Toggle Nav

INTRODUCTION

We are serious about protecting the privacy and data of our users. We are committed to being upfront about our privacy practices. This Privacy Policy describes how we use and protect your personal data.  The privacy policy applies towww.emporella.com, and was updated April 2020.

We use information collected about you only as permitted in this Privacy Policy. The Site may contain links to third parties’ websites. We’re not responsible for the privacy practices or the content of those websites. Therefore, please read carefully any privacy policies on those websites before either agreeing to their terms or using those websites. Unless we explain otherwise in this policy, the words and phrases used in this policy have the same meaning as in theGeneral FAQs,DeliveryandReturns.

The terms “users” or “you” as used in this Privacy Policy, refer to both customers, who use the site to look for services to hire, and suppliers who use this site to list their services for hire.

By providing information to us when registering as a customer or a supplier, sending enquiries or otherwise using the site, you expressly agree to this Privacy Policy. We may occasionally amend this Privacy Policy to reflect regulatory requirements; advances in technology, site updates and changes in our information collection and disclosure practices. Any new policy will automatically be effective when it is published on the website. You should therefore return here regularly to view our most up to date Privacy Policy. You should also print a copy for your records.

 

TOPICS

SECTION 1 - WHAT DO WE DO WITH YOUR INFORMATION/DATA?

SECTION 2 – CONSENT

SECTION 3 – DISCLOSURE

SECTION 4 – MAGENTO

SECTION 5 – PAYMENTS

SECTION 6 - THIRD-PARTY SERVICES

SECTION 7 – SECURITY

SECTION 8 – COOKIES

SECTION 9 - AGE OF CONSENT

SECTION 10 - CHANGES TO THIS PRIVACY POLICY

SECTION 1 - WHAT DO WE DO WITH YOUR INFORMATION/DATA?

In order to use Emporella, you need to provide us with a valid email address, a name associated with your account that you can choose and that represents your identity on Emporella. You may review or change your name and email address through your account settings. Depending on which services you choose to use, additional information, such as a business name, billing and payment information, a telephone number, and/or a physical postal address, may be necessary in order for us to provide a particular service. In order to minimise the impact on your privacy, we will never knowingly collect more Personal Data than is strictly necessary to perform the activities described in this policy.

We may obtain location information you provide in your profile or your IP address. We may use and store information about your location to provide features and to improve and customise our services, for example, for Emporella internal analytics and performance monitoring; localisation, regional requirements, local content, search results and recommendations.

When you purchase something from our store, as part of the buying and selling process, we collect the personal information you give us such as your name, address and email address.

When you browse our store, we also automatically receive your computer’s internet protocol (IP) address in order to provide us with information that helps us learn about your browser and operating system.

Email marketing (if applicable): With your permission, we may send you emails about our store, new products and other updates.

Emporella collects your data so that we can process your order and manage your account or email you with special offers on other products and services we think you might like.

We use your information to deliver Emporella’s services and the specific features and functionality you request. This includes things like generating the search results that most accurately match your search criteria and supporting the wedding planning process. In addition to using your information to deliver the essential aspects of the Emporella service, we also use it to optimise and personalise your experience of the site. For example, we will use cookies to remember your language and other preferences may also personalise your experience by highlighting or recommending certain suppliers or informative posts that we believe are relevant to you. We use non-personal information, such as what you have searched for on the site or your general geographic location, to present you with relevant advertisements. We use information we collect about how users interact with the site in order to identify and correct faults, improve our services and inform business decisions, as well as for security and fraud-prevention purposes. We use your information to contact you with confirmations, notifications or alerts you have requested, such as email newsletters or correspondence between yourself and suppliers.

SECTION 2 – CONSENT

How do you get my consent?

When you provide us with personal information to complete a transaction, verify your credit card, place an order, arrange for a delivery or return a purchase, we imply that you consent to our collecting it and using it for that specific reason only.

If we ask for your personal information for a secondary reason, like marketing, we will either ask you directly for your expressed consent, or provide you with an opportunity to say no.

We collect information that you voluntarily provide to us during your use of the Emporella Services. This can range from information, such as wedding date, location, to the personal information you are required to submit when you create an online account, place an order through this website or advertise with us.

Voluntarily complete a customer survey or provide feedback on any of our message boards/ blogs or via email.

Use or view our website via your browser’s cookies.

In addition to information that you voluntarily provide to us, we also collect certain non-personal information directly from you as you use this website, as well as indirectly where it is provided to us automatically by the third party application, social networking site (such as Facebook) or other website (such as a promotion partner).

Why do you collect such personal information?

We collect such Non-personal and Personal Information for the following purposes:

To provide and operate the Services;

To provide our users with ongoing customer assistance and technical support;

To be able to contact our visitors and users with general or personalized service-related notices and promotional messages;

To create aggregated statistical data and other aggregated and/or inferred non-personal information, which we or our business partners may use to provide and improve our respective services; 

To comply with any applicable laws and regulations.

How do I withdraw my consent?

If after you opt-in, you change your mind, you may withdraw your consent for us to contact you, for the continued collection, use or disclosure of your information, at anytime, by contacting us at [email protected] 

Marketing

Emporella would like to send you information about products and services of ours that we think you might like, as well as those of our partner companies.

  • Bridal Emporium 
  • Claire Amelia Bridal
  • If you have agreed to receive marketing, you may always opt out at a later date.

You have the right at any time to stop Emporella from contacting you for marketing purposes or giving your data to other members of the Our Company Group.

If you no longer wish to be contacted for marketing purposes, please email [email protected]

What are your data protection rights?

Sellers:

If you sell using our platform, you may receive and determine what to do with certain personal information, such as when communicating with users and entering into transactions with buyers. This means you process personal information and, to the extent do so, under EU law, you are an independent controller of data relating to other users that you may have obtained through our platform.

You are responsible for protecting user personal information you receive or process and complying with all relevant legal requirements when you use the platform. This includes applicable data protection and privacy laws that govern the ways in which you can use a user’s information. Such laws may require that you post, and comply with, your own privacy policy, which must be accessible to Emporella users you interact with and compatible with this policy and Emporella Terms & Conditions. For more information on the General Data Protection Regulation, see more resources athttps://gdpr-info.eu.

As a data controller, to the extent that you process user personal information outside of the services, you may be required under applicable data protection and privacy laws to honour requests for data access, portability, correction, deletion, and objections to processing. Also, if you disclose personal information without the buyer’s proper consent, you are responsible for that unauthorised disclosure. This includes, for example, disclosures you make or unintentional data breaches. For example, you may receive a customer’s email address or other information as a result of entering into a transaction with that customer. This information may only be used for Emporella related communications or for Emporella-facilitated transactions. You may not use this information for unsolicited commercial messages or unauthorised transactions. Without the customers consent, and subject to other applicable Emporella policies and laws, you may not add any Emporella customer or supplier to your email or physical mailing list, use that customer's identity for marketing, or obtain or retain any payment information. Please bear in mind that you're responsible for knowing the standard of consent required in any given instance.

If Emporella and the seller are found to be joint data controllers of personal information, and if Emporella is sued, fined, or otherwise incurs expenses because of something that the seller did as a joint data controller of buyer personal information, you agree to indemnify Emporella for the expenses it occurs in connection with your processing of buyer personal information.

Emporella Customer:

Emporella would like to make sure you are fully aware of all of your data protection rights. Every user is entitled to the following:

The right to access: – You have the right to request Emporella for copies of your personal data. We may charge you a small fee for this service.

The right to rectification: – You have the right to request that Emporella correct any information you believe is inaccurate. You also have the right to request Emporella to complete the information you believe is incomplete.

The right to erasure – You have the right to request that Emporella erase your personal data, under certain conditions.

The right to restrict processing – You have the right to request that Emporella restrict the processing of your personal data, under certain conditions.

The right to object to processing – You have the right to object to Emporella processing of your personal data, under certain conditions.

The right to data portability – You have the right to request that Emporella transfer the data that we have collected to another organisation, or directly to you, under certain conditions.

If you make a request, we have 30 days to respond to you. If you would like to exercise any of these rights, please contact our GDPR nominee via our email:

[email protected]

GDPR Nominee: Claire Amelia

Withdrawing Consent

Where you have provided your consent, you have the right to withdraw your consent to our processing of your information and your use of the platform. For example, you can withdraw your consent to email marketing by using the unsubscribe link in such communications or by changing your account settings via your dashboard. You can choose to withdraw your consent to our processing of your information and your use of the Services at any time by closing your account by emailing [email protected] to request that your personal information be deleted, except for information that we are required to retain.

How can I access or manage my Personal Information?

If you have created an account with Emporella you can manage most of your Personal Information and subscription preferences from within your profile settings.

SECTION 3 – DISCLOSURE

We may disclose your personal information if we are required by law to do so or if you violate our terms of service.

We will always be working with our suppliers, to make sure they are adhering to our privacy policy, terms and conditions. We require all of our third parties to respect the security of your personal data, and that they may only use your data for the purposes that is stated upon our privacy policy.

SECTION 4 – MAGENTO

Our online store is hosted on Magento. They provide us with the online e-commerce marketplace platform that allows us to sell our products and services to you. 

Your data is stored through Magento’s data storage, databases and the general Magento application. They store your data on a secure server behind a firewall.

SECTION 5 – PAYMENTS

Emporella uses two payment gateways, Stripe and Paypal. All direct payment gateways adhere to the standards set by PCI-DSS as managed by the PCI Security Standards Council, which is a joint effort of brands like Visa, MasterCard, American Express and Discover.

If you choose a direct payment gateway to complete your purchase, then Magento stores your credit card data. It is encrypted through the Payment Card Industry Data Security Standard (PCI-DSS). Your purchase transaction data is stored only as long as is necessary to complete your purchase transaction. After that is complete, your purchase transaction information is deleted. PCI-DSS requirements help ensure the secure handling of credit card information by our store and its service providers.

Paypal

A significant benefit and innovation of PayPal’s Services is that you can connect your Account with a third-party account or platform. For the purposes of this Privacy Statement, an “account connection” with such a third-party is a connection you authorise or enable between your Account and a non-PayPal account, payment instrument, or platform that you lawfully control or own.  When you authorise such a connection, PayPal and the third-party will exchange your Personal Data and other information directly. Examples of account connections include:

  • linking your Account to a social media account or social messaging service;
  • connecting your Account to a third-party data aggregation or financial services company, if you provide such company with your Account log-in credentials; or
  • using your Account to make payments to a merchant or allowing a merchant to charge your Account.

If you choose to create an account connection, we may receive information from the third-party about you and your use of the third-party’s service.  For example, if you connect your Account to a social media account, we will receive Personal Data from the social media provider via the account connection.  If you connect your Account to other financial accounts, directly or through a third-party service provider, we may have access to your account balance and transactional information, such as purchases and funds transfers.  We will use all such information that we receive from a third-party via an account connection in a manner consistent with this Privacy Statement. 

Information that we share with a third-party based on an account connection will be used and disclosed in accordance with the third-party’s privacy practices.  Before authorising an account connection, you should review the privacy notice of any third-party that you authorised to have an account connection that will gain access to your Personal Data as part of the account connection.  For example, Personal Data that PayPal shares with a third-party account or platform such as a social media account may in turn be shared with certain other parties, including the general public, depending on the account’s or platform’s privacy practices. 

You can view PayPals Privacy Policy here:https://www.paypal.com/uk/webapps/mpp/ua/privacy-full#6

Stripe

Appointment of Sub-Processors. You acknowledge and agree that: (a) Stripe affiliates may be retained as Sub-Processors; and (b) Stripe and Stripe affiliates may engage third-party Sub-Processors in connection with the provision of the Services. Stripe or a Stripe affiliate will enter into a written agreement with the Sub-Processor imposing on the Sub-Processor data protection obligations comparable to those imposed on Stripe under this Agreement with respect to the protection of Personal Data. In case the Sub-Processor fails to fulfill its data protection obligations under such written agreement with Stripe, Stripe will remain liable to you for the performance of the Sub-Processor’s obligations under such agreement, except as otherwise set forth in the Stripe Agreement. By way of this DPA, the Data Controller provides general written authorization to Stripe as Data Processor to engage Sub-Processors as necessary to perform the Services.

You can view Stripe’s Privacy Policy here:https://stripe.com/gb/privacy

SECTION 6 - THIRD-PARTY SERVICES

In general, the third-party providers used by us will only collect, use and disclose your information to the extent necessary to allow them to perform the services they provide to us.

However, certain third-party service providers, such as payment gateways and other payment transaction processors, have their own privacy policies in respect to the information we are required to provide to them for your purchase-related transactions.

For these providers, we recommend that you read their privacy policies so you can understand the manner in which your personal information will be handled by these providers. Please review the url links above.

In particular, remember that certain providers may be located in or have facilities that are located a different jurisdiction than either you or us. So if you elect to proceed with a transaction that involves the services of a third-party service provider, then your information may become subject to the laws of the jurisdiction(s) in which that service provider or its facilities are located.

As an example, if you are located in the UK and your transaction is processed by a payment gateway located in the United States, then your personal information used in completing that transaction may be subject to disclosure under United States legislation, including the Patriot Act.

Once you leave our store’s website or are redirected to a third-party website or application, you are no longer governed by this Privacy Policy.

When you click on links on our store, they may direct you away from our site. We are not responsible for the privacy practices of other sites and encourage you to read their privacy statements.

Our store uses Google Analytics to help us learn about who visits our site and what pages are being looked at.

We share information relating to our users with selected third parties who perform services on our behalf and under our instruction (“Third Party Processors”). We ensure that any Third Party Processor which handles information on our behalf does so pursuant to contractual terms which require that the information is kept secure and, where that information contains any Personal Information, is processed in accordance with applicable data protection laws and used only as we have instructed and not for that Third Party Processor’s own purposes (unless you have explicitly consented to them doing so). We may disclose your information where necessary to enforce our Terms & Conditions or other agreements, or to a prospective buyer or ultimate buyer if Emporella itself is sold. We may also disclose your information if necessary to prevent, detect or prosecute illegal or suspected illegal activities or to prevent other damage or in response to a legal action against us or to enforce our rights and claims.

SECTION 7 – SECURITY

We make the confidentiality and security of your Personal Information our highest priority and we limit access to it to only those Emporella employees who need to come into contact with it in order to fulfil their role and enable the Emporella Services to be provided to you. We follow generally accepted standards to protect personal information submitted to us, both during transmission and after it is received. Your account information is protected by a password. It is important that you protect against unauthorised access to your account and information by choosing your password carefully and by keeping your password and computer secure, such as by signing out after using the platform. If you have any questions about the security of your personal information, you can contact us at [email protected]

To protect your personal information, we take reasonable precautions and follow industry best practices to make sure it is not inappropriately lost, misused, accessed, disclosed, altered or destroyed.

If you provide us with your credit card information, the information is encrypted using secure socket layer technology (SSL) and stored with a AES-256 encryption. Although no method of transmission over the Internet or electronic storage is 100% secure, we follow all PCI-DSS requirements and implement additional generally accepted industry standards.

Emporella does not store any credit card information. This is all held through our secure third-party Payments. 

The information we collect from you is stored on secure servers. However, any Personal Information we collect from you is only stored within servers located in the UK. Regardless of location, we ensure that adequate technical and organisational measures are in place to protect the security of any information we store on our servers.

Our Company will keep your inactive data for a period of 3 years. Once this time period has expired, we will delete your data.

SECTION 8 – COOKIES

Cookies are text files placed on your computer to collect standard Internet log information and visitor behaviour information. When you visit our websites, we may collect information from you automatically through cookies or similar technology.

For further information, visit allaboutcookies.org.

How do we use cookies?

Our Company uses cookies in a range of ways to improve your experience on our website, including:

  • Keeping you signed in
  • Understanding how you use our website

What types of cookies do we use?

There are a number of different types of cookies, however, our website uses:

  • Functionality – Our Company uses these cookies so that we recognise you on our website and remember your previously selected preferences. These could include what language you prefer and location you are in. A mix of first-party and third-party cookies are used.
  • Advertising – Our Company uses these cookies to collect information about your visit to our website, the content you viewed, the links you followed and information about your browser, device, and your IP address. Our Company sometimes shares some limited aspects of this data with third parties for advertising purposes. We may also share online data collected through cookies with our advertising partners. This means that when you visit another website, you may be shown advertising based on your browsing patterns on our website.

To view Magento’s cookies extensive list:https://docs.magento.com/m2/ce/user_guide/stores/cookie-reference.html

How to manage cookies

You can set your browser not to accept cookies, and the above website tells you how to remove cookies from your browser. However, in a few cases, some of our website features may not function as a result.

SECTION 9 - AGE OF CONSENT

By using this site, you represent that you are at least the age of majority in your state or province of residence, or that you are the age of majority in your state or province of residence and you have given us your consent to allow any of your minor dependents to use this site.

SECTION 10 - CHANGES TO THIS PRIVACY POLICY

We reserve the right to modify this privacy policy at any time, so please review it frequently. Changes and clarifications will take effect immediately upon their posting on the website. If we make material changes to this policy, we will notify you here that it has been updated, so that you are aware of what information we collect, how we use it, and under what circumstances, if any, we use and/or disclose it.

 

If our store is acquired or merged with another company, your information may be transferred to the new owners so that we may continue to sell products to you.

 

If you would like to: access, correct, amend or delete any personal information we have about you, register a complaint, or simply want more information contact our Privacy Compliance Officer at [email protected] > Emporella [Claire Amelia].

GDPR

  1. A) AIM

We are aware of the obligations placed on us by the General Data Protection Regulation (GDPR) in relation to processing data lawfully and to ensure it is kept securely.

One such obligation is to report a breach of personal data in certain circumstances and this policy sets out our position on reporting data breaches.

 

  1. B) PERSONAL DATA BREACH

A personal data breach is a breach of security leading to the accidental or unlawful destruction, loss,

alteration, unauthorised disclosure of, or access to, personal data transmitted, stored or processed.

The following are examples of data breaches:

  1. a) access by an unauthorised third party;
  2. b) deliberate or accidental action (or inaction) by a data controller or data processor;
  3. c) sending personal data to an incorrect recipient;
  4. d) computing devices containing personal data being lost or stolen;
  5. e) alteration of personal data without permission;
  6. f) loss of availability of personal data.

 

  1. C) BREACH DETECTION MEASURES

We have implemented the following measures to assist us in detecting a personal data breach:

Online services are checked fortnightly, passwords changed monthly.

 

  1. D) INVESTIGATION INTO SUSPECTED BREACH

In the event that we become aware of a breach, or a potential breach, an investigation will be carried out.

This investigation will be carried out by (Claire Amelia) who will make a decision over whether the breach is required to be notified to the Information Commissioner. A decision will also be made over whether the breach is such that the individual(s) must also be notified.

 

  1. E) WHEN A BREACH WILL BE NOTIFIED TO THE INFORMATION COMMISSIONER

In accordance with the GDPR, we will undertake to notify the Information Commissioner of a breach which is likely to pose a risk to people’s rights and freedoms. A risk to people’s freedoms can include physical, material or non-material damage such as discrimination, identity theft or fraud, financial loss and damage to reputation.

Notification to the Information Commissioner will be done without undue delay and at the latest within 72 hours of discovery. If we are unable to report in full within this timescale, we will make an initial report to the Information Commissioner, and then provide a full report in more than one instalment if so required.

 

The following information will be provided when a breach is notified:

  1. a) a description of the nature of the personal data breach including, where possible:
  2. i) the categories and approximate number of individuals concerned; and
  3. ii) the categories and approximate number of personal data records concerned
  4. b) the name and contact details of the compliance officer where more information can be obtained;
  5. c) a description of the likely consequences of the personal data breach;
  6. d) a description of the measures taken, or proposed to be taken, to deal with the personal data breach, including, where appropriate, the measures taken to mitigate any possible adverse effects.

 

  1. F) WHEN A BREACH WILL BE NOTIFIED TO THE INDIVIDUAL

In accordance with the GDPR, we will undertake to notify the individual whose data is the subject of a breach if there is a high risk to people’s rights and freedoms. A high risk may be, for example, where there is an immediate threat of identity theft, or if special categories of data are disclosed online.

This notification will be made without undue delay and may, dependent on the circumstances, be made before the supervisory authority is notified.

The following information will be provided when a breach is notified to the affected individuals:

  1. a) a description of the nature of the breach
  2. b) the name and contact details of the (delete as appropriate - data protection officer/ appointed compliance officer) where more information can be obtained
  1. c) a description of the likely consequences of the personal data breach and
  2. d) a description of the measures taken, or proposed to be taken, to deal with the personal data breach, including, where appropriate, the measures taken to mitigate any possible adverse effects.

 

  1. G) RECORD OF BREACHES

The Company records all personal data breaches regardless of whether they are notifiable or not as part of its general accountability requirement under GDPR. It records the facts relating to the breach, its effects and the remedial action taken.

 

 

SUBJECT ACCESS REQUEST POLICY

 

  1. A) AIM

You have a right, under the General Data Protection Regulation, to access the personal data we hold on you. To do so, you should make a subject access request, and this policy sets out how you should make a request, and our actions upon receiving the request.

 

  1. B) DEFINITIONS

“Personal data” is any information relating to an identifiable person who can be directly or indirectly identified in particular by reference to an identifier, including your name.

“Special categories of personal data” includes information relating to:

  1. a) race
  2. b) ethnic origin
  3. c) politics
  4. d) religion
  5. e) trade union membership
  6. f) genetics
  7. g) biometrics (where used for ID purposes)
  8. h) health
  9. i) sex life or
  10. j) sexual orientation.

 

  1. C) MAKING A REQUEST

Although subject access requests may be made verbally, we would advise that a request may be dealt with more efficiently and effectively if it is made in writing. If you wish to make a request, please email [email protected]

Requests that are made directly by you should be accompanied by evidence of your identity. If this is not provided, we may contact you to ask that such evidence be forwarded before we comply with the request.

Requests made in relation to your data from a third party should be accompanied by evidence that the third party is able to act on your behalf. If this is not provided, we may contact the third party to ask that such evidence be forwarded before we comply with the request.

 

  1. D) TIMESCALES

Usually, we will comply with your request without delay and at the latest within one month. Where requests are complex or numerous, we may contact you to inform you that an extension of time is required. The maximum extension period is two months.

 

  1. E) FEE

We will normally comply with your request at no cost. However, if the request is manifestly unfounded or excessive, or if it is repetitive, we may contact you requesting a fee. This fee must be paid in order for us to comply with the request. The fee will be determined at the relevant time and will be set at a level which is reasonable in the circumstances.

In addition, we may also charge a reasonable fee if you request further copies of the same information.

 

  1. F) INFORMATION YOU WILL RECEIVE

When you make a subject access request, you will be informed of:

  1. a) whether or not your data is processed and the reasons for the processing of your data;
  2. b) the categories of personal data concerning you;
  3. c) where your data has been collected from if it was not collected from you;
  4. d) anyone who your personal data has been disclosed to or will be disclosed to, including anyone outside of the EEA and the safeguards utilised to ensure data security;
  5. e) how long your data is kept for (or how that period is decided);
  6. f) your rights in relation to data rectification, erasure, restriction of and objection to processing;
  7. g) your right to complain to the Information Commissioner if you are of the opinion that your rights have been infringed;
  8. h) the reasoning behind any automated decisions taken about you.
  9. G) CIRCUMSTANCES IN WHICH YOUR REQUEST MAY BE REFUSED

We may refuse to deal with your subject access request if it is manifestly unfounded or excessive, or if it is repetitive. Where it is our decision to refuse your request, we will contact you without undue delay, and at the latest within one month of receipt, to inform you of this and to provide an explanation. You will be informed of your right to complain to the Information Commissioner and to a judicial remedy.

We may also refuse to deal with your request, or part of it, because of the types of information requested.

For example, information which is subject to legal privilege or relates to management planning is not required to be disclosed. Where this is the case, we will inform you that your request cannot be complied with and an explanation of the reason will be provided.

 

POLICY ON YOUR RIGHTS IN RELATION TO YOUR DATA

  1. A) AIM

This policy outlines the rights that data subjects have, under the General Data Protection Regulation (GDPR), in relation to the data about them that we hold. Data subjects, for the purposes of this policy, includes employees (current, prospective and former), workers and contractors.

 

  1. B) THE RIGHT TO BE INFORMED

In order to keep you informed about how we use your data, we have a privacy notice for employees. You can obtain a copy of the privacy notice from your manager.

The Company also has a separate privacy notice applicable to job applicants, available from your manager.

You will not be charged for receiving our privacy notices.

Our privacy notices set out:

  1. a) the types of data we hold and the reason for processing the data;
  2. b) our legitimate interest for processing it;
  3. c) details of who your data is disclosed to and why, including transfers to other countries. Where data is transferred to other counties, the safeguards used to keep your data secure are explained;
  4. d) how long we keep your data for, or how we determine how long to keep your data for;
  5. e) where your data comes from;
  6. f) your rights as a data subject;
  7. g) your absolute right to withdraw consent for processing data where consent has been provided and no other lawful reason for processing your data applies;
  8. h) your right to make a complaint to the Information Commissioner if you think your rights have been breached;
  9. i) whether we use automated decision making and if so, how the decisions are made, what this means for you and what could happen as a result of the process;
  10. j) the name and contact details of our data protection officer.

 

  1. C) THE RIGHT OF ACCESS

You have the right to access your personal data which is held by us. You can find out more about how to request access to your data by reading our Subject Access Request policy.

 

  1. D) THE RIGHT TO ‘CORRECTION’

If you discover that the data we hold about you is incorrect or incomplete, you have the right to have the data corrected. If you wish to have your data corrected, you should complete the Data Correction Form.

Usually, we will comply with a request to rectify data within one month unless the request is particularly complex in which case we may write to you to inform you we require an extension to the normal timescale. The maximum extension period is two months.

You will be informed if we decide not to take any action as a result of the request. In these circumstances, you are able to complain to the Information Commissioner and have access to a judicial remedy.

Third parties to whom the data was disclosed will be informed of the rectification.

 

  1. E) THE RIGHT OF ‘ERASURE’

In certain circumstances, we are required to delete the data we hold on you. Those circumstances are:

  1. a) where it is no longer necessary for us to keep the data;
  2. b) where we relied on your consent to process the data and you subsequently withdraw that consent.

Where this happens, we will consider whether another legal basis applies to our continued use of your data;

  1. c) where you object to the processing (see below) and the Company has no overriding legitimate interest to continue the processing;
  2. d) where we have unlawfully processed your data;
  3. e) where we are required by law to erase the data.

If you wish to make a request for data deletion, you should complete the Data Erasure form.

We will consider each request individually, however, you must be aware that processing may continue under one of the permissible reasons. Where this happens, you will be informed of the continued use of your data and the reason for this.

Third parties to whom the data was disclosed will be informed of the erasure where possible unless to do so will cause a disproportionate effect on us.

 

  1. F) THE RIGHT OF ‘RESTRICTION’

You have the right to restrict the processing of your data in certain circumstances.

We will be required to restrict the processing of your personal data in the following circumstances:

  1. a) where you tell us that the data we hold on you is not accurate. Where this is the case, we will stop processing the data until we have taken steps to ensure that the data is accurate;
  2. b) where the data is processed for the performance of a public interest task or because of our legitimate interests and you have objected to the processing of data. In these circumstances, the processing may be restricted whilst we consider whether our legitimate interests mean it is appropriate to continue to process it;
  3. c) when the data has been processed unlawfully;
  4. d) where we no longer need to process the data but you need the data in relation to a legal claim.

If you wish to make a request for data restriction, you should complete the Data Restriction form.

Where data processing is restricted, we will continue to hold the data but will not process it unless you consent to the processing or processing is required in relation to a legal claim.

Where the data to be restricted has been shared with third parties, we will inform those third parties of the restriction where possible unless to do so will cause a disproportionate effect on us.

You will be informed before any restriction is lifted.

 

  1. G) THE RIGHT TO DATA ‘PORTABILITY’

You have the right to obtain the data that we process on you and transfer it to another party. Where our technology permits, we will transfer the data directly to the other party.

Data which may be transferred is data which:

  1. a) you have provided to us; and
  2. b) is processed because you have provided your consent or because it is needed to perform the employment contract between us; and
  3. c) is processed by automated means.

If you wish to exercise this right, please speak to your manager.

We will respond to a portability request without undue delay, and within one month at the latest unless the request is complex or we receive a number of requests in which case we may write to you to inform you that we require an extension and reasons for this. The maximum extension period is two months.

We will not charge you for access to your data for this purpose.

You will be informed if we decide not to take any action as a result of the request, for example, because the data you wish to transfer does not meet the above criteria. In these circumstances, you are able to complain to the Information Commissioner and have access to a judicial remedy.

The right to data portability relates only to data defined as above. You should be aware that this differs from the data which is accessible via a Subject Access Request.

 

  1. H) THE RIGHT TO ‘OBJECT’

You have a right to require us to stop processing your data; this is known as data objection.

You may object to processing where it is carried out:

  1. a) in relation to the Company’s legitimate interests;
  2. b) for the performance of a task in the public interest;
  3. c) in the exercise of official authority; or
  4. d) for profiling purposes.

If you wish to object, you should do so by completing the Data Objection Form.

In some circumstances we will continue to process the data you have objected to. This may occur when:

  1. a) we can demonstrate compelling legitimate reasons for the processing which are believed to be more important than your rights; or
  2. b) the processing is required in relation to legal claims made by, or against, us.

If the response to your request is that we will take no action, you will be informed of the reasons.

 

  1. I) RIGHT NOT TO HAVE AUTOMATED DECISIONS MADE ABOUT YOU

You have the right not to have decisions made about you solely on the basis of automated decision making processes where there is no human intervention, where such decisions will have a significant effect on you.

However, the Company does not make any decisions based on such processes.

However, we may carry out automated decision making with no human intervention in the following circumstances:

  1. a) when it is needed for entering into or the carrying out of a contract with you;
  2. b) when the process is permitted by law;
  3. c) when you have given explicit consent.

In circumstances where we use special category data, for example, data about your health, sex life, sexual orientation, race, ethnic origin, political opinion, religion, and trade union membership the Company will ensure that one of the following applies to the processing:

  1. a) you have given your explicit consent to the processing; or
  2. b) the processing is necessary for reasons of substantial public interest.

 

DATA PROTECTION POLICY

  1. A) INTRODUCTION

We may have to collect and use information about people with whom we work. This personal information must be handled and dealt with properly, however it is collected, recorded and used, and whether it be on paper, in computer records or recorded by any other means.

We regard the lawful and correct treatment of personal information as very important to our successful operation and to maintaining confidence between us and those with whom we carry out business. We will ensure that we treat personal information lawfully and correctly.

To this end we fully endorse and adhere to the principles of the General Data Protection Regulation (GDPR).

This policy applies to the processing of personal data in manual and electronic records kept by us in connection with our human resources function as described below. It also covers our response to any data breach and other rights under the GDPR.

This policy applies to the personal data of job applicants, existing and former employees, apprentices, volunteers, placement students, workers and self-employed contractors. These are referred to in this policy as relevant individuals.

 

  1. B) DEFINITIONS

“Personal data” is information that relates to an identifiable person who can be directly or indirectly

identified from that information, for example, a person’s name, identification number, location, online identifier. It can also include pseudonymised data.

“Special categories of personal data” is data which relates to an individual’s health, sex life, sexual orientation, race, ethnic origin, political opinion, religion, and trade union membership. It also includes genetic and biometric data (where used for ID purposes).

“Criminal offence data” is data which relates to an individual’s criminal convictions and offences.

“Data processing” is any operation or set of operations which is performed on personal data or on sets of personal data, whether or not by automated means, such as collection, recording, organisation, structuring, storage, adaptation or alteration, retrieval, consultation, use, disclosure by transmission, dissemination or otherwise making available, alignment or combination, restriction, erasure or destruction.

 

  1. C) DATA PROTECTION PRINCIPLES

Under GDPR, all personal data obtained and held by us must be processed according to a set of core principles. In accordance with these principles, we will ensure that:

  1. a) processing will be fair, lawful and transparent
  2. b) data be collected for specific, explicit, and legitimate purposes
  3. c) data collected will be adequate, relevant and limited to what is necessary for the purposes of processing
  4. d) data will be kept accurate and up to date. Data which is found to be inaccurate will be rectified or erased without delay
  5. e) data is not kept for longer than is necessary for its given purpose
  6. f) data will be processed in a manner that ensures appropriate security of personal data including protection against unauthorised or unlawful processing, accidental loss, destruction or damage by using appropriate technical or organisation measures
  7. g) we will comply with the relevant GDPR procedures for international transferring of personal data

 

  1. D) TYPES OF DATA HELD

We keep several categories of personal data on our employees in order to carry out effective and efficient processes. We keep this data in a personnel file relating to each employee and we also hold the data within our computer systems, for example, our holiday booking system.

Specifically, we hold the following types of data:

  1. a) personal details such as name, address, phone numbers
  2. b) information gathered via the recruitment process such as that entered into a CV or included in a CV cover letter, references from former employers, details on your education and employment history etc
  3. c) details relating to pay administration such as National Insurance numbers, bank account details and tax codes
  4. d) medical or health information
  5. e) information relating to your employment with us, including:
  6. i) job title and job descriptions
  7. ii) your salary

iii) your wider terms and conditions of employment

  1. iv) details of formal and informal proceedings involving you such as letters of concern, disciplinary and grievance proceedings, your annual leave records, appraisal and performance information
  2. v) internal and external training modules undertaken

All of the above information is required for our processing activities. More information on those processing activities are included in our privacy notice for employees, which is available from your manager.

 

  1. E) EMPLOYEE RIGHTS

You have the following rights in relation to the personal data we hold on you:

  1. a) the right to be informed about the data we hold on you and what we do with it;
  2. b) the right of access to the data we hold on you. More information on this can be found in the section headed “Access to Data” below and in our separate policy on Subject Access Requests”;
  3. c) the right for any inaccuracies in the data we hold on you, however they come to light, to be corrected. This is also known as ‘rectification’;
  4. d) the right to have data deleted in certain circumstances. This is also known as ‘erasure’;
  5. e) the right to restrict the processing of the data;
  6. f) the right to transfer the data we hold on you to another party. This is also known as ‘portability’;
  7. g) the right to object to the inclusion of any information;
  8. h) the right to regulate any automated decision-making and profiling of personal data.

More information can be found on each of these rights in our separate policy on employee rights under GDPR.

 

  1. F) RESPONSIBILITIES

In order to protect the personal data of relevant individuals, those within our business who must process data as part of their role have been made aware of our policies on data protection.

We have also appointed employees with responsibility for reviewing and auditing our data protection systems.

 

  1. G) LAWFUL BASES OF PROCESSING

We acknowledge that processing may only be carried out where a lawful basis for that processing exists and we have assigned a lawful basis against each processing activity.

Where no other lawful basis applies, we may seek to rely on the employee’s consent in order to process data.

However, we recognise the high standard attached to its use. We understand that consent must be freely given, specific, informed and unambiguous. Where consent is to be sought, we will do so on a specific and individual basis where appropriate. Employees will be given clear instructions on the desired processing activity, informed of the consequences of their consent and of their clear right to withdraw consent at any time.

 

  1. H) ACCESS TO DATA

As stated above, employees have a right to access the personal data that we hold on them. To exercise this right, employees should make a Subject Access Request. We will comply with the request without

delay, and within one month unless, in accordance with legislation, we decide that an extension is required. Those who make a request will be kept fully informed of any decision to extend the time limit.

No charge will be made for complying with a request unless the request is manifestly unfounded, excessive or repetitive, or unless a request is made for duplicate copies to be provided to parties other than the employee making the request. In these circumstances, a reasonable charge will be applied.

Further information on making a subject access request is contained in our Subject Access Request policy.

 

  1. I) DATA DISCLOSURES

The Company may be required to disclose certain data/information to any person. The circumstances leading to such disclosures include:

  1. a) any employee benefits operated by third parties;
  2. b) disabled individuals - whether any reasonable adjustments are required to assist them at work;
  3. c) individuals’ health data - to comply with health and safety or occupational health obligations towards the employee;
  4. d) for Statutory Sick Pay purposes;
  5. e) HR management and administration - to consider how an individual’s health affects his or her ability to do their job;
  6. f) the smooth operation of any employee insurance policies or pension plans;
  7. g) to assist law enforcement or a relevant authority to prevent or detect crime or prosecute offenders or to assess or collect any tax or duty.

These kinds of disclosures will only be made when strictly necessary for the purpose.

 

  1. J) DATA SECURITY

All our employees are aware that hard copy personal information should be kept in a locked filing cabinet, drawer, or safe.

Employees are aware of their roles and responsibilities when their role involves the processing of data.

All employees are instructed to store files or written information of a confidential nature in a secure manner so that are only accessed by people who have a need and a right to access them and to ensure that screen locks are implemented on all PCs, laptops etc when unattended. No files or written information of a confidential nature are to be left where they can be read by unauthorised people.

Where data is computerised, it should be coded, encrypted or password protected both on a local hard drive and on a network drive that is regularly backed up. If a copy is kept on removable storage media, that media must itself be kept in a locked filing cabinet, drawer, or safe.

Employees must always use the passwords provided to access the computer system and not abuse them by passing them on to people who should not have them.

Personal data relating to employees should not be kept or transported on laptops, USB sticks, or similar devices, unless prior authorisation has been received. Where personal data is recorded on any such device it should be protected by:

  1. a) ensuring that data is recorded on such devices only where absolutely necessary.
  2. b) using an encrypted system — a folder should be created to store the files that need extra protection and all files created or moved to this folder should be automatically encrypted.
  3. c) ensuring that laptops or USB drives are not left where they can be stolen.

Failure to follow the Company’s rules on data security may be dealt with via the Company’s disciplinary procedure. Appropriate sanctions include dismissal with or without notice dependent on the severity of the failure.

 

  1. K) THIRD PARTY PROCESSING

Where we engage third parties to process data on our behalf, we will ensure, via a data processing agreement with the third party, that the third party takes such measures in order to maintain the Company’s commitment to protecting data.

 

  1. L) INTERNATIONAL DATA TRANSFERS

The Company does not transfer personal data to any recipients outside of the EEA and doesn’t transfer data outside of the studio in the Bridal Emporium.

Transfers may take place because (provide details on why transfer may have to take place). Where this occurs, the following safeguards are adopted (insert details eg binding corporate rules/standard data protection clauses/compliance with an approved code of practice etc).

 

  1. M) REQUIREMENT TO NOTIFY BREACHES

All data breaches will be recorded on our Data Breach Register. Where legally required, we will report a breach to the Information Commissioner within 72 hours of discovery. In addition, where legally required, we will inform the individual whose data was subject to breach.

More information on breach notification is available in our Breach Notification policy.

 

  1. N) TRAINING

New employees must read and understand the policies on data protection as part of their induction.

All employees receive training covering basic information about confidentiality, data protection and the actions to take upon identifying a potential data breach.

The nominated data controller/auditors/protection officers for the Company are trained appropriately in their roles under the GDPR.

All employees who need to use the computer system are trained to protect individuals’ private data, to ensure data security, and to understand the consequences to them as individuals and the Company of any potential lapses and breaches of the Company’s policies and procedures.

 

  1. O) RECORDS

The Company keeps records of its processing activities including the purpose for the processing and retention periods in its HR Data Record. These records will be kept up to date so that they reflect current processing activities.

 

  1. P) DATA PROTECTION COMPLIANCE

Our Data Protection Officer is:

Claire Amelia

[email protected]