Privacy policy

Your privacy is important to us. When we process your personal data, we comply with the UK GDPR and the Data Protection Act 2018, together with any other applicable data protection and privacy legislation, including the GDPR where you are based within the European Union.

Your personal data includes all the information we hold that identifies you or is about you. More information about the types of personal data we process about you is set out below.

Everything we do with your personal data counts as processing it, including collecting, storing, amending, transferring and deleting it.

This privacy policy, together with our website terms of use, provides information about the personal data we process about you, why we process it and how we process it. It applies to customers and suppliers as well as candidates contacting us in relation to job vacancies.

Our responsibilities

Harrison Spinks Beds Ltd (a company registered in England with registered company number 277690 and registered address at The Innovation Centre, Westland Road, Leeds, LS11 5SB) is the controller of the personal data you provide.

If you have any questions about this privacy policy or the ways in which we process your personal data or you wish to exercise any of your rights as a data subject set out below, please contact us at info@harrisonspinks.co.uk.

What data do we process about you?

Customers

We need certain information from you to be able to process your requests/queries with regard to our products and services and to process any orders. The information we usually collect about you is your:

• name;
• address;
• email address; and
• phone number.

We may also process your information if one of our customers has asked us to send products directly to you, in which case we ask our customer to provide your name, delivery address and phone number.

We may also collect information through the use of cookies employed on our website (see below for further information on this).

Suppliers and Business Contacts

If you are one of our business contacts or suppliers, we will process information about you to the extent necessary to manage our relationship with you. This usually includes processing your name, business email address, business telephone number and information about the organisation for which you work.

All other information that we process, such as payment details and transaction / order data will relate to the organisation for which you work and is therefore not personal data.

Candidates

Personal data that we are likely to process about you includes:

• identity data such as your first name, middle names, last name, marital status, title, date of birth and gender;
• contact data such as your postal address, email address and telephone numbers;
• background data such as your education, career background and work experience;
• personal information such as your skills and qualities;
• any other information that you include on any CV, application or covering letter you send to us.

Why do we process your personal data?

Customers, Suppliers and Business Contacts

We process your personal data to:

• fulfil any order you make for our goods and services (if you are a consumer, we process this information on the grounds of fulfilment of our contract with you. Otherwise we process this information on the grounds of our legitimate interests);
• respond to any request or query you make with regard to our products and/or services on the grounds of our legitimate interests; and
• notify you of any changes to any product or service on the grounds of our legitimate interests.

We may also process your personal data on the grounds of our legitimate interests for the following reasons:

• to enhance, modify, personalise or otherwise improve the website, our services and communications for the benefit of our customers;
• to identify and prevent fraud;
• to enhance the security of our network and information systems;
• to better understand how people interact with our websites;
• administer the website and for internal operations, including data analysis, troubleshooting and testing, research, statistical and survey purposes;
• ensure that content from our website is presented in the most effective manner for you and your computer; and carry out customer management activities to enable us to deliver better goods and services to our customers; and
• as part of our efforts to keep our website safe and secure.

Candidates

We will process your information on the grounds of our legitimate interests to determine whether or not we have a suitable vacancy for you. To the extent we need to process special categories of data about you (for example, to ensure our premises are suitably equipped for you if you attend for an interview), we will do so in accordance with our legal obligations. If you provide special categories of data to us which we have not requested, we will process it on the grounds of your consent because you have voluntarily provided the information to us.

Our collection of your personal data

Customers, Suppliers and Business Contacts

We use different methods to collect data from and about you including through:

Direct interactions

You may give us your personal data by filling in forms on our website or by corresponding with us by post, phone, email or otherwise. This includes personal data you provide when you: place an order for our products or services; submit a query about our products or service whether on our website or by email or phone; request for information or marketing to be sent to you; or give us feedback or contact us.

Unfortunately, the transmission of information via the internet is not always completely secure. Although we will do our best to protect your personal data, we cannot guarantee the security of data transmitted to our site and any transmission will be at your own risk. Once we have received your information we will use strict procedures and security features to try prevent unauthorised access to the data.

Automated technologies or interactions

As you interact with our website, we may automatically collect personal data about you. You can find out more information in our cookie policy.

Other sources

We may receive information about you if you use any of the other websites we operate or the other services we provide. These include www.spinks.co.uk, www.themotorist.co.uk, www.theoakwoodatryther.co.uk and www.horningtonmanor.co.uk.

Candidates

We receive personal data about you directly from you (or from a recruitment agency on your behalf) when you contact us in respect of a specific vacancy or with a speculative approach.

Who will receive your personal data?

Your personal data is only transferred to the extent that this is necessary. Recipients of your personal data may include:

• any IT or web development service provider we may appoint to provide updates to our website, process payments, improve our IT security or any associated IT assistance;
• third party marketing platforms including Rocket Science Group LLC, trading as MailChimp;
• third parties that process payment information which may include your personal data (for example, Shopify) on our behalf to fulfil any order you make for our goods and services;
• organisations for the purposes of fraud protection and credit risk reduction where we are under a duty to disclose or share your personal data in order to comply with any legal obligation, or in order to enforce or apply our terms of use and other agreements; or to protect our rights, property, or safety, our customers, or others;
• any member of our group, which means our subsidiaries, our ultimate holding company and its subsidiaries, as defined in section 1159 of the Companies Act 2006;
• legal advisers to the extent they need to see your personal data to provide us with legal advice;
• third parties to whom we may choose to sell, transfer or merge parts of our business or our assets. Alternatively, we may seek to acquire other businesses or merge with them. If a change happens to our business, then the new owners may use your personal data in the same way as set out in this privacy policy; and
• any third parties to whom you ask us to transfer personal data, for example on termination or expiry of our contract with you.

We require all third parties to respect the security of your personal data and to treat it in accordance with the law.

Ordinarily we will not transfer your data outside of the EEA but where we do (e.g. to MailChimp in the USA) we will ensure a similar degree of protection is afforded to it by ensuring at least one of the following safeguards is implemented:

• we will only transfer your personal data to countries that have been deemed to provide an adequate level of protection; or
• we will rely on alternative transfer mechanisms such as standard contractual clauses or equivalent approved mechanisms.

Please contact us if you require any further information on the specific mechanism used by us when transferring your personal data outside of the EEA.

How long will we keep your personal data?

Customers, Suppliers and Business Contacts

Your personal data is retained for no more than 7 years from the date we add you to our database, unless communications with you are ongoing at that point in which case we will retain your data for 7 years from the date of your last communication with us. It is retained for this period in case any issues arise (or any contractual claim is brought by either party) or in case you have any queries. Your information will be kept securely at all times. Following the end of the 7 year period, your files and personal data we hold about you will be permanently deleted or destroyed. If we are required to obtain your consent to send you marketing communications, any information we use for this purpose will be kept until you withdraw your consent, unless we have other legitimate reasons to retain the data.

Candidates

If you are successful, we will retain your personal data in line with our employee facing privacy policy, a copy of which will be provided to you. If you are unsuccessful, we will retain your application, CV and/or covering letter and any other personal data you provided to us for 6 months from the date we reach our decision in case any other suitable roles arise in which we think you may be interested, or in case you have any questions about our decision. After that date, your personal data will be permanently deleted or destroyed.

Marketing

We may use your personal data to form a view on what we think you may want or need, or what may be of interest to you. This is how we decide which products, services and offers may be relevant for you.

You will receive marketing communications from us if you have requested information from us or purchased goods or services from us and you have not opted out of receiving that marketing.

We will get your express opt-in consent before we share your personal data with any third party for marketing purposes.

You can ask us or third parties to stop sending you marketing messages by contacting us at any time or by clicking the “Unsubscribe” option in any email we send you.

Third Party Sites

Our website may contain links to third party websites, including websites via which you are able to purchase products and services. They are provided for your convenience only and we do not check, endorse, approve or agree with such third party websites not the products and/or services offered and sold on them. We have no responsibility for the content, product and/or services of the linked websites.

Please ensure you review all terms and conditions of website use and the privacy policies of any such third party websites before use and before you submit any personal data to such websites.

What are your rights?

You benefit from a number of rights in respect of the personal data we hold about you. We have summarised your rights below, and more information is available from the Information Commissioner’s Office website. These rights apply for the period in which we process your data. There are certain caveats and exemptions to those rights which mean that in some circumstances you may not be entitled to exercise them, if we believe that is the case upon receipt of a request from you, we will let you know.

1. Access to your data

You have the right to ask us to confirm that we process your personal data, as well as access to and copies of your personal data. You can also ask us to provide a range of information, although most of that information corresponds to the information set out in this privacy policy.

2. Rectification of your data

If you believe personal data, we hold about you is inaccurate or incomplete, you can ask us to rectify that information.

3. Right to be forgotten

In some circumstances, you have the right to ask us to delete personal data we hold about you.

4. Right to restrict processing

In some circumstances you are entitled to ask us to suppress processing of your personal data. This means we will stop actively processing your personal data, but we do not have to delete it.

5. Data portability

You have the right to ask us to provide your personal data in a structured, commonly used and machine-readable format so that you are able to transmit the personal data to another data controller.

6. Right to object

You are entitled to object to us processing your personal data:

• if the processing is based on legitimate interests or performance of a task in the public interest or exercise of official authority;
• for direct marketing purposes (including profiling); and/or
• for the purposes of scientific or historical research and statistics.

We do not intend to use your personal data to send you direct marketing nor for scientific or historical research and statistics.

Automated decision-making

Automated decision-making means making a decision solely by automated means without any human involvement.

We carry out re-marketing which uses cookies to place advertisements which may be of interest to you on websites you visit. We will only do this once we have your prior consent. For more information please visit our cookie policy.

Your right to complain about our processing

If you think we have processed your personal data unlawfully or that we have not complied with GDPR may you can report your concerns to the supervisory authority in your jurisdiction, although we would welcome the opportunity to investigate and resolve any concerns that you.

The supervisory authority in the UK is the Information Commissioner’s Office (“ICO”). You can call the ICO on 0303 123 1113 or get in touch via other means, as set out on the ICO website - https://ico.org.uk/concerns/. We’d really like it if you got in touch with us in the first instance so we can try to help.