The Cotton Bunting Company

Privacy Policy

Introduction: This privacy policy explains the types of your personal data that The Cotton Bunting Company (referred to as “we”, “our” or “us” in this policy) receive from Not On The High Street; how we use that data, and when we share it with other parties. The policy was last updated on 23/05/18.

The Legal Bases We Rely On: For the purposes of the General Data Protection Regulation (referred to in this policy as “the GDPR”), we are a Data Processor. Reasons for which we may process your personal data include:

Contract

We may need your personal data to comply with our contractual obligations. E.g. we will need your address and contact details to deliver your order, sort out any queries, and provide contact information to our courier.

Legal compliance

If the law requires us to, we may need to process your data. For example, we are required by HMRC to maintain certain records for tax purposes.

Personal Data We Receive: We receive personal data from Not On The High Street when you order or make an enquiry. This data includes your gender, name, billing address, delivery name and address, telephone number, and order details.

How We Use Your Personal Data: We use your personal data provided by Not On The High Street in order to

• process and dispatch your order

• respond to your queries, refund requests and complaints

• comply with our tax and accounting obligations

We do not use personal data that we receive from Not On The High Street for marketing.

How we protect your personal data: We treat your data with the utmost care and take all appropriate steps to protect it. Our order processing computer systems are password-protected and the data held by them is secured by encryption.

Any paper records we keep are stored in key-controlled areas accessible only to authorised members of staff who require such access.

How Long We Keep Your Personal Data: We retain personal data for tax and accounting purposes for 7 years.

Who We Share Your Personal Data With: We pass your personal data to third parties (such as couriers) to deliver your order and advise you of delivery estimates. We may pass order details (e.g. despatch updates) to Not On The High Street.

We won’t share your personal data with anyone else, unless:

• You ask us to do so

• We are required to do so by law or regulatory obligations

Data Subject Access Requests: Under the GDPR you are entitled to request a copy of your personal data that we may hold, and to have any inaccuracies in that data rectified. We are obliged to provide this data to you within 1 calendar month of the request and free of charge. However we have the right to refuse or charge for requests that are manifestly unfounded or excessive and repetitive.