Your Privacy
This Privacy Policy sets out how we, SOURCE-RE LIMITED, collect, store and use information about you when you use or interact with our websites, www.source-re.uk (our website) and where we otherwise obtain or collect information about you. This Privacy Policy is effective from 26th February 2021 and last updated 26th February 2021
Definitions
You will see terms in our Privacy Policy that are capitalized. These terms have meanings as described in the definitions section below.
Personal Data: Any information regarding a natural person, a legal person, an institution or an association, which is, or can be, identified, even indirectly, by reference to any other information, including a personal identification number.
Usage Data: Information collected automatically from this website (or third-party services employed in this website), which can include: the IP addresses or domain names of the computers utilised by the Users who use this website, the URI addresses (Uniform Resource Identifier), the time of the request, the method utilised to submit the request to the server, the size of the file received in response, the numerical code indicating the status of the server’s answer (successful outcome, error, etc.), the country of origin, the features of the browser and the operating system utilised by the User, the various time details per visit (e.g. the time spent on each page within the website) and the details about the path followed within the website with special reference to the sequence of pages visited, and other parameters about the device operating system and/or the User’s IT environment.
User: The User is the individual using our Service. The User corresponds to the Data Subject, who is the subject of Personal Data.
Data Controller: Data Controller means a natural or legal person who (either alone or jointly or in common with other persons) determines the purposes for which and the manner in which any personal data are, or are to be, processed. For the purpose of this Privacy Policy, we are a Data Controller of your data.
Data Processors (or Service Providers):
Data Processor (or Service Provider) means any natural or legal person who processes the data on behalf of the Data Controller. We may use the services of various Service Providers in order to process your data more effectively.
Data Subject: Data Subject is any living individual who is the subject of Personal Data.
GDPR: General Data Protection Regulation Data Protection Directive. The current legislation – (EU) 2016/679 is a regulation in EU law on data protection and privacy for all individuals within the European Union. It addresses the export of personal data outside the EU.
Website: The hardware or software tool by which the Personal Data of the User is collected.
Cookies: Cookies are small pieces of data stored on a User’s device.
Table of Contents
- Summary
- Our company details
- Information collected: Website visit
- Information collected: Contact us
- Information collected: Website interaction
- Information collected: Place order
- Information collected: Third parties
- Profiling
- Interaction with external social networks and platforms:
- Platform services
- Disclosure and additional uses of your information
- Data retention: Personal data
- Data security: Personal data
- Data Transfers outside the European Economic Area
- GDPR Individual rights
- The right to restrict processing
- Sensitive Personal Information
- Privacy Policy Updates
- External Links
- Children’s Data Privacy Compliance
- DNT (Do Not Track) Disclosure: The California Online Privacy Protection Act
- How to contact us
- Your right to complain
1. Summary
This section summarises as a general overview how we obtain, store and use information about you.
Data Controller:
Eleanor Matthews, Director, Registered Address: 32 High Street, Woodstock, Oxfordshire, OX20 1TG, Mailing Address: 32 High Street, Woodstock, Oxfordshire, OX20 1TG
How we collect or obtain information about you:
- when you provide it to us (e.g. by contacting us, placing an order on our website, booking an appointment, using our chat system, browsing our products or by signing up to your e-newsletter).
- from your use of our website, using cookies and occasionally from third parties.
Information we collect:
Name, contact details, payment information e.g. your credit or debit card details, usage data including IP address, information from cookies, information about your computer or device (e.g. device and browser type), information about how you use our website (e.g. which pages you have viewed, the time when you view them and what you clicked on, the geographical location from which you accessed our website (based on your IP address), company name or business name (if applicable), VAT number (if applicable).
How we use your information:
- For administrative and business purposes (particularly to contact you and process orders you place on our website), to improve our business and website, to fulfil our contractual obligations, to advertise our goods and services, to analyse your use of our website, and in connection with our legal rights and obligations;
- To notify you about changes to our business, products and services;
- To provide customer support;
- To gather analysis or valuable information so that we can improve our Web Service and products;
- To monitor the usage of our website;
- To detect, prevent and address technical issues;
- To provide you with news, offers and general information about other goods, services and events which we offer that are similar to those that you have already purchased or enquired about unless you have opted not to receive such information. You have the legal right to opt-in and opt-out. Opt-out is the default value in accordance to the GDPR.
Disclosure of your information to third parties:
Only to the extent necessary to run our business, to our service providers, to fulfil any contracts we enter into with you, where required by law or to enforce our legal rights:
- Business Transaction. If we are involved in a merger, acquisition or asset sale, your Personal Data may be transferred. We will provide notice before your Personal Data is transferred and becomes subject to a different Privacy Policy.
- Disclosure for Law Enforcement. Under certain circumstances, we may be required to disclose your Personal Data if required to do so by law or in response to valid requests by public authorities (e.g. a court or a government agency).
Do we sell your information to third parties (other than in the course of a business sale or purchase or similar event):
No
Are there consequences in not supplying your personal data:
To place an order with us we will require email address, billing address, shipping address, company name (if applicable), & VAT number (if applicable). Usage data to place an order is not mandatory.
You can instruct your browser to refuse all cookies or to indicate when a cookie is being sent.
How long we retain your information:
For no longer than necessary, taking into account any legal obligations we have (e.g. to maintain records for tax purposes), any other legal basis we have for using your information (e.g. your consent, performance of a contract with you or our legitimate interests as a business) and certain additional factors described in the main section below entitled How long we retain your information. For specific retention periods in relation to certain information which we collect from you, please see the main section below entitled How long we retain your information.
How we secure your information:
Using appropriate technical and organisational measures such as storing your information on secure servers, encrypting transfers of data to or from our servers using Secure Sockets Layer (SSL) technology, encrypting payments you make on or via our website using Secure Sockets Layer (SSL) technology, only granting access to your information where necessary. This site uses a Starfield Secure Certificate to offer secure communications by encrypting all data to and from the site.
Use of cookies:
We use cookies on our website including essential, functional, analytical and targeting cookies. You can instruct your browser to refuse all cookies or to indicate when a cookie is being sent.
Like most sites, we use cookies for several reasons, the main reasons being:
- Analytics & Tracking – we use cookies to understand how the site is being used in order to improve the user experience. User data is anonymous.
For more information, please visit our cookies policy.
Data Transfers outside the European Economic Area:
We will only transfer your information outside the European Economic Area if we are required to do so by law.
Profiling and automated decision-making:
Profiling is used to help promote our blog posts or products through social media paid adverts, web analytics and cookies. We do not make decisions by automated means.
GDPR Individual rights:
- to access your information and to receive information about its use;
- to have your information corrected and/or completed;
- to have your information deleted;
- to restrict the use of your information;
- to receive your information in a portable format;
- to object to the use of your information;
- to withdraw your consent to the use of your information;
- not to have significant decisions made about you based solely on automated processing of your information, including profiling;
- to complain to a supervisory authority.
Sensitive personal information:
We do not knowingly or intentionally collect what is commonly referred to as ‘sensitive personal information’. Please do not submit sensitive personal information about you to us. For more information, please see the main section below entitled Sensitive Personal Information.
Legal Basis for Processing Personal Data Under General Data Protection Regulation (GDPR):
If you are from the European Economic Area (EEA), our legal basis for collecting and using the personal information described in this Privacy Policy depends on the Personal Data we collect and the specific context in which we collect it.
We may process your Personal Data because:
- We need to perform a contract with you;
- You have given us permission to do so;
- The processing is in our legitimate interests and it’s not overridden by your rights;
- For payment processing purposes;
- To comply with the law.
2. Our company details
The data controller in respect of our website is Eleanor Matthews, Director of SOURCE-RE LIMITED, Our VAT registration number is 391 8072 78. You can contact the data controller by writing to the business address above or sending an email to Eleanor@source-re.uk
If you have any questions about this Privacy Policy, please contact the data controller.
3. Information collected: Website visit
Web server log information:
We use a third party server to host our website called 20i Ltd the privacy policy of which is available here. https://www.20i.com/legal/20i-ltd-privacy-policy
Our website server automatically logs the IP address you use to access our website as well as other information about your visit such as the pages accessed, information requested, the date and time of the request, the source of your access to our website (e.g. the website or URL (link) which referred you to our website), and your browser version and operating system.
Our server is located in the UK
Use of website server log information for IT security purposes:
20i Ltd collect and store server logs to ensure network and IT security and so that the server and website remain uncompromised. This includes analysing log files to help identify and prevent unauthorised access to our network, the distribution of malicious code, denial of services attacks and other cyber-attacks, by detecting unusual or suspicious activity.
Unless we are investigating suspicious or potential criminal activity, we do not make, nor do we allow our hosting provider to make, any attempt to identify you from the information collected via server logs.
Legal basis for processing:
Compliance with a legal obligation to which we are subject (Article 6(1)(c) of the General Data Protection Regulation).
Legal obligation:
We have a legal obligation to implement appropriate technical and organisational measures to ensure a level of security appropriate to the risk of our processing of information about individuals. Recording access to our website using server log files is such a measure.
Legal basis for processing:
Our and 20i Ltd legitimate interests (Article 6(1)(f) of the General Data Protection Regulation).
Legitimate interests:
We and our third-party hosting provider 20i Ltd have a legitimate interest in using your information for the purposes of ensuring network and information security.
Use of website server log information to analyse website use and improve our website:
We use the information collected by our website server logs to analyse how our website users interact with our website and its features for website performance reasons.
Legal basis for processing:
Our legitimate interests (Article 6(1)(f) of the General Data Protection Regulation).
Legitimate interest: Improving our website for our website users and getting to know our website users’ preferences so our website can better meet their needs and desires.
Cookies:
Cookies are data files which are sent from a website to a browser to record information about users for various purposes.
We use cookies on our website, including essential, functional, analytical and targeting cookies. For further information on how we use cookies, please see our cookies policy.
You can reject some or all of the cookies we use on or via our website by changing your browser settings or non-essential cookies but doing so can impair your ability to use our website or some or all of its features. For further information about cookies, including how to change your browser settings, please visit www.allaboutcookies.org or see our Cookies Policy.
Analytics & Tracking:
We use cookies to understand how the site is being used in order to improve the user experience. User data is anonymous.
4. Information collected: Contact us
Email:
When you send an email to the email address displayed on our website, we collect your email address and any other information you provide in that email (such as your name, telephone number and the information contained in any signature block in your email).
Legal basis for processing:
Our legitimate interests (Article 6(1)(f) of the General Data Protection Regulation).
Legitimate interest(s):
Responding to enquiries and messages we receive and keeping records of correspondence.
Legal basis for processing:
Necessary to perform a contract or to take steps at your request to enter into a contract (Article 6(1)(b) of the General Data Protection Regulation).
Reason why necessary to perform a contract:
Where your message relates to us providing you with goods or services or taking steps at your request prior to providing you with our goods and services (for example, providing you with information about such goods and services), we will process your information in order to do so.
Transfer and storage of your information:
Emails you send us will be stored within Microsoft servers in London, England.
We use a third-party email provider to store emails you send us. Our third-party email provider is Microsoft Office 365 Outlook Their privacy policy is available here https://www.microsoft.com/en-us/trust-center/privacy
Transfer and storage of your information:
Emails you send us will be stored within the European Economic Area on Google’s servers in Belgium. For further information please see the section of this privacy policy entitled Transfers of your information outside the European Economic Area.
Contact form:
When you contact us using our contact form, we collect mandatory information including your name, email address and IP address.
Legal basis for processing:
Our legitimate interests (Article 6(1)(f) of the General Data Protection Regulation).
Legitimate interest(s):
Responding to enquiries and messages we receive and keeping records of correspondence.
Legal basis for processing:
Necessary to perform a contract or to take steps at your request to enter into a contract (Article 6(1)(b) of the General Data Protection Regulation).
Reason why necessary to perform a contract:
Where your message relates to us providing you with goods or services or taking steps at your request prior to providing you with our goods and services (for example, providing you with information about such goods and services), we will process your information in order to do so.
Transfer and storage of your information:
Messages you send us via our contact form will be stored within London on Microsoft servers in England
For information about the safeguards used when your information is transferred outside the European Economic Area, see the section of this privacy policy below entitled Data Transfers outside the European Economic Area.
Phone:
When you contact us by phone, we collect your phone number and any information provide to us during your conversation with us. We do not record phone calls.
Legal basis for processing:
Our legitimate interests (Article 6(1)(f) of the General Data Protection Regulation).
Legitimate interest(s):
Responding to enquiries and messages we receive and keeping records of correspondence.
Legal basis for processing:
Necessary to perform a contract or to take steps at your request to enter into a contract (Article 6(1)(b) of the General Data Protection Regulation).
Reason why necessary to perform a contract:
Where your message relates to us providing you with goods or services or taking steps at your request prior to providing you with our goods and services (for example, providing you with information about such goods and services), we will process your information in order to do so.
Transfer and storage of your information:
Information about your call, such as your phone number and the date and time of your call, is processed by our third-party telephone service provider EE which is located in England. You can visit their website here. https://ee.co.uk/
Information about your phone call will be stored by our third-party telephone service provider within England.
Post:
If you contact us by post, we will collect any information you provide to us in any postal communications you send us.
Legal basis for processing:
Our legitimate interests (Article 6(1)(f) of the General Data Protection Regulation).
Legitimate interest(s):
Responding to enquiries and messages we receive and keeping records of correspondence.
Legal basis for processing:
Necessary to perform a contract or to take steps at your request to enter into a contract (Article 6(1)(b) of the General Data Protection Regulation).
Reason why necessary to perform a contract:
Where your message relates to us providing you with goods or services or taking steps at your request prior to providing you with our goods and services (for example, providing you with information about such goods and services), we will process your information in order to do so).
5. Information collected: Website interaction
Registering on our website:
When you register and create an account on our website, we collect the following information:
- Information about your computer and about your visits to and use of this website, such as your IP address, geographical location, browser type, referral source, length of visit and number of page views;
- Information relating to any transactions carried out between you and us on or in relation to this website, including information relating to any purchases you make of our goods or services (including name, e-mail address, postal address and phone number).
- Information that you provide to us for the purpose of subscribing to our e-mail notifications, placing reviews on our website, booking an appointment and when using our chat service.
If you do not provide the mandatory information required by the registration form, you will not be able to register or create an account on our website.
Legal basis for processing:
Necessary to perform a contract (Article 6(1)(b) of the General Data Protection Regulation).
Reason why necessary to perform a contract:
Creating an account on our website is necessary to allow you to access the goods and services you have purchased from us.
Transfer and storage of your information:
Information you submit to us via the registration form on our website will be stored within the UK on 20i Ltd servers.
Our web server is located in the UK For more context, you can review 20i Ltd Privacy Policy. https://www.20i.com/legal/20i-ltd-privacy-policy
We use a third-party email provider to store emails you send us. Our third-party email provider is Microsoft Mail. Their privacy policy is available here https://www.microsoft.com/en-us/trust-center/privacy
6. Information collected: Place order
Mandatory information:
When you place an order for goods or services on our website, we collect your name, email address, billing address, shipping address, company name (if applicable), & VAT number (if applicable).
If you do not provide this information, you will not be able to purchase goods or services from us on our website or enter into a contract with us.
Legal basis for processing:
Necessary to perform a contract (Article 6(1)(b) of the General Data Protection Regulation).
Reason why necessary to perform a contract:
We need the mandatory information collected by our checkout form or via email to establish who the contract is with and to contact you to fulfil our obligations under the contract, including sending you receipts and order confirmations.
Legal basis for processing:
Compliance with a legal obligation (Article 6(1)(c) of the General Data Protection Regulation).
Legal obligation:
We have a legal obligation to issue you with an invoice for the goods and services you purchase from us where you are VAT registered and we require the mandatory information collected by our checkout form for this purpose. We also have a legal obligation to keep accounting records, including records of transactions
Optional information:
We also collect optional information from you, such as your phone number and information about how you heard about us. We also ask you if you would like to receive marketing communications from us.
Payment Processing:
There are 2 options to process payments,
Email Purchase orders We may send a quotation to you via email where payment can be made directly with our bank. The security of your customer data is managed between both banks.
Outbound Communications:
To facilitate your order or for customer services purposes we will contact you directly via:
- Telephone (Voice)
7. Information collected: Third parties
Generally, we do not receive information about you from third parties.
It is also possible that third parties with whom we have had no prior contact may provide us with information about you.
Information we obtain from third parties will generally be your name and contact details, but will include any additional information about you which they provide to us. In certain circumstances (for example, to verify the information we hold about you or obtain missing information we require to provide you with a service) we will obtain information about you from certain publicly accessible sources, both EU and non-EU, such as online customer databases, business directories, media publications, social media, and websites (including your own website if you have one).
Legal basis for processing:
Necessary to perform a contract or to take steps at your request to enter into a contract (Article 6(1)(b) of the General Data Protection Regulation).
Reason why necessary to perform a contract:
Where a third party has passed on information about you to us (such as your name and email address) in order for us to provide services to you, we will process your information in order to take steps at your request to enter into a contract with you and perform a contract with you. We will also obtain information about you from public sources in order to enable us to understand your business and provide services to you.
Legal basis for processing:
Consent (Article 6(1)(a) of the General Data Protection Regulation).
Consent:
Where you have asked that a third party to share information about you with us and the purpose of sharing that information is not related to the performance of a contract or services by us to you.
Legal basis for processing:
Our legitimate interests (Article 6(1)(f) of the General Data Protection Regulation).
Legitimate interests:
Where a third party has shared information about you with us and you have not consented to the sharing of that information, we will have a legitimate interest in processing that information in certain circumstances. we will have a legitimate interest in obtaining information about you from public and private sources in order to investigate and pursue any potential infringement.
8. Profiling
Profiling is any form of automated processing of your information to evaluate personal aspects about you, in particular to analyse or predict things like your performance at work, economic situation, health, personal preferences, interests, reliability, behaviour, location or movements.
Use of profiling for web analytics:
Our web analytics service, Google Analytics collects information such as your location (based on your IP address) and your behaviour (based on cookies) when you access our website (such as the pages you visit and what you click on). We will only process information from cookies if you have consented to us setting cookies on your computer in accordance with our Cookies Policy here.
Logic involved:
By automatically analysing and categorising information such as the location (based on IP address) as well as the behaviour and devices of visitors to our website (using cookies), we are able to gain a better understanding of what our website visitors want (in terms of the content of our website and our products), how to improve our website and how to advertise and market our services to them.
Reason:
Cookies will be used to track and store information about your behaviour and device on our website (unless you have opted out from receiving such cookies by following this guide) and your location will be analysed based on your IP address. We may target advertisements based on the level of interest we receive from certain visitors and their behaviour on our website.
9. Interaction with external social networks and platforms:
This type of service allows interaction with social networks or other external platforms directly from the pages of this Website. The platforms might still collect traffic data for the pages where the service is installed, even when Users do not use it.
The interaction and information obtained through this Website are always subject to the User’s privacy settings for each social network.
Google Fonts (Google Inc.):
Google Fonts is a typeface visualization service provided by Google Inc. that allows this Website to incorporate content of this kind on its pages.
Personal Data collected: Usage Data and various types of Data as specified in the privacy policy of the service.
Place of processing: US – Privacy Policy.
Google Maps widget (Google Inc.)
Google Maps is a maps visualization service provided by Google Inc. that allows this Website to incorporate content of this kind on its pages.
Personal Data collected: Cookies and Usage Data.
Place of processing: US – Privacy Policy.
Font Awesome (Fonticons, Inc.):
Fontawesome is a typeface visualization service provided by Fonticons, Inc. that allows this Website to incorporate content.
Personal Data collected: Usage Data and various types of Data as specified in the privacy policy of the service.
Place of processing: US – Privacy Policy.
YouTube video widget (Google Inc.)
YouTube is a video content visualization service provided by Google Inc. that allows this Website to incorporate content of this kind on its pages.
Personal Data collected: Cookies and Usage Data.
Place of processing: US – Privacy Policy
Google Maps widget (Google Inc.)
Google Maps is a maps visualization service provided by Google Inc. that allows this Website to incorporate content of this kind on its pages.
Personal Data collected: Cookies and Usage Data.
Place of processing: US – Privacy Policy
YouTube video widget (Google Inc.)
YouTube is a video content visualization service provided by Google Inc. that allows this Website to incorporate content of this kind on its pages.
Personal Data collected: Cookies and Usage Data.
Place of processing: US – Privacy Policy
Instagram widget (Instagram, Inc.)
Instagram is an image visualization service provided by Instagram, Inc. that allows this Application to incorporate content of this kind on its pages.
Personal Data collected: Cookies and Usage Data.
Place of processing: US – Privacy Policy
- Interaction with data collection platforms and other third parties
This type of service allows Users to interact with data collection platforms or other services directly from the pages of this Website for the purpose of saving and reusing data.
If one of these services is installed, it may collect browsing and Usage Data in the pages where it is installed, even if the Users do not actively use the service.
Interaction with external social networks and platforms
This type of service allows interaction with social networks or other external platforms directly from the pages of this Website.
The interaction and information obtained through this Website are always subject to the User’s privacy settings for each social network.
This type of service might still collect traffic data for the pages where the service is installed, even when Users do not use it.
Facebook Like button and social widgets (Facebook, Inc.)
The Facebook Like button and social widgets are services allowing interaction with the Facebook social network provided by Facebook, Inc.
Personal Data collected: Cookies and Usage Data.
Place of processing: US – Privacy Policy
Pinterest and social widgets (Pinterest Europe Ltd)
Pinterest is a web and mobile application company that operates a software system designed to discover information online.
Personal Data collected: Cookies and Usage Data.
Place of processing: Ireland – Privacy Policy
Twitter Tweet button and social widgets (Twitter, Inc.)
The Twitter Tweet button and social widgets are services allowing interaction with the Twitter social network provided by Twitter, Inc.
Personal Data collected: Cookies and Usage Data.
Place of processing: US – Privacy Policy
LinkedIn button and social widgets (LinkedIn Corporation)
The LinkedIn button and social widgets are services allowing interaction with the LinkedIn social network provided by LinkedIn Corporation.
Personal Data collected: Cookies and Usage Data.
Place of processing: US – Privacy Policy
YouTube button and social widgets (Google Inc.)
The YouTube button and social widgets are services allowing interaction with the YouTube social network provided by Google Inc.
Personal Data collected: Cookies and Usage Data.
Place of processing: US – Privacy Policy
Managing contacts and sending messages
This type of service makes it possible to manage a database of email contacts, phone contacts or any other contact information to communicate with the User.
These services may also collect data concerning the date and time when the message was viewed by the User, as well as when the User interacted with it, such as by clicking on links included in the message.
SPAM protection
This type of service analyses the traffic of this Application, potentially containing Users’ Personal Data, with the purpose of filtering it from parts of traffic, messages and content that are recognized as SPAM.
Google reCAPTCHA (Google Inc.):
Google reCAPTCHA is a SPAM protection service provided by Google Inc.
The use of reCAPTCHA is subject to the Google Privacy Policy and Terms of Use.
Personal Data collected: Cookies and Usage Data.
Place of processing: US –Privacy Policy.
Managing our financial data
Accounting software where customer and supplier data is stored.
Xero Accounting (Xero Limited):
Xero is our online accounting software.
Personal Data collected: Personal Data.
Place of processing: UK –Privacy Policy.
10. Platform services
These services have the purpose of hosting and running key components of this Website, therefore allowing the provision of this Website from within a unified platform. Such platforms provide a wide range of tools to the Owner – e.g. analytics, user registration, commenting, database management, e-commerce, payment processing – that imply the collection and handling of Personal Data. Some of these services work through geographically distributed servers, making it difficult to determine the actual location where the Personal Data are stored.
WordPress.com (Automattic Inc.):
WordPress.com is a platform provided by Automattic Inc. that allows the owner to build, run and host this Website.
Personal Data collected: various types of Data as specified in the privacy policy of the service.
Place of processing: USA – Privacy Policy
Your information will be shared with these service providers where necessary to provide you with the service you have requested, whether that is accessing our website or ordering goods and services from us.
Legal basis for processing:
Legitimate interests (Article 6(1)(f) of the General Data Protection Regulation).
Legitimate interest relied on:
Where we share your information with these third parties in a context other than where is necessary to perform a contract (or take steps at your request to do so), we will share your information with such third parties in order to allow us to run and manage our business efficiently.
Legal basis for processing:
Necessary to perform a contract and/or to take steps at your request prior to entering into a contract (Article 6(1)(b) of the General Data Protection Regulation).
Reason why necessary to perform a contract:
We may need to share information with our service providers to enable us to perform our obligations under that contract or to take the steps you have requested before we enter into a contract with you.
Disclosure of your information to other third parties:
We disclose your information to other third parties in specific circumstances, as set out below.
Google Inc.
Google collects information through our use of Google Analytics on our website. Google uses this information, including IP addresses and information from cookies, for a number of purposes, such as improving its Google Analytics service. Information is shared with Google on an aggregated and anonymised basis. To find out more about what information Google collects, how it uses this information and how to control the information sent to Google, please see the following page: https://www.google.com/policies/privacy/partners/
Legal basis for processing:
Our legitimate interests (Article 6(1)(f) of the General Data Protection Regulation).
Legitimate interest(s):
Meeting our contractual obligations to Google under our Google Analytics Terms of Service (https://www.google.com/analytics/terms/us.html)
You can opt out of Google Analytics by installing the browser plugin here: https://tools.google.com/dlpage/gaoptout
Transfer and storage of your information:
Information collected by Google Analytics is stored outside the European Economic Area on Google’s servers in the United States of America.
For further information, See the section of this privacy policy below entitled Data Transfers outside the European Economic Area
Legal basis for processing:
Our legitimate interests (Article 6(1)(f) of the General Data Protection Regulation).
Legitimate interest:
Running and managing our business efficiently.
11. Disclosure and additional uses of your information
Insurers:
Information is shared with our insurers upon an official claim against us
Legal basis for processing:
Our legitimate interests (Article 6(1)(f) of the General Data Protection Regulation).
Legitimate interest:
Running and managing our business effectively.
Disclosure and use of your information for legal reasons:
- Indicating possible criminal acts or threats to public security to a competent authority, such as the Police.
- In connection with a legal or potential legal dispute or proceedings to resolve the dispute.
- For ongoing compliance with laws, regulations and other legal requirements:
Legal basis for processing:
Our legitimate interests (Article 6(1)(f) of the General Data Protection Regulation).
Legitimate interests:
Preventing crime or suspected criminal activity (such as fraud) and taking steps to enforce our legal rights.
Where the legal obligations are part of the laws of another country and have not been integrated into the United Kingdom’s legal framework, we have a legitimate interest in complying with these obligations.
12. Data retention: Personal data
We use your Personal Data to meet our contractual requirements to support us in providing a data protection service to you. We also use your Personal Data as required by law, such as for tax purposes. We also use your information to invoice you, and to keep track of payments that you make.
We will retain information about you for the duration of our relationship with you, then 2 years. We will retain financial records for 6 years, following the end of the current financial year for tax purposes.
Otherwise, we will retain your information for no longer than necessary, taking into account the following:
the purpose(s) and use of your information both now and in the future (such as whether it is necessary to continue to store that information in order to continue to perform our obligations under a contract with you or to contact you in the future);
- whether we have any legal obligation to continue to process your information (such as any record-keeping obligations imposed by relevant law or regulation);
- whether we have any legal basis to continue to process your information (such as your consent);
- how valuable your information is (both now and in the future);
- any relevant agreed industry practices on how long information should be retained;
- the levels of risk, cost and liability involved with us continuing to hold the information;
- how hard it is to ensure that the information can be kept up to date and accurate; and
- any relevant surrounding circumstances (such as the nature and status of our relationship with you).
13. Data security: Personal data
We take appropriate technical and organisational measures to secure your information and to protect it against unauthorised or unlawful use and accidental loss or destruction, including:
- only sharing and providing access to your information to the minimum extent necessary, subject to confidentiality restrictions where appropriate, and on an anonymised basis wherever possible;
- verifying the identity of any individual who requests access to information prior to granting them access to information;
- using Secure Sockets Layer (SSL) software to encrypt any information you submit to us via any forms on our website and any payment transactions you make on or via our website.
- only transferring your information via closed system or encrypted data transfers.
Transmission of information to us by email:
Transmission of information over the internet is not entirely secure, and if you submit any information to us over the internet (whether by email, via our website or any other means), you do so entirely at your own risk.
We cannot be responsible for any costs, expenses, loss of profits, harm to reputation, damages, liabilities or any other form of loss or damage suffered by you as a result of your decision to transmit information to us by such means.
14. Data Transfers outside the UK & European Economic Area
All of your information stored on our website is stored in the UK
Other than to comply with any legal obligations, we do not intend to transfer your information outside the UK, EEA or to an international organisation. In the unlikely event that we are required to transfer your information outside the UK & EEA, we will ensure appropriate safeguards and protections are in place.
Contact Form:
Information you submit to us via our contact form is transferred inside the UK and stored on our store’s server. Our hosting provider is 20i Ltd Internet. You can access their privacy policy here. https://www.20i.com/legal/20i-ltd-privacy-policy
Country of storage:
20i Ltd
Attn: Data Protection Officer
Hawthorn House, Southwell Road West, Mansfield, Nottinghamshire, NG21 0HJ, UK
Email:
Information you submit to us by email is stored in England by Microsoft. You can access their privacy policy here. https://www.microsoft.com/en-us/trust-center/privacy
Country of storage:
England
Google Analytics:
Information collected by Google Analytics (your IP address and actions you take in relation to our website) is transferred outside the EEA and stored on Google’s servers. You can access Google’s privacy policy here: https://www.google.com/policies/privacy/
Country of storage:
United States of America. This country is not subject to an adequacy decision by the European Commission.
Safeguard(s) used: Google has self-certified its compliance with the EU-U.S. Privacy Shield which is available here: https://www.privacyshield.gov/welcome. The EU-U.S. Privacy Shield is an approved certification mechanism under Article 42 of the General Data Protection Regulation, which is permitted under Article 46(2)(f) of the General Data Protection Regulation. You can access the European Commission decision on the adequacy of the EU-U.S. Privacy Shield here: http://ec.europa.eu/justice/data-protection/international-transfers/adequacy/index_en.htm
15. GDPR Individual rights
Subject to certain limitations on certain rights, you have the following rights in relation to your information, which you can exercise by writing to SOURCE-RE LIMITED , 32 High Street, Woodstock, Oxfordshire, OX20 1TG, 07966242665 or sending an email to Eleanor@source-re.uk
- to request access to your information and information related to our use and processing of your information;
- to request the correction or deletion of your information;
- to request that we restrict our use of your information;
- to receive information which you have provided to us in a structured, commonly used and machine-readable format (e.g. a CSV file) and the right to have that information transferred to another data controller (including a third-party data controller);
- to object to the processing of your information for certain purposes;
- to withdraw your consent to our use of your information at any time where we rely on your consent to use or process that information. (lawfulness of use and processing still applies).
In accordance with Article 77 of the General Data Protection Regulation, you also have the right to submit a complaint with a supervisory authority, in particular in the Member State of your habitual residence, place of work or of an alleged infringement of the General Data Protection Regulation.
For the purposes of the UK, the supervisory authority is the Information Commissioner’s Office (ICO), the contact details of which are available here: https://ico.org.uk/global/contact-us/
The above rights are provided in summary form only and certain limitations apply to many of these rights. For further information about your rights in relation to your information, including any limitations which apply, please visit the following pages on the ICO’s website:
- https://ico.org.uk/for-organisations/guide-to-the-general-data-protection-regulation-gdpr/individual-rights/; and
- https://ico.org.uk/for-the-public/is-my-information-being-handled-correctly/
- https://ico.org.uk/concerns/
You can also find out further information about your rights, as well as information on any limitations which apply to those rights, by reading the underlying legislation contained in Articles 12 to 22 and 34 of the General Data Protection Regulation, which is available here: http://ec.europa.eu/justice/data-protection/reform/files/regulation_oj_en.pdf
Verifying your identity where you request access to your information:
Upon a request to access your information, we are legally required to use all reasonable measures to verify your identity via existing information we have on file or we may ask for other forms of identity verification.
16. The right to restrict processing
You have the following rights in relation to your information, which you may exercise in the same way as you may exercise by writing to the Data controller: SOURCE-RE LIMITED, 32 High Street, Woodstock, Oxfordshire, OX20 1TG 07966242665 or sending an email to Eleanor@source-re.uk in order to object to us using or processing your information. Where we use or process it in order to carry out a task in the public interest or for our legitimate interests, including ‘profiling’ (i.e. analysing or predicting your behaviour based on your information) based on any of these purposes; and
- to object to us using or processing your information for direct marketing purposes (including any profiling we engage in that is related to such direct marketing).
You may also exercise your right to object to us using or processing your information for direct marketing purposes by:
- clicking the unsubscribe linkcontained at the bottom of any marketing email or SMS message we send to you.
- sending an email to Eleanor@source-re.uk in, asking that we stop sending you marketing communications or by including the words “OPT OUT”.
For more information on how to object to our use of information collected from cookies and similar technologies, please see the section entitled “How to accept or reject cookies” in our cookies policy.
17. Sensitive Personal Information
We do not knowingly or intentionally collect sensitive personal information from individuals.
‘Sensitive personal information’ data that consists of racial or ethnic origin, political opinions, religious or philosophical beliefs, or trade union membership, genetic data, biometric data, data concerning health or data concerning a natural person’s sex life or sexual orientation.
If you have sent sensitive personal information to us, you will be considered to have explicitly consented to us processing that sensitive personal information under Article 9(2)(a) of the General Data Protection Regulation. This information will be deleted after data processing.
18. Privacy Policy Updates
We periodically update and amend our Privacy Policy.
Privacy Policy: Minor updates
Where we make minor changes to our Privacy Policy, we will update our Privacy Policy with a new effective date stated at the beginning of it.
Privacy Policy: Major updates
Upon major changes to our Privacy Policy or using your Personal Data for a new purpose, we will notify you by email or via a notice on our website, explaining the reason for the change.
19. External Links
We have no control or responsibilities on other websites not owned by us. If you click on a third-party link, you will be directed to their website. It is recommended you review their privacy policy.
20. Children’s Data Privacy Compliance
Our company is compliant with the Children’s Online Privacy Protection Act of 1998 (COPPA). COPPA regulations protect the privacy of children using the internet. We do not contact or collect data for persons under the age of 18. However, if we did, we immediately obtain the appropriate parental consent to use that information or, if not we will delete the information from our servers. If you would like inform us that persons under the age of 18 has engaged with us via the Internet, please send an email to Eleanor@re-source.uk
21. DNT (Do Not Track) Disclosure: The California Online Privacy Protection Act
“Do Not Track” is a web browser privacy preference option. This will send a message to websites requesting that they do not track the user. For further information visit www.allaboutdnt.org
Currently, we do not respond to Do Not Track browser settings or signals. However, please note your internet activity may still be monitored via pixels and web beacons. To opt out of these please see our Cookies Policy.
22.How to contact us
If you want to request information about our privacy policy or discuss any data protection issues you can at Eleanor@source-re.uk or write to:
Data controller: Eleanor Matthews
32 High Street, Woodstock, Oxfordshire, OX20 1TG
07966242665
23. Your right to complain
Your right to complain to a supervisory authority. You have the right to take any complaints about how we process your personal data to a supervisory authority.
The supervisory authority contact details:
Information Commissioner’s Office
Wycliffe House
Water Lane
Wilmslow
Cheshire SK9 5AF
Phone: 0303 123 1113.
Further assistance in how to report a concern or a complaint https://ico.org.uk/concerns/
