Tangram Furnishers Ltd – Privacy Notice in compliance with GDPR

Scope

This document provides you with information about how we are handling, or are intending to handle, your personal information.

About us

Tangram Furnishers Ltd (“Tangram” “we” “us” and “our”) is committed to protecting and respecting your privacy and complying with the principles of applicable data protection laws.  This notice sets out the basis on which any personal data we collect from you, or that you provide to us, will be processed by us. Please read the following carefully to understand our views and practices regarding your personal data and how we will treat it.  The data controller of the personal data referred to in this policy is Tangram Furnishers Ltd, 33/37 Jeffrey Street, Edinburgh, EH1 1DH.

Collection of personal data

Personal data, or personal information, means any information about an individual from which that person can be identified. It does not include data where the identity has been removed (anonymous data).

Tangram may collect or otherwise obtain and process the following data about you:

• Information about you (identity data) such as your name, last name, title, that you provide by filling in forms while signing up to receive our newsletter.

• Information you provided when placing an order (contact data) such as billing address, delivery address, email address and telephone numbers (excluding credit card details which are destroyed immediately after use).

• Transaction and financial data such as details about payments from you and other details of products and services you have purchased from us. We may also ask you for information when you report a problem or make a complaint and, if you contact us, we may keep a record of that correspondence.

• Technical Data such as internet protocol (IP) address, your login data, browser type and version, time zone setting and location, browser plug-in types and versions, operating system and platform, and other technology on the devices you use to access our website, this includes information from your social media accounts but only where you have given us permission to use it. For example, posts, pictures and video footage you share on sites such as Facebook, Twitter and Instagram.

• Profile Data such as your username and password, purchases or orders made by you, your interests, preferences, feedback and survey responses, this includes information provided at the time of registering to use our website chat function, subscribing to our communications or requesting further services.

• Usage Data such as information about how you use our website, products and services including details of when you digitally interact with Tangram via our website and other digital channels and the resources that you access which may include the use of cookies (subject to our Cookie policy).

• Marketing and Communications Data such as your preferences in receiving marketing from us and our third parties and your communication preferences including: information about emails and other communications we have sent to you and your interaction with them, and information from third parties where you consent to those other organisations sharing information they hold on you with us, and where those other organisations lawfully share your information with us.

We do not collect any Special Categories of Personal Data about you (this includes details about your race or ethnicity, religious or philosophical beliefs, sex life, sexual orientation, political opinions, trade union membership, information about your health, and genetic and biometric data). Nor do we collect any information about criminal convictions and offences.

Third-Party Links

Our website may include links to third-party websites, plug-ins and applications. Clicking on those links or enabling those connections may allow third parties to collect or share data about you. We do not control these third-party websites and are not responsible for their privacy statements. When you leave our website, we encourage you to read the privacy policy of every website you visit.

If you fail to provide personal data

Where we need to collect personal data by law, or under the terms of a contract we have with you, and you fail to provide that data when requested, we may not be able to perform the contract we have or are trying to enter into with you (for example, to provide you with goods or services). In this case, we may have to cancel a product or service you have with us but we will notify you if this is the case at the time.

How is your Personal Data collected and legal basis for processing

We use different methods to collect data from and about you including through:

• Direct interactions. You may give us your Identity, Contact and Financial Data by filling in forms or by corresponding with us by post, phone, email or otherwise. This includes personal data you provide when you:

• • buy products from us
  • create an account on our website;
  • request marketing to be sent to you;
  • enter a competition, promotion or survey; or
  • give us feedback or contact us.

• Automated technologies or interactions. As you interact with our website, we will automatically collect Technical Data about your equipment, browsing actions and patterns. We collect this personal data by using cookies, pixels, and other similar technologies.
• Third parties or publicly available sources. We will receive personal data about you from various third parties and public sources as set out below:

• • Technical Data from analytics providers such as Google based outside the EU.

We will only use your personal data when the law allows us to. Most commonly, we will use your personal data in the following circumstances:

• Where we need to perform the contract we are about to enter into or have entered into with you.
• Where it is necessary for our legitimate interests (or those of a third party) and your interests and fundamental rights do not override those interests.
• Where we need to comply with a legal obligation.

Generally, we do not rely on consent as a legal basis for processing your personal data. You have the right to withdraw consent to marketing at any time by contacting us.

Purposes for which we will use your personal data

We have set out below, in a table format, a description of all the ways we plan to use your personal data, and which of the legal bases we rely on to do so. We have also identified what our legitimate interests are where appropriate.

Note that we may process your personal data for more than one lawful ground depending on the specific purpose for which we are using your data. Please contact us if you need details about the specific legal ground we are relying on to process your personal data where more than one ground has been set out in the table below.

Marketing and promotional offers from us

We may use your data to form a view on what we think you may want or need, or what may be of interest to you. This is how we decide which products, services and offers may be relevant for you (we call this marketing).

You will receive marketing communications from us if you have opted in to receive our e-newsletter, requested information from us or purchased products from us and you have not opted out of receiving that marketing.

We do not share your details for third party marketing. We would always get your express opt-in consent before we share your personal data with any third party for marketing purposes.

Opting out

You can ask us to stop sending you marketing messages at any time by following the unsubscribe links on any marketing message sent to you.

Where you opt out of receiving these marketing messages, this will not apply to personal data provided to us as a result of a product purchase, fulfilling a contract with you, a warranty registration, product experience or other transactions.

Cookies

You can set your browser to refuse all or some browser cookies, or to alert you when websites set or access cookies. If you disable or refuse cookies, please note that some parts of this website may become inaccessible or not function properly.

Information security

Tangram will take all steps reasonably necessary including policies, procedures and security features to ensure that your data is treated securely and protected from unauthorised and unlawful access and/or use, and in accordance with this notice.  Unfortunately, the transmission of information via the internet is not completely secure and, although we will do our best to protect your personal data transmitted to us via the internet, we cannot guarantee the security of your data transmitted to our website from your device. Any transmission is at your own risk.

We have put in place procedures to deal with any suspected personal data breach and will notify you and any applicable regulator of a breach where we are legally required to do so.

Card payments

Tangram will always provide payment options for an order.  We offer the option to pay over the phone using details provided or by BACS transfer.  Details that are provided over the phone are destroyed immediately after use and are not stored.

Change of purpose

We will only use your personal data for the purposes for which we collected it, unless we reasonably consider that we need to use it for another reason and that reason is compatible with the original purpose. If you wish to get an explanation as to how the processing for the new purpose is compatible with the original purpose, please contact us.

If we need to use your personal data for an unrelated purpose, we will notify you and we will explain the legal basis which allows us to do so.

Please note that we may process your personal data without your knowledge or consent, in compliance with the above rules, where this is required or permitted by law.

Disclosures of your personal data

We may share your personal data with the parties set out below for the purposes set out in the table above.

External third parties

• Service providers acting as processors such as Quickbooks (Intuit Inc and Quincy Data Centre LLC), Hubspot, Inc, Mailchimp (the Rocket Science Group LLC), Office 365 (part of the Microsoft corporation) based in the USA who provide IT, electronic marketing, database, and system administration services.
• Service providers acting as based in the EEA who provide IT, electronic marketing, database, and system administration services.
• Contractors and suppliers such as architects, electricians, builders, interior designers, furniture manufacturers
• Professional advisers acting as processors including lawyers, bankers, auditors and insurers based in the UK who provide consultancy, banking, legal, insurance and accounting services.
• HM Revenue & Customs, regulators and other authorities acting as processors or joint controllers based in the UK who require reporting of processing activities in certain circumstances.

Third parties to whom we may choose to sell, transfer or merge parts of our business or our assets. Alternatively, we may seek to acquire other businesses or merge with them. If a change happens to our business, then the new owners may use your personal data in the same way as set out in this privacy policy.

We require all third parties to respect the security of your personal data and to treat it in accordance with the law. We do not allow our third-party service providers to use your personal data for their own purposes and only permit them to process your personal data for specified purposes and in accordance with our instructions.

International Transfers

Some of our external third parties are based outside the EEA so their processing of your personal data will involve a transfer of data outside the EEA.

Whenever we transfer your personal data out of the EEA, we ensure a similar degree of protection is afforded to it by ensuring at least one of the following safeguards is implemented:

• We will only transfer your personal data to countries that have been deemed to provide an adequate level of protection for personal data by the European Commission.
• Where we use certain service providers, we may use specific contracts approved by the European Commission which give personal data the same protection it has in Europe.
• Where we use providers based in the US, we may transfer data to them if they are part of the Privacy Shield which requires them to provide similar protection to personal data shared between Europe and the US.

Please contact us if you want further information on the specific mechanism used by us when transferring your personal data out of the EEA.

Data retention period

We will hold information about you in our data systems only for as long as we need it for the purpose for which we collected it, which is as follows:

• As long as you continue to visit our website or use our services (including engaging with emails) we will retain and process information about you. In such cases, you will be considered to be an ‘active’ customer. If you have not been ‘active’ as a customer for a period of three years, Tangram will anonymise any personal data relating to you.
• We are obligated to retain customer accounts information for 7 years as an HMRC requirement
• Personal data linked to the processing of insurance claims, subject access requests, disputes, safeguarding investigations, disciplinary or police matters will only be kept for as long as it necessary for those purposes, as each is applicable.

The data subject’s rights

Data protection laws grant you, as a Data Subject, certain ‘information rights’, which are summarised below:

• Right of access– You have the right to obtain a copy of information we hold about you
• Right of rectification or erasure– If you feel that any data that we hold about you is inaccurate, you have the right to ask us to correct or rectify it. You also have a right to ask us to erase information about you where you can demonstrate that the data we hold is no longer needed by us, or if you withdraw the consent upon which our processing is based, or if you feel that we are unlawfully processing your data. Please note that we may be entitled to retain your personal data despite your request, for example if we are under a separate legal obligation to retain it. Your right of rectification and erasure extends to anyone we have disclosed your personal information to and we will take all reasonable steps to inform those with whom we have shared their data about your request for erasure.
• Right to restriction of processing– You have a right to request that we refrain from processing your data where you contest its accuracy, or the processing is unlawful and you have opposed its erasure, or where we do not need to hold your data any longer but you need us to in order to establish, exercise or defend any legal claims, or we are in dispute about the legality of our processing your personal data.
• Right to Object– You have a right to object to our processing your personal data where the basis of the processing is our legitimate interests including but not limited to direct marketing and profiling.
• Right to Withdraw Consent– You have the right to withdraw your consent for the processing of your personal data where the processing is based on consent.
• Right of Complaint– You also have the right to lodge a complaint about any aspect of how we are handling your data with theUK Information Commissioner’s Office, which can be contacted at org.uk.
• Right to Opt-out of Marketing Communications– You have the right to opt-out of marketing communications we send to you at any time. You can exercise this right by clicking on the “unsubscribe” link in the marketing emails we send you.

Changes to our privacy policy

Any changes we may make to our Privacy Notice in the future will be posted on this page and, where appropriate, notified to you by e-mail communication.

How to contact us

If you wish to contact us about your personal data or exercise any of the rights described above please contact: [email protected]