Devenish Privacy Notice

Overview

At Devenish, we want you to know that when you use our organisation you can trust us with your information. We are determined not to do anything that would infringe your rights or undermine your trust

This Privacy Notice describes the information we collect about you, how it is used and shared, and your rights regarding it.

Data Controller

We are registered with the Information Commissioners Office (ICO) as a Data Controller for the personal data that we hold and process. Our registered address is Devenish, 96 Duncrue Street, Belfast, BT3 9AR. Our registration number is ZA464006. Our Data Protection Lead can be contacted at privacy@devenish.com

Data Collection

The vast majority of the information that we hold about you is provided to us by yourself when you seek to use our services. We will tell you why we need the information and how we will use it.

We only ask you to provide personal data when we have a good reason.

Our Lawful basis for processing your information

The General Data Protection Regulation (GDPR (EU) 2016/679) requires all organisations that process personal data to have a Lawful Basis for doing so. The Lawful Bases identified in the GDPR are:

• Consent of the data subject
• Performance of a contract with the data subject or to take steps to enter into a contract
• Compliance with a legal obligation
• Compliance with a legal obligation
• To protect the vital interests of a data subject or another person
• Performance of a task carried out in the public interest or in the exercise of official authority vested in the controller
• The legitimate interests of ourselves, or a third party, except where such interests are overridden by the interests, rights or freedoms of the data subject

Examples of legitimate interests include:

• Where the data subject is a client or in the service of the controller;
• Transmission within a group of undertakings for internal administrative purposes;
• Processing necessary to ensure network and information security, including preventing unauthorised access;
• Processing for direct marketing purposes, or to prevent fraud; and
• Reporting possible criminal acts or threats to public security

Our lawful Basis, Legitimate interests and Purpose / Activity of what we use your information for are detailed at Appendix A

We do not use automated decision-making in the processing of your personal data.

We collect and process both personal data and special categories of data as defined in the GDPR (EU) 2016/679.

Details of the types of data we process are detailed in Appendix A

We may share your personal data with:

• Delivery Partners
• Our Business Partners
• Our Subsidiaries
• Our legal advisors in the event of a dispute or other legal matter
• Law enforcement officials, government authorities or other third parties to meet our legal obligations
• In connection with, or during negotiation of, any merger, sale, consolidation or restructuring, refinancing or acquisition of some or all of our business
• Any other party where we ask you and you consent to the sharing

Transfers to third countries and international organisations

We may transfer personal data to third countries or international organisation using identified safeguards to enable processing and delivery of your order requirements. Safeguards will include data processing agreements or other contractual stipulations as required by the GDPR (EU) 2016/679.

Data Retention

We retain your personal data whilst you remain a customer/client unless you ask us to delete it. Our retention and disposal policy (available on request) details how long we hold data for and how we dispose of it when it no longer needs to be held. We will delete or anonymise your information at your request unless:

• There is an unresolved issue, such as a claim or dispute
• We are legally required to; or
• There are overriding legitimate business interests, including but not limited to fraud prevention and protecting customers’ safety and security

Your Rights

The General Data Protection Regulation gives you specific rights around your personal data. For example, you have to be informed about the information we hold and what we use it for, you can ask for a copy of the personal information we hold about you, you can ask us to correct any inaccuracies with the personal data we hold, you can ask us to stop sending you direct mail, or emails, or in some circumstances ask us to stop processing your details. You can find out more information from the ICO’s website https://ico.org.uk/your-data-matters/ and this is the organisation that you can complain to if you are unhappy with how we deal with you.

Accessing and Correcting Your Information

You may request access to, correction of, or a copy of your information by contacting us at privacy@devenish.com

Marketing Opt-Outs

You may opt out of receiving emails and other messages from our organisation by following the instructions in those messages.

Cookies

Cookies are small text files that are stored on your browser or device by websites, apps, online media, and advertisements.We use cookies to:

• Validate users
• Remember user preferences and settings
• Determine frequency of accessing our content
• Measure the effectiveness of advertising campaigns
• Analyse site visits and trends

We will occasionally update our Privacy Notice. When we make changes, the latest version will be published on this page.

Appendix A

Purposes for which we will use your personal data

We have set out below, in a table format, a description of all the ways we may use your personal data, and which of the legal bases we rely on to do so. We have also identified what our legitimate interests are where appropriate.

Note that we may process your personal data for more than one lawful ground depending on the specific purpose for which we are using your data.

Purpose/Activity	Type of data	Lawful basis for processing, including basis of legitimate interest
To register you as a new customer	a) Identity b) Contact c) Address d) Financial	Performance of a contract with you
To process and deliver your request including: · Provide goods, services, deliveries, quotations, information, eg catalogues and newsletters · Direct your enquiries to the appropriate support staff · Manage payments, fees and charges · Collect and recover money owed to us	a) Identity b) Contact c) Financial d) Transaction e) Marketing and Communications f) Performance	Performance of a contract with you Necessary for our legitimate interests

To manage our relationship with you which will include: · Notifying you about changes to our terms or privacy policy · Contacting you with regard to a contract between you (or your organisation) and us	a) Identity b) Contact c) Profile d) Marketing and e) Communications	Performance of a contract with you Necessary to comply with a legal obligation Necessary for our legitimate interests (to keep our records updated and to study how customers use our services)
To administer and protect our business and this website (including troubleshooting, data analysis, testing, system maintenance, support, reporting and hosting of data)	a) Identity b) Contact c) Technical	Necessary for our legitimate interests (for running our business, provision of administration and IT services, network security, to prevent fraud and in the context of a business reorganisation or group restructuring exercise) Necessary to comply with a legal obligation
To deliver relevant website content and advertisements to you and measure or understand the effectiveness of the advertising we serve to you	a) Identity b) Contact c) Profile d) Usage e) Marketing and Communications f) Technical	Necessary for our legitimate interests (to study how customers use our products/services, to develop them, to grow our business and to inform our marketing strategy)
To use data analytics to improve our website, products/services, marketing, customer relationships and experiences	Technical Usage	Necessary for our legitimate interests (to define types of customers for our products and services, to keep our website updated and relevant, to develop our business and to inform our marketing strategy)

Board Authorised: 19.03.19 Ver 1.0