of your CONTRACT

We will use your personal information where this is necessary for your contract to be performed or to carry out any pre-contract steps you’ve asked us to so that you can enter into that contract, for the following purposes:

• to register you as a new customer or supplier;

• to process, fulfil and complete your orders, purchases and other transactions entered into with us and deliver your order including issuing e-receipts;

• to order goods and services from you and to process payments to you or your third party at your request

• to process your payment card or bank details when taking payment for your orders or when providing a refund; and

• to arrange third party delivery

• to run our competitions and promotions that you enter from time to time and to distribute prizes.

In relation to our corporate customers, the processing activities described above in this section are processed by us in reliance of our legitimate interests to the extent they involve your personal information.

Where processing is in your VITAL INTERESTS

We use your personal information where this is in your vital interest for the following purposes:

• to notify you of any serious product safety or product recall issues; and

• to provide you with critical assistance if you suffer a physical incident in or near our stores.

Where necessary to comply with our LEGAL OBLIGATIONS

We will use your personal information to comply with our legal obligations:

• to keep a record relating the exercise of any of your rights relating to our processing of your personal information;

• to take any actions in relation to health and safety incidents required by law; and

• to handle and resolve any complaints we receive relating to the services we provide.